liveBookmanning.com

What you will learn in Spring Security in Action, Second Edition

by Laurentiu Spilca

Read it on liveBook Get the book at manning.com

Chapter by chapter

Concepts explained in this book

• authorizationAuthorization is the process of determining whether an authenticated entity has permission to perform an action or access a resource.
• PasswordEncoderPasswordEncoder is a Spring Security strategy for encoding passwords and matching supplied passwords against stored representations.
• Spring SecuritySpring Security is an open-source framework for securing Spring applications through authentication, authorization, access control, and protection against common attacks.
• AuthenticationProviderAuthenticationProvider is a Spring Security interface or component that encapsulates a specific authentication mechanism and returns an authentication result.
• UserDetailsServiceUserDetailsService is a Spring Security interface for retrieving user-specific data needed to authenticate a user.
• request matcherRequestMatcher is an API contract for determining whether an HTTP request matches specified request attributes.
• opaque tokenAn opaque token is an access token whose contents do not reveal claims or other usable information to the resource server, which must obtain its validity and associated details from the authorization server.
• authorization serverAn authorization server is the OAuth 2 component that issues tokens after processing an authorization grant and may provide identity-provider functions in OpenID Connect.
• csrf protectionCSRF protection is a web-security mechanism that prevents forged state-changing requests from an authenticated user's browser.
• method-level securityGlobal method security is a method-authorization capability that applies authorization rules across application methods.
• clientAn OAuth client is an application that requests authorization and accesses protected resources on behalf of a resource owner.
• resource serverA resource server is an OAuth server that hosts protected resources and accepts valid access tokens for authorized requests.
• basic authenticationHTTP Basic authentication is an HTTP authentication scheme that transmits a username and password using an Authorization header value containing Base64-encoded credentials.
• JSON Web TokenA JSON Web Token is a compact token format that represents claims as a digitally signed or otherwise protected JSON-based value.
• endpointAn endpoint is a network-accessible entry point representing an operation or resource in an application.
• CsrfTokenRepositoryCsrfTokenRepository is a Spring Security interface for generating, storing, retrieving, and invalidating CSRF tokens.
• application securityApplication-level security is the protection of an application's functionality, data, and communications from unauthorized access or misuse.
• filteringFiltering is a method-security technique that restricts method input parameters or returned results according to authorization rules.
• security contextA security context is a Spring Security object that holds authentication information associated with the current execution or request.
• UserDetailsUserDetails is a Spring Security representation of a user's identity, password, and granted authorities.
• custom authentication logicCustom authentication logic is application-defined processing that verifies a user's identity instead of relying entirely on a framework's default authentication behavior.
• servlet filterAn HTTP filter is a web-processing component that intercepts and can modify or reject HTTP requests and responses.
• encryptionEncryption is the transformation of readable data into ciphertext using a cryptographic key so that only authorized parties can recover the original data.
• @PreFilter@PreFilter is a Spring Security annotation that filters elements of a method input collection or array by evaluating an authorization expression before method invocation.
• oauth2ResourceServeroauth2ResourceServer is a Spring Security configuration method for enabling and configuring OAuth 2 resource-server authentication.
• token introspectionToken introspection is an OAuth protocol operation in which a resource server asks an authorization server whether a token is valid and requests its associated metadata.
• client credentials grant typeThe client credentials grant type is an OAuth 2 grant in which a client obtains an access token using its own credentials without user involvement.
• UserDetailsManagerUserDetailsManager is a Spring Security interface that extends UserDetailsService with operations for creating users and modifying or deleting user passwords.
• accessaccess() is an authorization configuration method that delegates request authorization to a supplied authorization decision function or manager.
• postfilteringPostfiltering is filtering applied to a method's returned data before the caller receives it.
• @PostAuthorizePostAuthorize is a Spring Security annotation that authorizes access to a method's result by evaluating an expression after the method executes.
• mutationA mutating operation is an application operation that changes stored data or other server-side state.
• authorization constraintAn authorization configuration is a set of rules that determines which authenticated or unauthenticated requests may access application functionality.
• roleA role is a named grouping of permissions or authorities used to represent an actor's access level.
• permitAllpermitAll is an authorization configuration method that grants access without requiring authentication.
• mock userA mock user is a test fixture that represents an authenticated user without performing the normal authentication process.
• public key set URIA key set endpoint is an authorization-server endpoint that exposes the cryptographic keys used to validate signed tokens.
• filter chainA filter chain is an ordered sequence of request-processing filters in which each filter can delegate processing to the next filter.
• authorizeHttpRequestsauthorizeHttpRequests is an HttpSecurity configuration method for defining authorization rules for HTTP requests.
• authentication managerReactiveAuthenticationManager is a Spring Security contract that performs authentication asynchronously in a reactive application.
• Base64Base64 encoding represents arbitrary binary data as characters from a fixed 64-symbol alphabet and provides no confidentiality.
• @PostFilter@PostFilter is a Spring Security method annotation that filters a method's returned collection or array according to a Spring Expression Language authorization expression.
• reactive applicationA reactive application is an application designed around asynchronous, nonblocking processing of streams of data and events.
• cross-site request forgeryCross-site request forgery is an attack that causes a user's authenticated browser to send an unintended state-changing request to a web application.
• CustomizerCustomizer is a Spring configuration functional interface whose callback applies customization to a framework configuration object.
• @WithMockUser@WithMockUser is a Spring Security test annotation that establishes a SecurityContext containing a configured mock authenticated user.
• @EnableMethodSecurity@EnableMethodSecurity is a Spring Security annotation that enables method-level authorization support and selected method-security annotations.
• InMemoryUserDetailsManagerInMemoryUserDetailsManager is a Spring Security UserDetailsService and UserDetailsManager implementation that stores user details in application memory.
• RequestPostProcessorA request postprocessor is a test component that modifies or prepares a simulated HTTP request before it is executed.
• HTTP Authorization headerThe HTTP Authorization header carries credentials or authentication tokens in an HTTP request.
• anyRequestanyRequest is an authorization configuration method that matches every HTTP request not matched by an earlier rule.
• CORSCross-origin resource sharing is a browser security mechanism that controls whether a web page may access resources from another origin.
• path expressionA path expression is a request-path pattern syntax for selecting endpoint requests based on their URL structure.
• MonoMono is a Reactor type representing an asynchronous computation that emits zero or one item.
• hash functionA hashing algorithm deterministically transforms input data into an output from which the original input is intended to be impractical to recover.
• GrantedAuthorityGrantedAuthority is a Spring Security interface representing an authority granted to an authenticated principal.
• preauthorizationPreauthorization is authorization checking performed before a protected method executes, preventing the call when its conditions are not satisfied.
• Spring Authorization ServerSpring Security Authorization Server is a Spring-based library for implementing OAuth 2.0 and OpenID Connect authorization servers.
• CsrfTokenRequestHandlerCsrfTokenRequestHandler is a Spring Security interface for managing how a generated CSRF token is associated with an HTTP request.
• SecurityWebFilterChainSecurityWebFilterChain is a Spring Security interface representing an ordered chain of reactive web security filters that processes server exchanges.
• client idA client identifier is an externally visible value that uniquely identifies an OAuth client to an authorization server.
• securitySoftware security is the protection of software applications and their data against unauthorized access, misuse, disruption, and other security threats.
• grant typeA grant type is an OAuth 2 protocol flow by which a client obtains a token from an authorization server.
• openid connectoidc is a configuration method that enables OpenID Connect support in an authorization server.
• prefilteringPrefiltering is filtering applied to a method's input parameters before the method receives them.
• postauthorizationPostauthorization is authorization evaluation performed after a method executes, using the method's returned value to decide whether the caller may receive it.
• CsrfTokenRequestAttributeHandlerCsrfTokenRequestAttributeHandler is a Spring Security implementation that exposes a generated CSRF token as an HTTP request attribute.
• JWKSourceJWKSource is a component that supplies JSON Web Keys for cryptographic operations such as signing authorization-server tokens.
• RegisteredClientRepositoryRegisteredClientRepository is a Spring Security Authorization Server interface for storing and retrieving registered OAuth clients and their configurations.
• oauth2 loginOAuth 2 login is an authentication flow in which an application obtains a user's identity through an OAuth 2 provider.
• HttpSecurityHttpSecurity is a Spring Security configuration API for defining servlet-based web authentication, authorization, and protection settings.
• JdbcUserDetailsManagerJdbcUserDetailsManager is a Spring Security UserDetailsService and UserDetailsManager implementation that stores and manages user details through JDBC and a relational database.
• PermissionEvaluatorPermissionEvaluator is a Spring Security interface for evaluating whether an authenticated principal has permission on a target object or operation.
• form-based loginForm-based login is an authentication method in which a user submits credentials through an application-provided login form.
• client authentication methodA client authentication method is the protocol mechanism an OAuth client uses to authenticate when calling a provider's secured endpoints.
• Spring Security UserUser is a Spring Security class representing an authenticated user's username, password, and authorities.
• authorization code flowThe authorization code grant type is an OAuth flow in which a client obtains a token through an authorization code, commonly after user authentication.
• client credentialA client credential is secret or otherwise verifiable information that identifies an OAuth client to an authorization system.
• CsrfFilterCsrfFilter is a Spring Security filter that processes protection against cross-site request forgery.
• supports()supports() is an AuthenticationProvider method that reports whether the provider can handle a specified Authentication type.
• AuthorizationManagerAuthorizationManager is a Spring Security contract for evaluating whether an authenticated principal is authorized for an object or request.
• hasauthorityhasAnyAuthority() is an authorization configuration method that permits a request when the user has at least one authority from a specified set.
• WebExpressionAuthorizationManagerWebExpressionAuthorizationManager is a Spring Security AuthorizationManager implementation that evaluates web authorization decisions from Spring Expression Language expressions.
• hasPermission()hasPermission() is a Spring Security expression that delegates an authorization decision to a permission evaluator for a specified object or identifier.
• MethodSecurityExpressionHandlerMethodSecurityExpressionHandler is a Spring Security interface for creating and configuring expression evaluation for method-level security.
• @RolesAllowed@RolesAllowed is a JSR-250 security annotation that restricts access to methods based on the roles assigned to the caller.
• @Secured@Secured is a Spring Security annotation that restricts access to methods or classes based on configured security attributes.
• MockMvcMockMvc is a Spring testing utility that performs simulated HTTP requests against MVC application components without requiring a running server.
• AuthorizationServerSettingsAuthorizationServerSettings is a Spring Security Authorization Server object for configuring the paths and general settings of an authorization server.
• OAuth2AuthorizationServerConfigurerOAuth2AuthorizationServerConfigurer is a Spring Security Authorization Server configuration API for configuring OAuth 2 authorization-server protocol endpoints and features.
• RegisteredClientRegisteredClient is a Spring Security Authorization Server object that describes a client known to an authorization server.
• authorization server protocol configurationAuthorization server protocol configuration is the security configuration that defines and customizes an authorization server's protocol endpoints and capabilities.
• custom authentication objectA custom authentication object is an application-defined authentication-token subtype that carries identity, authorities, and additional authentication data.
• LdapUserDetailsManagerLdapUserDetailsManager is a Spring Security UserDetailsManager implementation that retrieves and manages user details in an LDAP directory.
• reactive programmingReactive programming is a programming paradigm based on asynchronous processing of streams of data and events, typically to support nonblocking and concurrent execution.
• @SpringBootTest@SpringBootTest is a Spring Boot test annotation that loads an application context for integration testing.
• authorizeExchange()authorizeExchange() is a ServerHttpSecurity configuration method for defining authorization rules for reactive server exchanges.
• ServerHttpSecurityServerHttpSecurity is a Spring Security reactive configuration builder for defining web authentication, authorization, and protection settings.
• NoOpPasswordEncoderNoOpPasswordEncoder is a Spring Security PasswordEncoder implementation that leaves passwords in cleartext instead of applying one-way encoding.
• client secretA client secret is confidential information a client presents to authenticate itself to an authorization server.
• MVC matcherMvcRequestMatcher is a Spring Security request matcher that evaluates paths using Spring MVC request-mapping conventions.
• query filteringDatabase-level filtering is the application of selection criteria within a database query so that only permitted records are returned.
• authentication filterAn authentication filter is a request-processing component that intercepts authentication requests and delegates them to an authentication mechanism.
• HTTPSHTTPS is HTTP transmitted through TLS to provide encrypted communication and server authentication.
• formLoginformLogin is a Spring Security configuration method that enables authentication through an HTML form-based login flow.
• data at restData at rest is persisted information stored in computer storage rather than being transmitted between systems.
• OAuthOAuth 2 is an authorization framework specification for delegated access to protected resources using access tokens.
• servlet request attributeA request attribute is a named value attached to an HTTP request for access by components processing that request.
• spring-boot-starter-securityspring-boot-starter-security is a Spring Boot dependency bundle that adds Spring Security to an application.
• BCryptPasswordEncoderBCryptPasswordEncoder is a Spring Security PasswordEncoder implementation that encodes passwords with the bcrypt password-hashing function.
• SCryptPasswordEncoderSCryptPasswordEncoder is a Spring Security PasswordEncoder implementation that encodes passwords with the scrypt password-hashing function.
• regular expressionA regular expression is a pattern notation for matching character sequences and strings according to specified textual rules.
• SecurityEvaluationContextExtensionSecurityEvaluationContextExtension is a Spring Security extension that exposes security evaluation context information to Spring Expression Language expressions used by data queries.
• Spring Data repositoryA Spring Data repository is an interface-based abstraction that provides data-access operations for an underlying data store.
• SQLA database query is a structured request to retrieve or modify data in a database.
• AuthorizationContextAuthorizationContext is a reactive Spring Security object that provides information about the server exchange being authorized.
• AuthorizationDecisionAuthorizationDecision is a Spring Security result object that indicates whether an authorization request is permitted.
• endpoint authorizationEndpoint authorization is authorization enforcement applied by matching incoming requests at web application endpoints.
• pathMatchers()pathMatchers() is a reactive authorization configuration method that matches server exchanges according to request paths and related attributes.
• jwkSetUrijwkSetUri is a JWT resource-server configuration method that specifies the URI from which public signing keys are obtained.
• public key setA public key set is a collection of public cryptographic keys available for verifying digital signatures.
• introspection uriAn introspection endpoint is an OAuth endpoint that accepts requests to validate a token and return its associated metadata.
• httpBasichttpBasic is an HttpSecurity configuration method that enables HTTP Basic authentication.
• SecurityContextHolderSecurityContextHolder is the Spring Security holder that associates a security context with the current execution thread or other configured scope.
• client registrationA client registration is the configured association of an OAuth client with its provider, credentials, redirect URI, and requested scopes.
• ANT syntaxANT syntax is a path-pattern notation that uses wildcard expressions to match hierarchies of path segments.
• FluxFlux is a Project Reactor publisher that emits zero or more values asynchronously.
• imperative approachAn imperative approach processes a bulk of available data as a whole rather than incrementally as data arrives.
• Project ReactorProject Reactor is a Java library that provides reactive programming types and operators for composing asynchronous streams.
• reactive streamThe Reactive Streams specification defines standard contracts for asynchronous stream processing with bounded resource usage.
• claimA claim is a named assertion about a subject or other token property carried in a JSON Web Token.
• SecurityFilterChainSecurityFilterChain is a Spring Security component that processes HTTP requests through security filters and applies web security rules.
• access-control-allow-methodsAccess-Control-Allow-Methods is an HTTP response header that specifies the HTTP methods permitted for cross-origin requests.
• Access-Control-Allow headersAccess-Control-Allow-Origin is an HTTP response header that specifies which origins may access a resource through cross-origin requests.
• preflight requestA preflight request is a browser-generated HTTP request that tests whether a cross-origin request is permitted before the browser sends the original request.
• OAuth2AuthorizedClientManagerOAuth2AuthorizedClientManager is a Spring Security component that manages authorized clients and obtains access tokens by executing OAuth 2 grant flows.
• hidden fieldA hidden input is an HTML form control whose value is submitted with the form but is not displayed to the user.
• ReactiveUserDetailsServiceReactiveUserDetailsService is a Spring Security contract that retrieves user details asynchronously for authentication in a reactive application.
• addFilterAtaddFilterAt is a Spring Security HttpSecurity method that inserts a filter at the position associated with another filter class.
• static keyA static key is a fixed secret value presented by a client to identify itself to an application.
• ClientRegistrationRepositoryClientRegistrationRepository is a Spring Security component that stores and retrieves OAuth 2 client registration details.
• user managementUser management is the administration of user identities, credentials, and related account information in an application.
• authorization endpointAn authorization endpoint is an OAuth endpoint where a client initiates an authorization request and a resource owner's authorization is obtained.
• openid configuration endpointAn OpenID configuration endpoint publishes an OpenID Connect provider's supported endpoints and protocol configuration metadata.
• token endpointA token endpoint is an OAuth endpoint where a client exchanges a grant or credential for tokens.
• DelegatingPasswordEncoderDelegatingPasswordEncoder is a Spring Security PasswordEncoder implementation that selects another password encoder according to an identifier in the stored password representation.
• hash prefixA hash prefix is an identifier prepended to a stored password hash to indicate which password encoder produced it.
• @PreAuthorize@PreAuthorize is a Spring Security annotation that authorizes a method invocation by evaluating a Spring Expression Language expression before the method runs.
• JWT authentication converterA JWT authentication converter is a converter that transforms a decoded JWT into an application-specific authentication object.
• JwtAuthenticationTokenJwtAuthenticationToken is a Spring Security authentication-token class representing an authenticated principal derived from a JWT.
• OAuth2TokenCustomizerOAuth2TokenCustomizer is a Spring Authorization Server callback interface for modifying OAuth 2 token claims or other token attributes before issuance.
• Proof Key for Code ExchangeProof key for code exchange is an OAuth extension that binds an authorization-code exchange to a client-generated secret to mitigate code interception.
• mode_threadlocalMODE_THREADLOCAL is a SecurityContextHolder strategy mode that stores the security context in the current thread's local storage.
• hasAnyRole()hasAnyRole() is an authorization configuration method that permits access when the user has at least one role from a specified set.
• hasRole()hasRole() is an authorization configuration method that permits access when the user has a specified role.
• ROLE_ prefixThe ROLE_ prefix is the naming convention Spring Security uses to distinguish role authorities from other authorities.
• roles()roles() is a Spring Security User builder method that creates role authorities and adds the ROLE_ prefix to supplied role names.
• browserA web browser is client software that retrieves, renders, and executes web resources on behalf of a user.
• HTTP headerAn HTTP header is a field in an HTTP request or response that conveys metadata or control information.
• originAn origin is the scheme, host, and port tuple that identifies the security context of a web resource.
• Spring Expression LanguageSpring Expression Language is an expression language for querying and manipulating object graphs within Spring applications.
• vulnerabilityA weakness in an application that permits unauthorized use of data or functionality or allows the application to affect other systems.
• authentication manager resolverauthenticationManagerResolver() is a Spring Security configuration method that supplies an authentication manager resolver for resource-server authentication.
• authentication errorAn authentication failure is a failure to verify the identity represented by credentials submitted with a request.
• cryptographic saltA salt is additional key-like data combined with an input before a hashing or cryptographic operation to make repeated inputs produce distinct results.
• denyAlldenyAll is a Spring Security authorization configuration method that denies access to every request matched by a rule.
• aspectAn aspect is a modular unit that encapsulates behavior applied across selected program execution points, commonly by intercepting method calls.
• MapReactiveUserDetailsServiceMapReactiveUserDetailsService is a Spring Security ReactiveUserDetailsService implementation that stores user details in memory.
• ReactiveSecurityContextHolderReactiveSecurityContextHolder is the Spring Security holder that provides access to the security context through reactive execution context rather than thread-local storage.
• RegexRequestMatcherRegexRequestMatcher is a Spring Security request-matching implementation that selects requests whose paths satisfy a regular expression.
• revocationToken revocation is the process of invalidating a token before its normal expiration so that it can no longer be used.
• pbkdf2PBKDF2 is a password-based key-derivation standard that repeatedly applies a pseudorandom function to derive a cryptographic key from a password and salt.
• Pbkdf2PasswordEncoderPbkdf2PasswordEncoder is a Spring Security PasswordEncoder implementation that derives password representations using PBKDF2.
• StandardPasswordEncoderStandardPasswordEncoder is a deprecated Spring Security PasswordEncoder implementation that hashes passwords with SHA-256 and an optional secret.
• oauth2Clientoauth2Client is an HttpSecurity configuration method that enables an application to operate as an OAuth 2 client.
• MODE_INHERITABLETHREADLOCALMODE_INHERITABLETHREADLOCAL is a Spring Security security-context strategy mode that makes a thread's context available to child threads through inheritable thread-local storage.
• scopeAn OAuth scope is a named permission value that limits the access or identity information requested by a client.
• call authorizationCall authorization is method-level authorization that decides whether a method may be called or whether its returned value may be accessed.
• getAuthorities()getAuthorities() is a UserDetails method that returns the authorities granted to the user.

These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.