Spring security is a great framework saving lots of time and effort from the developers. Also It is flexible enough to customize and bring it down to your needs. As spring evolves spring security involves too making it easier and more bootstrapping to setup up security in you project.
Spring Boot 2.0 is out there and we will take advantage of it for our security projects. On this Project we aim at creating an as simple security backed project as possible. To get started we shall create a simple spring boot 2.0 project.
We can use the spring SPRING INITIALIZR application.
The end result of the project would be to have a spring boot 2 project with gradle.
buildscript {
ext {
springBootVersion = '2.0.1.RELEASE'
}
repositories {
mavenCentral()
}
dependencies {
classpath("org.springframework.boot:spring-boot-gradle-plugin:${springBootVersion}")
}
}
apply plugin: 'java'
apply plugin: 'eclipse'
apply plugin: 'org.springframework.boot'
apply plugin: 'io.spring.dependency-management'
group = 'com.gkatzioura.security'
version = '0.0.1-SNAPSHOT'
sourceCompatibility = 1.8
repositories {
mavenCentral()
}
dependencies {
compile('org.springframework.boot:spring-boot-starter-security')
compile('org.springframework.boot:spring-boot-starter-web')
testCompile('org.springframework.boot:spring-boot-starter-test')
testCompile('org.springframework.security:spring-security-test')
}Now be aware that with Spring Boot 2 there are two stacks to go. Either the Servlet stack or the WebFlux reactive stack. On this tutorial we shall use the servlet stack. We will cover WebFlux on another tutorial.
Let’s go and add our first controller.
package com.gkatzioura.security.simple.controller;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class HelloWorldController {
@GetMapping("/hello")
public ResponseEntity<String> hello(String name) {
return new ResponseEntity<>("Hello "+name, HttpStatus.OK);
}
}If we try to access the endpoint http://localhost:8080/hello?name=john we will be presented with a login screen. Thus including the security dependency in our project auto secures our endpoints and configures a user with a password. In order to retrieve the password you can check at the login screen. The username would be ‘user’ and the password will be the one that spring autogenerates.
Of course using an autogenerated password is not sufficient, thus we are going to provide the username and the password of our choice.
One of the ways to set your username and password on the application.yaml file
spring:
security:
user:
name: test-user
password: test-passwordNow putting you passwords in the file system especially when not encrypted is not a good practice, let alone being uploaded in you version control since application.yaml is a source file. Also anyone with access to the binary can retrieve the username and password
Therefore instead of putting these sensitive information in the application.yaml file you can set them by using environmental variables.
So your environmental variables would be
SPRING_SECURITY_USER_NAME=test-user SPRING_SECURITY_USER_PASSWORD=test-password
To sum up this was the easiest and fastest way to add security to your project. On the next blog we will do the same but using the WebFlux reactive stack.
| Published on Java Code Geeks with permission by Emmanouil Gkatziouras, partner at our JCG program. See the original article here: Spring Security with Spring Boot 2.0: Simple authentication using the Servlet Stack Opinions expressed by Java Code Geeks contributors are their own. |
