Spring Security Fundamentals - Lesson 7 - Method authorization - Part 1

In this stream, we discuss Spring Security using the latest available version in 2022. We'll discuss configurations for authentication and authorization, tips and tricks, how to learn Spring Security, vulnerabilities, OAuth 2, and many more.

[gamar]

I was just learning Spring and I put authorization in both the filter and on the method level and I was wondering why the method level isn't working. This is what in depth knowledge does. Thank you sir! You just saved me a lot of time with debugging.

[lunatichigh]

Thank you for sharing your knowledge with us.

[nimacode]

thanks to Olga Lugacheva for asking such an important question ! and thanks to laur to explain it clearly
🙂

[jolskey]

Hello Laurentiu. Why don't you write `isAuthenticated()` method inside @PreAuthorize annotation? Because probably I don't want to make user authenticated for all the endpoints. And also, is it mandatory to be authenticated to authorize? I would expect 403 in this case as well (If you haven't written `isAuthenticated()` anywhere, but used @PreAuthorize()). Thanks.

[KamilZgon]

Oh, I came back to this series after 1 week break and I was quite confused after this lesson about what I learned before. So I need to double check when and how I should use @EnableGlobalMethodSecurity (in previous lessons it was not used if I remember well) and how to mix configuration of the securityFilterChain with @PreAuthorize on the method level

[Lallushe]

I have a question. Can we have multiple @Configuration classes with which we can configure multiple controllers (for each controller to have SecurityFilterChain bean) or the SecurityFilterChain gets overridden every time we add a new bean of it. Or it just throws an exception if we attempt to have more than one?

[Joseph-oztx]

Laur, how we can write tests for PreAuthrize annotations ?

[rozkurt]

Hi, when I set permitAll() spesific endpoint, and I sent request with authentication, endpoint, which I set it permitAll, returned 401 code, but if I sent request without authentication returned 200 ok.

how can I handle it?

[VladShtaiier]

Hello, im just interested, are you Java Senior Engineer?

[ArfatBinkileb]

This video looks incomplete somehow. Maybe some issue while uploading?

[Joseph-oztx]

why video did the video cut after 35 min? I feel you was continuing to explain something else.

[davidkovacs]

As far as I know @EnableGlobalMethodSecurity is also deprecated now. Can I use @EnableMethodSecurity instead with the same parameters?