Going Full OAuth with the new Spring Authorization Server in Spring Boot 3.1! #oauth2 #oauth

Hi, Spring fans! We're doin' it! We're looking at the new Spring Authorization Server auto-config in the just-released Spring Boot 3.1, and I'll be joined by Spring Security legend Steve Riesenberg

[mrcoder]

You guys are just amazing, I was blushing all the time. Great learning experience :)

[alltechtrickstips]

Josh acted like he doesn't knw 😂! Pretty entraining and easy grasping content! We really waited for Spring Authorization server to be in spring eco-system! Excellent content but plz upload in high resolution

[janyoussef]

Security is hard, after watching the video it hasn't gotten any easier 🤣, but if you can do all this in 1 hour, then it's certainly manageable for the rest of us 👍.
Kudos to the Spring team for this great effort 🔥.

[rkalyankumar]

Thanks guys. This video actually cleared most of the doubts I had with the authorisation server. Awesome!

[blacky]

And what if fe have auth server and resource server in same app and we use symmetric key?

[markostrisko]

First of all, guys, amazing video, I enjoyed it all the way from the beginning till the end.
One question in my mind right now. How flexible is SAS for changing the view (HTML & CSS) of the Login page or Consent page as well?
I remember having so many troubles doing those things with Cognito or Keycloak, I really hope SAS gives more flexibility.
Thanks and all the best to you guys.

[julianjupiter]

Hoping for a follow-up discussion or tutorial with how UI app (Angular or React.js) works with it.

[sivlayyi]

Hello, josh. Could we config of that in the same module without splitting in subprojects?

[treefrog]

I tried doing this exact implementation, but I containerized it using docker compose, and I'm constantly getting bad client?
I wonder if there's something additional required.

[fqvjkqq]

Great video. Very informative. I am running into issues though. On form login I keep getting an error with status 999. This occurs after the post. Any advice or general direction to check? I do have it on stackoverflow which has a lot more detail (such as pom.xml and config file). Thanks and keep up the great work!!

[vipinkoul]

Very awesome. Can you please help understand when should we use access_token Bearer token as opposed to API Key's? Sometimes API's are secured using API's key (api key and secret key combinations) instead of access_token Bearer token ; can you please help explain.

[arjitmishra]

Thanks for great overview.
I have one question, is authorization_code flow is PKCE enabled?

[navkkrnair]

By just following you, I was able to successfully complete the authorization_code workflow. The only difference is, my resource server is an mvc, not rest. Now when I try to post a form, I get "An expected CSRF token cannot be found" with status code 403. As I am using thymeleaf, csrf is already there in the form. Any suggestion?

[jackfrosch]

Great stuff, Josh and Steve. The worst part seems to be all the config, which is mostly a one-off.

Speaking of security... I recommend moving off LastPass because of its poor security practices. We switched from LP to 1Password and really love it. Migration is easy and it is feature rich.

[divyashreeb.l]

Amazing content...Can we use revoke endpoint for logout? Or please suggest how to handle logout..

[cloudsquall]

Thank you for the presentation!
I have a (genuine) question: Why would I use Spring Authorization Server instead of, say, Keycloak?
Could you give some pros/cons?

[NadaP.]

Thank you for the demo. It looks simple enough but I'm still confused about how to apply it to my own app. When securing a rest api that is consumed by a separate client app, can the authorization server live inside the rest api and serve the oauth endpoints on the same port as my rest api? Do I need the resource server in there as well? Would the client app use authorization_code grant type? Could you point me to some info on this? Appreciate the help!

[subaratatubebd]

I already watched out many videos like your, But I can't figure out how to register new users through the API. All are doing the same (In Memory User), a single admin user by coding and fixed. So I wanted to know how to register more than one users on Auth server through API like "api/auth/register". Hope you get my point and pls answer me.

[TaiChiSWAG]

This video is amazing, how do you able to execute "uao resourceserver.zip" and "http" and some other custom command, Have you created any aliases or custom scripts?

[keithleo-smith]

Using Spring Security and Auth Server is there an easy way to generate an access token programatically?