Spring Security - Lesson 31 - Securing reactive apps

The Spring Security stream will teach you how to use Spring Security, from the basic authentication and authorization architecture to using OAuth 2.

[roman_mf]

Hello Laur, thank you for sharing you knowledge. Although the video is a bit dated, but the question still holds for today: in non-reactive Spring Security, we have .userDetailsService() instance method to set up UserDetailsService, however ServerHttpSecurity lacks this method. So, we can only set it up by defining ReactiveUserDetailsService bean?

[lunatichigh]

Sorry if this is out of the topic, but I've seen few videos where the tutor used ResponseBody to wrap the return object. My question is what do you prefer to return between these two in a REST API?

1. ResponseEntity<Mono<T>>
2. Mono<ResponseEntity<T>>

[acronis]

how about some lessons about enabling https or maybe authentication (or even authorization if it's not too hard) with certificates?

[emilwozniak]

It took me some time to undenstand Reactive Security and org.springframework.web.reactive.function.server.router, therefore I would like to share what I found:

Because router doesn't allow us to inject Authorization, but we do have principals inside the request inself.

Kotlin example:

router {
"/demo".nest {
"".nest {
GET { request ->
request.principal().flatMap { principal ->
ok().bodyValue("Hello ${principal.name}")
}
}
}
}
}

Hope that helps someone