Spring Boot Security Tutorial | REST & Web

In this Spring Boot Security tutorial I show you how to secure your RESTful endpoints & controllers with spring security.

I first start off my creating a standard spring boot project and add a couple of RESTful endpoints via spring’s @RestController and @RequestMapping annotations. At this stage spring security is not on the classpath so the URLs are all open to HTTP requests.

I then add the spring-boot-starter-security dependency to the classpath via a simple maven dependency and perform a project update. If spring security is on the classpath then the web application will automatically be secured with basic authentication on all HTTP endpoints when there is no bean annotated with @EnableWebSecurity. The default username and password is ‘user’ and a random UUID password is generated each time the application starts, you can see this in the start-up logs. Do not use this in production.

After showing the automatic spring security basic authentication on all endpoints, I then create a java class annotated with @EnableWebSecurity. The class SecurityConfig extends WebSecurityConfigurerAdapter and overrides the configure(HttpSecurity http) method. This method disables the default HTTP Spring Security and allows us to define our own fine grained http security on our RESTful endpoints. I specified that the ant path expressions endpoints must have the defined roles associated with the login credentials.

Within the bean annotated with EnableWebSecurity, I added and autowired an configureGlobal(AuthenticationManagerBuilder auth) method. This allows you to specify the type of authentication manager (LDAP, In-memory, Token based etc). I added two users with different roles and demo the application returning an http 403 unauthorized when an authenticated but unauthorized user attempted to access a specific endpoint.

I hope you enjoyed this introductory spring security with spring boot example! Give it a go!

Don’t forget to subscribe for more great tech videos :)

Till next time,
Phil

Filmed at Newcastle County Down, Slieve Donard. Mourne Mountains.

Links:

[bilal-jrsp]

You just gained a new subscriber ;), it put me in the right direction as I was so confused on how to implement a simple authentication scheme

[vinuthchandraboraiah]

Very good, Quick and crisp spring security implementation..

[deepakarul]

dude such a nice and fast explanation. crisp.. keep doing stuff like this.... :)

[anindya]

A very Nice tutorial for basic understanding of Spring security with REST api

[SoyJayP]

Awesome! Very clear explanation, this is what I needed

[aawesome]

Philip you are awesome. Keep up the good work.

[mohitbhagat]

Great Explanation!!! I have a question here, lets say we have many pages which will fall under category of /admin/ url. This will check/intercept on every call to the matching url pattern correct ? If yes then how it is more beneficial than introducing a Filter which too intercepts the requests on every call to a page.

[amandastacie]

Thank you so much! Your explanation was amazing, at least now I can get started and move on with securing my rest web application! Many thanks:)

[shivendrakishore]

Nice explanation philip. Can you also suggest some sites where i can find more starting tutorial for springboot security?

[peterwein]

Good! This was well explained and structured and leave me in the believe the author quite knows what he does... :-)

[nikilkaranjit]

can you please show how do we integrate webservice security and rest service security together i am totally new in spring boot

[ningzedai]

Hi Philip, thank you for your awesome video. Can you make a video on spring boot oauth 2.0 ? That will be very helpful. Cheers!

[gibranlara]

Hello Philip, thank you for the good tutorial! I have a question, how can i implement a register page and save the data in the database? Thank you so much again.

[annaright]

The explanation was awesome Philip.It will be very helpful if you make a video how to use jjwt tokens to use with spring oauth2.

[guitarDad]

Great beginner video for Spring Boot Authentication. Would it be possible to do one on AuthenticationManagerBuilder LDAP Example Spring boot? Thank you.

[kassymbekoff]

Hello, nice explanation of spring security. But it's not for the REST service. How can I access private URL with http request(headers, tokens)? I can't fill login form(for example mobile http request).

[ruixue]

6:26 add starter-security dependency
8:55 create a secure config class in the controller package

[harieducation]

Thanks Philip.This was given me good understanding of spring boot security.Is there any video for Spring boot, rest, jpa authentication .

[SSchithFoo]

Thank you. Do you happen to know how to implement CAS authentication with Springboot?

[memento]

Hey Philip, I have a question. I used your example and now I'd like to get rid of the form. I don't wan't to use any form, actually.
I plan to consume this web service ONLY with an angular2 remote front end or with a REST client like Postman.
When I try to replace .formLogin() by .httpBasic(), it messes up the authorisation system as the web service ask for authentication for both private and public paths. What would you advice me to use?
I've been browsing spring documentation, google and stackoverflow for hours.

Cheers mate
Have a good one