Spring Security Quick Start
In this section we will see how to introduce Spring Security in a typical Spring MVC application. It is to be noted that Spring Security not only works with Spring MVC, it works seamlessly with other web frameworks as well as other type of application according to the security requirements. This section considers introducing Spring Security in a web environment.
We will look at how to quickly add security to a web application using an out-of-the-box configuration using mainly default settings. In practice most things are highly configurable and the framework provides many powerful services. The underlying classes can also be easily extended to adapt their behavior. However, the aim here is to get up and running as quickly as possible without going into too much detail. Many Spring Beans will be created behind the scenes by the configuration we show, but you don’t need to know about these, at least not to begin with. Figure 15-11 below shows a typical working of Spring Security in action.
Figure 15-11. Working of Spring Security
The various steps required to add the Spring Security in a web environment is as summarized below:
1. Hooking Spring Security to the web application using the web deployment descriptor web.xml file. Configure the Spring Security filter and map it accordingly as shown in Listing 15-15 below. The name of the filter “springSecurityFilterChain” should be kept as is because the security framework uses this internally in many places as a Spring bean.
Listing 15-15. Configuring Spring Security filter in the web deployment descriptor file web.xml
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 |
<web-app …> … <!-- Spring Security --> <filter> <filter-name>springSecurityFilterChain</filter-name> <filter-class> org.springframework.web.filter.DelegatingFilterProxy </filter-class> </filter> <filter-mapping> <filter-name>springSecurityFilterChain</filter-name> <url-pattern>/*</url-pattern> </filter-mapping> </web-app> |
2. Include bare minimum Spring modules required into the project. The mandatory ones are as given below:
- spring-core-3.x.x.jar
- spring-web-3.x.x.jar
- spring-security-core-3.x.x.jar
- spring-security-web-3.x.x.jar
- spring-security-config-3.x.x.jar
If you are using Maven as the build tool, include these jars in the pom.xml file of your web project. Otherwise download these jars separately and include these in the web application’s WEB-INF/lib directory.
3. Configure the Spring Security configuration file, which can be split into various steps as summarized below:
a. Configure security namespace in the Spring Security configuration file as shown in Listing 15-16 below. In Listing 15-1 below the security namespace is set as the default, so you need not use the security namespace while using security related tags in this configuration file.
Listing 15-16. Security namespace in Spring Security configuration file
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 |
<beans:beans xmlns="http://www.springframework.org/schema/security" xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security- 3.0.3.xsd"> … </beans:beans> |
b. Web URL authorization configuration as shown in Listing 15-17 below.
Listing 15-17. Web URL authorization configuration
|
1 2 3 4 5 6 7 |
<http auto-config="true"> <intercept-url pattern="/admin*" access="ROLE_ADMIN"/> … </http> |
The “auto-config” attribute is actually a shorthand syntax for the following syntax as shown in Listing 15-18 below. we will be covering these cofiguration in the latter part of this Chapter.
Listing 15-18. Attribute auto-config is shorthand for the foloing syntax in Spring Security configuration
|
1 2 3 4 5 6 7 8 9 |
<http> <form-login /> <http-basic /> <logout /> </http> |
Page Visitors: 11022
Tomcy John
Latest posts by Tomcy John (see all)
- A Guide to Continuous Improvement for Architects - February 2, 2023
- Cloud-first Architecture Strategy - January 26, 2023
- Architecture Strategy and how to create One - January 24, 2023