Spring Boot Security: Core Fundamentals

This module demonstrates how to secure a Spring Boot application using the latest Spring Security 6 architecture. It moves away from the deprecated WebSecurityConfigurerAdapter and utilizes the modern SecurityFilterChain bean approach.

---

Technical Concepts

1. The Security Filter Chain

In Spring Security 6, the configuration is "functional." We define a SecurityFilterChain bean where we chain security rules.

• anyRequest().authenticated(): This is the most secure starting point—it locks every door by default.
• formLogin vs httpBasic: By enabling both, we allow human users to log in via a browser UI and programmatic clients (like our spring-client from earlier) to authenticate via headers.

2. Password Encoding with BCrypt

Storing passwords in plain text is a critical security failure.

• BCryptPasswordEncoder: This is a slow, "adaptive" hashing function. It automatically handles salting (adding random data to the password before hashing) to protect against rainbow table attacks.
• Work Factor: BCrypt is intentionally resource-intensive to make "brute-force" attacks prohibitively expensive for hackers.

3. CSRF (Cross-Site Request Forgery)

The code includes csrf(AbstractHttpConfigurer::disable).

• What is CSRF?: An attack where a malicious site tricks your browser into performing actions on a site where you are already logged in.
• Why disable it?: In stateless REST APIs (where we don't use session cookies for authentication), CSRF protection is often unnecessary and can interfere with POST/PUT requests from non-browser clients like Postman or mobile apps.

---

Component Reference

SecurityConfig.java

The heart of the security layer.

• @EnableWebSecurity: Activates Spring Security’s web security support.
• UserDetailsService: Defines our "User Database." For this demo, we use InMemoryUserDetailsManager, which is perfect for testing without a real database.

SecurityController.java

A simple REST controller used to verify security:

• GET /api/hello: Accessible after authentication.
• POST /api/update: Tests if the security configuration allows state-changing operations (verifies our CSRF settings).

---

How to Test

1. Start the App: Run SpringSecurityDemoApplication.
2. Browser Access: Navigate to http://localhost:8080/api/hello. You will be redirected to the default Spring Security login page.
   • Username: geek
   • Password: pass123
3. Basic Auth (Postman):
   • Create a GET request to http://localhost:8080/api/hello.
   • Go to the Auth tab, select Basic Auth, and enter the credentials.
4. Verify Logs: Because logging.level.org.springframework.security=DEBUG is enabled, you can see the internal "handshake" between the filters in your IDE console.

---

Output

When csrf is enable (by default)

INFO  --- [demo-app] : Initializing Spring DispatcherServlet 'dispatcherServlet'
DEBUG --- [demo-app] : Securing GET /api/hello
DEBUG --- [demo-app] : Authenticated user [PRINCIPAL_REDACTED]
DEBUG --- [demo-app] : Invalid CSRF token found for http://localhost:8080/api/update
DEBUG --- [demo-app] : Responding with 403 status code

When disable the csrf ( .csrf(AbstractHttpConfigurer::disable)

INFO  --- [demo-app] : Completed initialization in 24 ms
DEBUG --- [demo-app] : Securing POST /api/update
DEBUG --- [demo-app] : Authenticated user [PRINCIPAL_REDACTED]
DEBUG --- [demo-app] : Secured POST /api/update

)