🌱 Spring Boot Q22 / 56

How do you secure a Spring Boot application?

AI-Powered Answer ✓ Answered

Securing a Spring Boot application primarily involves integrating with Spring Security, a powerful and highly customizable framework providing authentication, authorization, and other security features for Java applications. It protects against common vulnerabilities like CSRF, session hijacking, and brute-force attacks.

Core Security Concepts

Authentication: Verifying the identity of a user or client.
Authorization: Determining if an authenticated user has permission to access a specific resource or perform an action.
CSRF Protection: Mitigating Cross-Site Request Forgery attacks, enabled by default.
Session Management: Securely handling user sessions, including protection against session fixation.
Password Encoding: Storing user passwords securely using strong hashing algorithms.

Implementation Steps with Spring Security

1. Add Spring Security Dependency

Include the spring-boot-starter-security dependency in your project's pom.xml (Maven) or build.gradle (Gradle).

xml

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

2. Basic Security Configuration (SecurityFilterChain)

For modern Spring Security (6+), security is configured by defining SecurityFilterChain beans. This example sets up basic form login, path authorization, and an in-memory user for demonstration.

java

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/public/**", "/error", "/login").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard", true)
                .permitAll()
            )
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password"))
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("adminpass"))
            .roles("ADMIN", "USER")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

3. Custom UserDetailsService (for Database/External Users)

For real-world applications, you will implement a custom UserDetailsService to fetch user details (username, password, roles) from a database or another external source.

java

import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.stereotype.Service;

import java.util.Collections;

@Service
public class CustomUserDetailsService implements UserDetailsService {

    private final PasswordEncoder passwordEncoder;

    public CustomUserDetailsService(PasswordEncoder passwordEncoder) {
        this.passwordEncoder = passwordEncoder;
    }

    // Assume you have a UserRepository to fetch user data from a DB
    // @Autowired
    // private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // In a real application, fetch user from a database
        // Example:
        // UserEntity userEntity = userRepository.findByUsername(username)
        //     .orElseThrow(() -> new UsernameNotFoundException("User not found: " + username));
        // return new User(userEntity.getUsername(), userEntity.getPassword(), userEntity.getRoles());

        // Placeholder logic:
        if ("johndoe".equals(username)) {
            return User.builder()
                       .username("johndoe")
                       .password(passwordEncoder.encode("secretpassword"))
                       .roles("USER")
                       .build();
        } else if ("janedoe".equals(username)) {
             return User.builder()
                       .username("janedoe")
                       .password(passwordEncoder.encode("anothersecret"))
                       .roles("USER", "MANAGER")
                       .build();
        } else {
            throw new UsernameNotFoundException("User not found: " + username);
        }
    }
}

4. Enable HTTPS/SSL

Always use HTTPS in production to encrypt communication between the client and the server. This can be configured in application.properties or application.yml.

properties

server.ssl.enabled=true
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=changeit
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=springboot

5. CSRF Protection

Spring Security enables CSRF protection by default for state-changing HTTP methods (POST, PUT, DELETE). Ensure your front-end sends the CSRF token with requests for these methods. For single-page applications (SPAs) or APIs, you might need to configure how the token is retrieved and sent.

6. Keep Dependencies Updated

Regularly update Spring Boot and Spring Security dependencies to patch known vulnerabilities, benefit from security enhancements, and ensure compatibility with the latest security standards.

← All Spring Boot questions