Hands-On Spring Security 5 for Reactive Applications: Learn effective ways to secure your apps with Spring and Spring WebFlux

Cover
Title Page
Copyright and Credits
Dedication
Packt Upsell
Contributors
Table of Contents
Preface
Chapter 1: Overview of Spring 5 and Spring Security 5
	How examples are structured
	New-generation application requirements
	Reactive programming
	Reactive applications
		Reactive Manifesto
			Responsive
			Resilient
			Elastic
			Message-driven
	Spring Framework
	Reactive Landscape in Java
		Reactive Streams and Reactive Streams Specifications
			Non-blocking
			Backpressure
		Reactive Extensions
			RxJava
		Reactive Streams and RxJava
		JDK 9 additions
			Important interfaces
				The Publisher Interface
				The Subscriber Interface
				The Subscription interface
				The Processor interface
	Spring Framework and reactive applications
		Modules in Reactor
			Reactive types in Reactor Core
				The Flux reative type
				The Mono reactive type
			Data stream types
			Reactor and RxJava
		Reactive Web Application
			Spring WebFlux
				Reactive Spring Web
			WebClient
			WebSockets
	Application security
	Spring Security
		Spring Security terminologies
	Spring Security's core features
		Authentication
		Authorization
	Spring Security 5's new features
	Working of Spring Security
		Servlet Filter
		Filter Chain
		Security Interceptor (DelegatingFilterProxy)
	Core Spring Security modules
	Summary
Chapter 2: Deep Diving into Spring Security
	Authentication
		Setting up AuthenticationManager
		AuthenticationProvider
			Custom AuthenticationProvider
			Multiple AuthenticationProvider
	Sample application
		Base project setup
			Step 1—Create a Maven project in IntelliJ IDEA
			Step 2—pom.xml changes
			Step 3—MySQL database schema setup
			Step 4—Setting up MySQL database properties in your project
			Step 5—Spring application configuration
			Step 6—Web application configuration
			Step 7—Spring MVC setup
			Step 8—Controller setup
			Step 9—JSP creation
		Spring Security setup
			Step 1—Spring Security configuration setup
			Step 2—Spring Security setup for a web application
		Running the application
		In-memory user storage
		Run as Spring Boot
	Authorization
		Web URL
		Method invocation
		Domain instance
	Other Spring Security capabilities
	Summary
Chapter 3: Authentication Using SAML, LDAP, and OAuth/OIDC
	Security Assertion Markup Language
		Setting up an SSO provider
		Setting up the project
			The pom.xml file setup
			The application.yml file setup
			The Spring Security configuration files
			The resources folder setup
		Running and testing the application
	Lightweight Directory Access Protocol
		Set up dependencies in the pom.xml file
		Spring Security configuration
		LDAP server setup
			Setting up users in the LDAP server
		Running the application
			Seeing the application in action on a browser
	OAuth2 and OpenID Connect
		Setting up a project
			Bootstrap Spring project using Spring Initializr
			Inclusion of OAuth libraries in pom.xml
			Setting up provider details in application.properties
		Provider setup
		Default application change
			The HomeController class
			The home.jsp file
			Spring Boot main application class change
		Running the application
	Summary
Chapter 4: Authentication Using CAS and JAAS
	CAS
		CAS server setup
			Git clone
			Adding additional dependencies
			Setting up the resources folder in the project
			Creating the application.properties file
			Creating a local SSL keystore
			Creating the .crt file to be used by the client
			Exporting the .crt file to Java and the JRE cacert keystore
			Building a CAS server project and running it
		Registering a client with the CAS server
			JSON service configuration
			Additional application.properties file changes
		CAS client setup
			Bootstrap Spring project using Spring Initializr
			Including CAS libraries in pom.xml
			Changing the application.properties file
			Additional bean configuration
				ServiceProperties bean
				AuthenticationEntryPoint bean
				TicketValidator bean
				CasAuthenticationProvider bean
			Setting up Spring Security
				Creating the CasAuthenticationFilter bean
			Setting up the controller
		Running the application
	Java Authentication and Authorization Service
		Setting up a project
			Setting up Maven project
			Setting up LoginModule
			Setting up a custom principal
			Setting up a custom AuthorityGranter
			Configuration files
				Application configuration
				Spring MVC configuration
				Spring Security configuration
				Controllers
				Setting up pages
		Running the application
	Kerberos
	Custom AuthenticationEntryPoint
		Multiple AuthenticationEntryPoint
	PasswordEncoder
		Salt
	Custom filters
	Summary
Chapter 5: Integrating with Spring WebFlux
	Spring MVC versus WebFlux
		When to choose what?
	Reactive support in Spring 5
		Reactive in Spring MVC
	Spring WebFlux
		HandlerFunction
		RouterFunction
		Spring WebFlux server support
		Reactive WebClient
		Reactive WebTestClient
		Reactive WebSocket
	Spring WebFlux authentication architecture
	Spring WebFlux authorization
	Sample project
		WebFlux project setup
			Maven setup
			Configuration class
				The SpringWebFluxConfig class
			Repository
			Handler and router
			Bootstrap application
			Running the application
		Adding security
			Configuration classes
				The UserDetailsService bean
				The SpringSecurityFilterChain bean
			Running the application
				CURL
				Browser
		WebClient
			Maven setup
			Creating a WebClient instance
			Handling errors
			Sending requests and retrieving responses
			Running and testing the application
		Unit testing (WebTestClient)
			Maven dependency
			Test class
		Spring Data
			Maven dependency
			MongoDB configuration
			Setting up a model
			Implementing a repository
			Implementing a controller
			Running the application
		Authorization
			Method security
	Customization
		Writing custom filters
			Using WebFilter
			Using HandlerFilterFunction
	Summary
Chapter 6: REST API Security
	Important concepts
		REST
		JSON Web Token (JWT)
			Structure of a token
				Header
				Payload
				Signature
	Modern application architecture
		SOFEA
	Reactive REST API
	Simple REST API security
		Spring Security configuration
		Authentication success handler
		Custom WebFilter namely JWTAuthWebFilter
		New controller classes
		Running the application and testing
	Advanced REST API security
		OAuth2 roles
			Resource owner
			Resource server
			Client
			Authorization server
		Authorization grant types
			Authorization code flow
			Implicit flow
			Client credentials
			Resource owner password credentials
		Access Token and Refresh Token
	Spring Security OAuth project
	OAuth2 and Spring WebFlux
	Spring Boot and OAuth2
	Sample project
		Authorization server
			Maven dependencies
			Spring Boot run class
			Spring Security config
			Authorization server config
			Application properties
		Resource server
			Maven dependencies
			Spring Boot run class
			Resource server config
			Spring Security config
			Spring MVC config class
			Controller class
			Application properties
		Client application
			Maven dependencies
			Spring Boot class
			OAuth client config
			Spring Security config
			Controller classes
			Templates
			Application properties
		Running the project
	Summary
Chapter 7
: Spring Security Add-Ons
	Remember-me authentication
		Creating a new table in MySQL database
		Spring Security configuration
		The custom login page
		Running the application and testing
	Session management
	CSRF
	CSP
		CSP using Spring Security
	Channel security
	CORS Support
	The Crypto module
		Password encoding
		Encryption
		Key generation
	Secret management
		Starting by unsealing Vault
		The Spring Boot project
		The Maven dependency
	HTTP Data Integrity Validator
		What is HDIV?
		The Bootstrap project
		Maven dependencies
		Spring Security configuration
			Spring MVC configuration
			HDIV configuration
			The Model class
			The Controller class
			Pages
			Running the application
	Custom DSL
	Summary
Other Books You May Enjoy
Index