Pro Spring Security: Securing Spring Framework 5 and Boot 2-based Java Applications 2nd Edition Carlo Scarioni download pdf
Pro Spring Security: Securing Spring Framework 5 and Boot 2-based Java Applications 2nd Edition Carlo Scarioni download pdf
com
https://textbookfull.com/product/pro-spring-security-
securing-spring-framework-5-and-boot-2-based-java-
applications-2nd-edition-carlo-scarioni/
OR CLICK BUTTON
DOWNLOAD NOW
https://textbookfull.com/product/pro-spring-mvc-with-webflux-web-
development-in-spring-framework-5-and-spring-boot-2-2nd-edition-
marten-deinum/
textboxfull.com
https://textbookfull.com/product/pro-spring-mvc-with-webflux-web-
development-in-spring-framework-5-and-spring-boot-2-2nd-edition-
marten-deinum-2/
textboxfull.com
https://textbookfull.com/product/pro-spring-5-an-in-depth-guide-to-
the-spring-framework-and-its-tools-cosmina/
textboxfull.com
https://textbookfull.com/product/spring-quick-reference-guide-a-
pocket-handbook-for-spring-framework-spring-boot-and-more-adam-l-
davis/
textboxfull.com
Carlo Scarioni
Massimo Nardone
Pro Spring Security: Securing Spring Framework 5 and Boot 2-based
Java Applications
Carlo Scarioni Massimo Nardone
Surbiton, UK HELSINKI, Finland
Introduction�������������������������������������������������������������������������������������������������������������xv
v
Table of Contents
vi
Table of Contents
vii
Table of Contents
Index��������������������������������������������������������������������������������������������������������������������� 403
viii
About the Authors
Carlo Scarioni is a passionate software developer, motivated
by learning and applying innovative and interesting software
development tools, techniques, and methodologies.
His professional objectives are the following: to be in a
technology-oriented enterprise where the technical staff is
the soul of the company; to be on an important IT team; to
be able to design and develop state-of-the-art software; to
be able to apply new knowledge every day, in innovative
ways, and with a great degree of freedom; to architect,
design, and develop software that uses the best practices of
the field; and to play with the latest technologies, learn every day, and participate in the
research and innovation of software products. His specialties are TDD, object-oriented
principles and design patterns, Java/JEE, Spring, application servers, SQL and NoSQL
(MongoDB), multithreading, messaging, Enterprise Integration Patterns, Ruby, and
RoR. His certifications are Sun Certified Enterprise Architect (Part I), Sun Certified Java
Programmer, Sun Certified Business Component Developer, SpringSource Certified
Professional, and IBM SOA Certified Associate.
ix
About the Authors
He has worked as a visiting lecturer and supervisor for exercises at the Networking
Laboratory of the Helsinki University of Technology (Aalto University). He holds four
international patents (in the PKI, SIP, SAML, and Proxy areas). He currently works as
an Executive Security Consultant, OT Security Leader, and Chief Information Security
Office (CISO) for IBM, and he is member of ISACA Finland Chapter Board.
Massimo is the coauthor of Pro JPA in Java EE 8 (Apress, 2018), Beginning EJB in Java
EE 8 (Apress, 2018), and Pro Android Games (Apress, 2015); he also reviewed more than
45 IT books for different publishers.
x
About the Technical Reviewer
Iuliana Cosmina is a Spring-certified Web Application Developer and a Spring-certified
Spring Professional, as defined by Pivotal, the makers of Spring Framework, Boot, and
other tools. She is the author of books with Apress on core Spring certification and
Spring-certified web development. She is a software architect at Bearing Point Software
and is an active coder and software contributor on GitHub, Stack Overflow, and more.
xi
Acknowledgments
This book is definitely the work of more than one person. The people involved in the
preparation of this book have brought so much experience and quality to the final
version that the end product is many times better than if I had done all the work myself.
Their input ranged from improving text style, to introducing better ways to present
concepts, to performing code reviews and suggesting general improvements that have
made this book a much better reading experience.
I am talking, of course, about the great people at Apress who have been with me
along the full journey of writing this book. I’m talking about Steve Anglin, who initiated
me into the project, kept an eye from afar on the progress of the book, and tried to make
sure I kept on track as much as possible. I’m talking about Kevin Shea, who was my main
editorial contact and made sure that I stayed on schedule with the book and helped
with advice and support. I’m talking about Tom Welsh, who had the great responsibility
of reading every chapter as I was writing it; he gave me great input on each section,
including helping with my use of English grammar as well as ways to make the different
parts more attractive to potential readers. I am talking about Manuel Jordan, who not
only read every single chapter in a very detailed way, but also took on the laborious job
of evaluating and executing every single line of code and making sure that the book
provides code samples that can be reproduced by the readers in their own environments.
His input is greatly appreciated, and it is the difference between having a full book or
a half a book. There were, of course, many more people at Apress involved in the full
review phases of the book, and I want to say “thank you for your help” to all of them.
I would like to also thank the creators, committers, and community of Spring and
Spring Security for creating such an amazing piece of software and making it available to
everyone. A big thank you to them for letting all developers share their knowledge and
ways of work by freely distributing the source code of the different projects covered by
the SpringSource umbrella. They make us all wiser and better developers.
Finally, I want to thank my wife for being with me all the time and motivating me to
keep going forward.
—Carlo Scarioni
xiii
Acknowledgments
—Massimo Nardone
xiv
Introduction
Denying the impact of the Spring Framework in the Java world would be simply
impossible. Spring has brought so many advantages to the Java developer that we could
say it has made better developers of all of us. The good ones, the average ones. All of us.
The previous version of this book utilized Spring Security 3. Therefore, it is very
important to note, in this new edition of the book, the most important changes from v3
to v5. Spring Security v5 is now part of Pivotal since SpringSource is no longer used.
Spring Framework 5 was published in September of 2017 and it can be considered the
first major Spring Framework release since version 4 was released in December of 2013.
Spring’s core building blocks of dependency injection and aspect-oriented
programming are widely applicable to many business and infrastructure concerns, and
certainly application security can benefit from these core functionalities. So this is Spring
Security: an application-level security framework built on top of the powerful Spring
Framework that deals mainly with the core security concepts of authentication and
authorization, which are some of the fundamental functionalities of Spring Security v5.
Spring Security aims to be a full-featured security solution for your Java applications.
Although its main focus is on web applications and the Java programming language, you
will see that it goes beyond these two domains.
What we wanted to do in writing this book was to expose some of the internal works
of Spring Security along with the standard explanations of how to use certain features.
The idea is to teach beyond the basics of how to do something in particular, and instead
focus on the plumbing inside the framework. We find that this is the best way of learning
something: actually seeing how it is built in the core. That’s not to say, of course, that the
book doesn’t cover basic setups and give quick, practical advice on using the framework,
because it certainly does. The point is that instead of saying, “Use this to do that,” we say,
“This works like this… and this allows you to….” This is a point of view that only tools like
Spring afford (because they are open source).
With that said, we suggest that the best way to use this book is to have the Spring
Security source code checked out on your computer and go through the examples with
both the code from the book and the code from Spring Security itself. This will not only
help you understand each concept as it is introduced, but will also teach more than
xv
Introduction
one good programming trick and good practice. We recommend this approach for
studying any software whenever you have the chance. If the source code is out there,
grab it. Sometimes a couple lines of code teach more than a thousand words. In this
book, we will mainly introduce Spring Boot, analyze Spring Framework, and develop
Java Web Applications with Spring Security v5.1.5, Java v11, and Servlet v4. Also, Spring
Security v5 supports many different authentication mechanisms which are introduced
and developed in this book, like Database (MongoDB and hsqldb), LDAP, X.509, OAuth
2/OpenID, WebSockets, SON Web Token (JWT), JAAS, and CAS. Web development
frameworks like Grails and JRuby in the context of Rails and Scala are also introduced in
this book.
xvi
Introduction
• Chapter 2: Introduces Spring Security v5, how to use it, when to use
it, and all of its security functionalities
P
rerequisites
The examples in this book are all built with Java 11 and Maven 3.6.1. The latest Spring
versions are used if possible. Spring Security 5.1.5 was the version used throughout the
book. Tomcat Web Server v9 was used for the different web applications in the book,
mainly through its Maven plugin, and the laptop used was a ThinkPad Yoga 360 with
8GB of RAM. All the projects were developed using the IntelliJ IDEA Ultimate 2019.2.
You are free to use your own tools and operating system. Because everything is Java
based, you should be able to compile your programs on any platform without problems.
xvii
Introduction
D
ownloading the Code
The code for the examples shown in this book is available via the Download Source Code
button located at www.apress.com/9781484250518.
C
ontacting the Authors
You are more than welcome to send us any feedback regarding this book or any other
subject we might help you with. You can contact Carlo Scarioni via his blog at http://
cscarioni.blogspot.com, or you can send him email at carlo.scarioni@gmail.com.
You can contact Massimo Nardone via email at massimonardonedevchannel@gmail.com.
xviii
CHAPTER 1
1
© Carlo Scarioni and Massimo Nardone 2019
C. Scarioni and M. Nardone, Pro Spring Security, https://doi.org/10.1007/978-1-4842-5052-5_1
Chapter 1 The Scope of Security
Figure 1-1 shows the typical DiD mechanisms that define the IT infrastructure
security layers.
The three major security layers in an IT infrastructure are the network, the operating
system (part of the endpoint security layer), and the application itself.
2
Chapter 1 The Scope of Security
This is clearly not enough in the vast majority of cases, as traffic at this level is
normally allowed to enter the publicly open ports of your various exposed services with
no restriction at all. Different attacks can be targeted at these open services, as attackers
can execute arbitrary commands that could compromise your security constraints.
There are tools like the popular nmap (http://nmap.org/) that can be used to scan a
machine to find open ports. The use of such tools is an easy first step to take in preparing
an attack, because well-known attacks can be used against such open ports if they are
not properly secured.
A very important part of the network-layer security, in the case of web applications,
is the use of Secure Sockets Layer (SSL) to encode all sensitive information sent along
the wire, but this is related more to the network protocol at the application level than to
the network physical level at which firewalls operate.
3
Chapter 1 The Scope of Security
• Authentication
• Authorization
• ACLs
A
uthentication
The process of authentication allows an application to validate that a particular user is
who they claim they are. In the authentication process, a user presents the application
with information about herself (normally, a username and a password) that no one else
knows. The application takes this information and tries to match it against information
it has stored—normally, in a database or LDAP1 (Lightweight Directory Access Protocol)
server. If the information provided by the user matches a record in the authentication
server, the user is successfully authenticated in the system. The application will normally
create an internal abstraction representing this authenticated user in the system.
Figure 1-2 shows the authentication mechanism.
1
DAP will be explained in some detail in Chapter 8, where various authentication providers are
L
covered.
4
Chapter 1 The Scope of Security
Authorization
When a user is authenticated, that only means that the user is known to the system
and has been recognized by it. It doesn’t mean that the user is free to do whatever she
wants in said system. The next logical step in securing an application is to determine
which actions the user is allowed to perform, and which resources she has access to,
and make sure that if the user doesn’t have the proper permissions she cannot carry
out that particular action. This is the work of the authorization process. In the most
common case, the authorization process compares the user’s set of permissions against
the permissions required to execute a particular action in the application, and if a match
is found, access is granted. On the other hand, if no match is found, access is denied.
Figure 1-3 shows the authorization mechanism.
5
Chapter 1 The Scope of Security
Figure 1-3. Simple authorization process. The authenticated user tries to access a
secured resource
ACLs
Access control lists (ACLs) are part of the authorization process explained in the
previous section. The key difference is that ACLs normally work at a finer grained level
in the application. ACLs are simply a collection of mappings between resources, users,
and permissions. With ACLs, you can establish rules like “User John has administrative
permission on the blog post X” or “User Luis has read permission on blog post X.” You
can see the three elements: user, permission, and resource. Figure 1-3 shows how ACLs
work; they are just a special case of the general authorization process.
6
Chapter 1 The Scope of Security
• Credentials: Credentials are the way a user proves who they are.
Normally, in the shape of passwords (certificates are also a common
way of presenting credentials), they are data that only the owner of it
knows.
8
Chapter 1 The Scope of Security
One problem with this scheme is how to share the key between the
endpoints of the communication. A common approach is to use a
parallel secure channel to send the keys. Figure 1-5 shows symmetric
encryption at work.
Figure 1-5. Symmetric encryption. The two endpoints share the same encryption/
decryption key
The use of encryption achieves, among other things, two other security goals:
What to Secure
Not every part of the application requires a strong security model, or even any security
at all. If, for example, one part of your application is supposed to serve static content
to everyone interested in it, you can simply serve this content. There probably are no
security concerns to handle here.
10
Chapter 1 The Scope of Security
Anyway, when starting to work on a new application, you should think about the
security constraints that your application will have. You should think about concerns like
those in the following list and whether or not they apply to your particular use case:
11
Chapter 1 The Scope of Security
12
Other documents randomly have
different content
These fallacies, lodged in certain minds, generated, long ago, grand,
ambitious, and bold schemes of conquest and wealth. The people of
the North stood in the way of these schemes. In the minds of the
schemers, labour had been associated with servility, meekness,
cowardice; and they were persuaded that all men not degraded by
labour at the North “kept aloof from politics,” or held their judgment in
entire subjection to the daily wants of a working population, of no
more spirit and no more patriotism than their own working men—
slaves. They believed this whole people to be really in a state of
dependence, and that they controlled that upon which they
depended. So, to a hitherto vague and inert local partisanship, they
brought a purpose of determination to overcome the North, and, as
this could not be safely avowed, there was the necessity for a
conspiracy, and for the cloak of a conspiracy. By means the most
mendacious, the ignorant, proud, jealous, and violent free population
of the cotton States and their dependencies, were persuaded that
less consideration was paid to their political demands than the
importance of their contentment entitled them to expect from their
government, and were at length decoyed into a state of angry
passion, in which they only needed leaders of sufficient audacity to
bring them into open rebellion. Assured that their own power if used
would be supreme, and that they had but to offer sufficient evidence
of a violent and dangerous determination to overawe the sordid
North, and make it submit to a “reconstruction” of the nation in a form
more advantageous to themselves, they were artfully led along in a
constant advance, and constant failure of attempts at intimidation,
until at length they must needs take part in a desperate rebellion, or
accept a position which, after the declarations they had made for the
purpose of intimidation, they could not do without humiliation.
The conspirators themselves have, until recently, been able, either
directly or by impositions upon patriotic, but too confiding and
generous instruments, to control the treasury of the United States, its
post-office, its army and navy, its arsenals, workshops, dockyards
and fortresses, and, by the simple means of perjury, to either turn
these agencies against the government, or at least render them
ineffectual to aid it, and this at a time, when its very existence, if it
were anything but a democratic republican government, and, as we
think for all good purposes, by far the strongest that ever existed,
would have depended on a perfect instant and unquestionable
command of them. Yet I doubt not that the conspirators themselves,
trust at this moment, as they ever have trusted, even less to the
supposed helpless condition of the government than to the supposed
advantages of the cotton monopoly to the Slave States, and to the
supposed superiority of a community of privileged classes over an
actual democracy.
“No! you dare not make war upon cotton; no power on earth dares to
make war upon it. Cotton is king; until lately the Bank of England
was king; but she tried to put her screws, as usual, the fall before the
last, on the cotton crop, and was utterly vanquished. The last power
has been conquered: who can doubt, that has looked at recent
events, that cotton is supreme?”
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
textbookfull.com