Pro Spring Security 3rd Edition Masimo Nardone download
Pro Spring Security 3rd Edition Masimo Nardone download
download
https://textbookfull.com/product/pro-spring-security-3rd-edition-
masimo-nardone/
https://textbookfull.com/product/pro-spring-security-securing-
spring-framework-5-and-boot-2-based-java-applications-2nd-
edition-carlo-scarioni/
https://textbookfull.com/product/pro-spring-mvc-with-webflux-web-
development-in-spring-framework-5-and-spring-boot-2-2nd-edition-
marten-deinum/
https://textbookfull.com/product/pro-spring-mvc-with-webflux-web-
development-in-spring-framework-5-and-spring-boot-2-2nd-edition-
marten-deinum-2/
https://textbookfull.com/product/pro-spring-5-an-in-depth-guide-
to-the-spring-framework-and-its-tools-cosmina/
Pro Spring MVC with WebFlux Web Development in Spring
Framework 5 and Spring Boot 2 Second Edition Marten
Deinum Iuliana Cosmina
https://textbookfull.com/product/pro-spring-mvc-with-webflux-web-
development-in-spring-framework-5-and-spring-boot-2-second-
edition-marten-deinum-iuliana-cosmina/
https://textbookfull.com/product/spring-security-in-action-1st-
edition-laurentiu-spilca/
https://textbookfull.com/product/pro-angular-6-3rd-edition-adam-
freeman/
https://textbookfull.com/product/logic-pro-for-dummies-3rd-
edition-english/
https://textbookfull.com/product/spring-security-robert-winch-
mick-knutson-peter-mularien/
Pro Spring
Security
Securing Spring Framework 6 and
Boot 3-based Java Applications
—
Third Edition
—
Massimo Nardone
Carlo Scarioni
Pro Spring Security
Securing Spring Framework 6
and Boot 3-based Java Applications
Third Edition
Massimo Nardone
Carlo Scarioni
Pro Spring Security: Securing Spring Framework 6 and Boot 3–based Java
Applications, Third Edition
Massimo Nardone Carlo Scarioni
HELSINKI, Finland Surbiton, UK
Introduction�������������������������������������������������������������������������������������������������������������xv
v
Table of Contents
Core Container����������������������������������������������������������������������������������������������������������������������� 30
Data Access and Transactions����������������������������������������������������������������������������������������������� 31
Spring Messaging������������������������������������������������������������������������������������������������������������������ 32
General Web Revision������������������������������������������������������������������������������������������������������������ 32
Spring MVC���������������������������������������������������������������������������������������������������������������������������� 32
Spring WebFlux���������������������������������������������������������������������������������������������������������������������� 32
Observability�������������������������������������������������������������������������������������������������������������������������� 33
Pattern Matching������������������������������������������������������������������������������������������������������������������� 33
Testing����������������������������������������������������������������������������������������������������������������������������������� 34
Dependency Injection������������������������������������������������������������������������������������������������������������ 34
Aspect-Oriented Programming���������������������������������������������������������������������������������������������� 36
What’s New in Spring Security 6?����������������������������������������������������������������������������������������������� 38
Summary������������������������������������������������������������������������������������������������������������������������������������ 44
Chapter 8: Open Authorization 2.0 (OAuth 2.0) and Spring Security�������������������� 211
An Introduction to OAuth 2.0����������������������������������������������������������������������������������������������������� 211
OAuth 2.0 Security��������������������������������������������������������������������������������������������������������������� 213
Integrating OAuth 2.0 with Spring Security������������������������������������������������������������������������� 214
OAuth 2.0 Login������������������������������������������������������������������������������������������������������������������� 217
Summary���������������������������������������������������������������������������������������������������������������������������������� 238
vii
Table of Contents
Index��������������������������������������������������������������������������������������������������������������������� 281
viii
About the Authors
Massimo Nardone has more than 27 years of experience
in information and cybersecurity for IT/OT/IoT/IIoT,
web/mobile development, cloud, and IT architecture. His
true IT passions are security and Android. He has been
programming and teaching how to program with Android,
Perl, PHP, Java, VB, Python, C/C++, and MySQL for more
than 27 years. He holds an MSc degree in computing
science from the University of Salerno, Italy. Throughout
his working career, he has held various positions, starting
as a programming developer, then security teacher, PCI
QSA, auditor, assessor, lead IT/OT/SCADA/SCADA/
cloud architect, CISO, BISO, executive, program director, and OT/IoT/IIoT security
competence leader.
In his last working engagement, he worked as a seasoned cyber and information
security executive, CISO and OT, IoT and IIoT Security competence Leader, helping
many clients to develop and implement Cyber, Information, OT, and IoT security
activities.
His technical skills include security, OT/IoT/IIoT, Android, cloud, Java, MySQL,
Drupal, Cobol, Perl, web and mobile development, MongoDB, D3, Joomla!, Couchbase,
C/C++, WebGL, Python, Pro Rails, Django CMS, Jekyll, and Scratch. He has served as a
visiting lecturer and exercises supervisor at the Helsinki University of Technology (Aalto
University) Networking Laboratory.
He stays current with industry and security trends and is a board member of the
ISACA Finland chapter, ISF, the Nordic CISO Forum, and the Android Global Forum.
He holds four international patents (PKI, SIP, SAML, and Proxy areas). He currently
works as a cybersecurity freelancer for IT/OT and IoT. Massimo has reviewed more than
55 IT books for different publishers and has coauthored Pro JPA 2 in Java EE 8 (Apress,
2018), Beginning EJB in Java EE 8 (Apress, 2018), and Pro Android Games (Apress, 2015).
ix
About the Authors
x
About the Technical Reviewer
Mario Faliero is a telecommunication engineer and
entrepreneur. He has more than ten years of experience in
radio frequency hardware engineering. Mario has extensive
experience in numerical coding, using scripting languages
(MatLab, Python) and compiled languages (C/C++, Java).
He has been responsible for developing electromagnetic
assessment tools for space and commercial applications.
Mario received his master’s degree from the University
of Siena.
xi
Acknowledgments
Many thanks go to my wonderful family for supporting me while I was working on this
book. Luna, Leo, and Neve, you are the most beautiful reason of my life.
I want to thank my beloved late mother, Maria Augusta Ciniglio, who always
supported and loved me so much. I will love and miss you forever, my dearest mom.
Thanks to my beloved father, Giuseppe, and my brothers, Mario and Roberto, for
your endless love and for being the best dad and brothers in the world.
Many thanks to Melissa Duffy for giving me the opportunity to work as a writer on
this book, Shonmirin P. A. for doing such a great job during the editorial process and
supporting me, and Laura Berendson, development editor, for helping me to make it a
better book.
—Massimo Nardone
xiii
Introduction
Denying the impact of the Spring Framework in the Java world would be simply
impossible. Spring has brought so many advantages to Java developers that we could say
it has made us all better developers.
The previous version of this book utilized Spring Security 5. Therefore, in this new
edition of the book, it is very important to note the most important changes from version
5 to version 6.
Spring Framework 6.0 was released on November 16, 2022. It came with a Java
17+ baseline and a move to Jakarta EE 9+ (in the Jakarta namespace), focusing on
the recently released Jakarta EE 10 APIs such as Servlet 6.0 and JPA 3.1. Spring’s
current version’s core building blocks of dependency injection and aspect-oriented
programming widely apply to many business and infrastructure concerns. Certainly,
application security can benefit from these core functionalities. Even in version 6, Spring
Security is an application-level security framework built on top of the powerful Spring
Framework that deals mainly with the core security concepts of authentication and
authorization, which, also in version 6, are some of the fundamental functionalities of
Spring Security.
Spring Security aims to be a full-featured security solution for your Java applications.
Although its focus is on web applications and the Java programming language, you will
see that it goes beyond these two domains.
Because there are new things in the version, the baseline for Spring Boot 3 and
Spring Security 6 is Java 17.
Also, the WebSecurityConfigurerAdapter class to configure security settings was
deprecated in version 6, using a more component-based approach and creating a bean
of type SecurityFilterChain.
AuthorizeRequests was also deprecated and replaced with authorizeHttpRequests,
and in Spring Security 6, AntMatcher, MvcMatcher, and RegexMatcher were deprecated
and replaced by requestMatchers or securityMatchers for path-based access control.
Also, in version 6, some updates were done using OAuth 2.0 and SAML 2.0.
xv
Introduction
In writing this book, we wanted to expose some of Spring Security’s internal works
along with standard explanations of how to use certain features. The idea is to teach
beyond the basics of how to do something in particular and instead focus on the
plumbing inside the framework. This is the best way to learn something: seeing how it
is built in the core. That’s not to say that the book doesn’t cover basic setups and gives
quick, practical advice on using the framework because it certainly does. The point is
that instead of saying, “Use this to do that,” we say, “This works like this… and this allows
you to….” This is a point of view that only tools like Spring can afford (because they are
open source).
With that said, we suggest that the best way to use this book is to have the Spring
Security source code checked out on your computer and go through the examples
with both the code from the book and the code from Spring Security itself. This will
help you understand each concept as it is introduced and teach more than one good
programming trick and good practice. We recommend this approach for studying
any software whenever you have the chance. If the source code is out there, grab it.
Sometimes, a couple of lines of code teach more than a thousand words. This book
primarily introduces Spring Boot 3, analyzes Spring Framework, and develops Java web
applications with Spring Security 6 and Java 17/20.
Also, Spring Security 6 supports many different authentication mechanisms, which
are introduced and developed in this book, including the H2 and PostgreSQL databases,
LDAP, X.509, OAuth 2.0, JWT, JAAS, and CAS.
xvi
Introduction
• Chapter 2 introduces Spring Security 6, how to use it, when to use it,
and its security functionalities.
xvii
Introduction
Prerequisites
The examples in this book are all built with Java 17 and Maven 3.9.2. The latest Spring
versions are used if possible. Spring Security 6 is the version used throughout the book.
Tomcat Web Server 10 is used for the different web applications in the book, mainly
through its Maven plugin. The laptop is a ThinkPad Yoga 360 with 8 GB of RAM. All the
projects were developed using IntelliJ IDEA Ultimate 2023.2.
You are free to use your own tools and operating system. Because everything is Java-
based, you should be able to compile your programs on any platform without problems.
xviii
CHAPTER 1
1
© Massimo Nardone, Carlo Scarioni 2024
M. Nardone and C. Scarioni, Pro Spring Security, https://doi.org/10.1007/979-8-8688-0035-1_1
Chapter 1 The Scope of Security
2
Chapter 1 The Scope of Security
3
Chapter 1 The Scope of Security
The three major security layers in an IT infrastructure are the network, the operating
system (part of the endpoint security layer), and the application itself.
4
Chapter 1 The Scope of Security
This is not enough in most cases, as traffic at this level is normally allowed to enter
the publicly open ports of your various exposed services without restriction. Different
attacks can be targeted at these open services, as attackers can execute arbitrary
commands that could compromise your security constraints. Tools like the popular nmap
(http://nmap.org/) can scan a machine to find open ports. Using such tools is an easy
first step in preparing an attack because well-known attacks can be used against such
open ports if they are not properly secured.
A very important part of the network-layer security, in the case of web applications,
is the use of Secure Sockets Layer (SSL) to encode all sensitive information sent along
the wire, but this is related more to the network protocol at the application level than to
the network physical level at which firewalls operate.
5
Chapter 1 The Scope of Security
Authentication
Authentication is the process of verifying the identity of a user or entity attempting
to access an application. It ensures that the user is who they claim to be. Common
authentication methods include the following.
1
LDAP is explained in some detail in Chapter 8, where various authentication providers are
covered.
6
Chapter 1 The Scope of Security
Authorization
Authorization determines what actions or resources a user can access within an
application. Once a user is authenticated, authorization mechanisms control their
permissions based on predefined rules and policies. This ensures that users can only
access the features and data they are authorized to use. Authorization can be role-based,
attribute-based, or rule-based.
7
Chapter 1 The Scope of Security
When a user is authenticated, that only means that the user is known to the system
and has been recognized by it. It doesn’t mean that the user is free to do whatever she
wants in said system. The next logical step in securing an application is determining
which actions the user can perform and which resources she can access. If the user
doesn’t have the proper permissions, she cannot carry out that particular action. This
is the work of the authorization process. In the most common case, the authorization
process compares the user’s set of permissions against the permissions required
to execute a particular action in the application, and if a match is found, access is
granted. On the other hand, if no match is found, access is denied. Figure 1-3 shows the
authorization mechanism.
Figure 1-3. Simple authorization process: the authenticated user tries to access a
secured resource
8
Chapter 1 The Scope of Security
ACLs
An access control list (ACL) manages access rights and permissions to specific resources
or objects within an application. It is typically used in conjunction with authorization.
An ACL defines who has access to a particular resource and what actions they can
perform on that resource. It consists of a list of users or groups and their corresponding
permissions (read, write, execute, etc.) for specific resources.
ACLs are part of the authorization process explained in the previous section. The key
difference is that ACLs normally work at a finer-grained level in the application. ACLs
are a collection of mappings between resources, users, and permissions. With ACLs, you
can establish rules like “User John has administrative permission on the blog post X” or
“User Luis has read permission on blog post X.” You can see the three elements: user,
permission, and resource. Figure 1-3 shows how ACLs work; they are just a special case
of the general authorization process.
• Credentials: Credentials are the way a user proves who they are.
Normally, in the shape of passwords (certificates are also a common
way of presenting credentials), they are data that only the owner of
it knows.
9
Chapter 1 The Scope of Security
• Resource: Any part of the application you want to access that needs
to be properly secured against unauthorized access—for example, a
URL, a business method, or a particular business object.
For example, let’s suppose the requesting client encrypts a string and
sends the encrypted string to the server. The server may have access
to the original information from a previous registration process, for
example, and if it does, it can apply the same hash function. Then, it
compares the output from this hashing to the value sent by the client.
If they match, the server validates the information.
Figure 1-4 shows this scheme. Usually, the server doesn’t even need
the original data. It can simply store the hashed version and then
compare it with the incoming hash from the client.
10
Chapter 1 The Scope of Security
11
Chapter 1 The Scope of Security
Figure 1-5. Symmetric encryption: the two endpoints share the same encryption/
decryption key
12
Chapter 1 The Scope of Security
• No one else can decrypt the message because they don’t have the
receiver’s private key.
The following defines the key, speed, and use case for asymmetric or PKI encryption.
The use of encryption achieves, among other things, two other security goals.
• Confidentiality: Potentially sensitive information belonging to one
user or group of users should be accessible only to this user or group.
Encryption algorithms are the main helpers in achieving this goal.
13
Random documents with unrelated
content Scribd suggests to you:
THE TRANSFERENCE OF WOODCUTS IN
THE FIFTEENTH AND SIXTEENTH
CENTURIES[5]
GRANOLLACHS' 'LUNARE.' FLORENCE: L. MORGIANI FOR P. PACINI, 1496. IMITATED FROM THE NAPLES
EDITION OF 1485
FROM THE 'LUNARE' OF GRANOLLACHS FOR 1493. PRINTED AT ROME BY PLANNCK. REVERSED FROM THE
NAPLES EDITION. (REDUCED.)
THE SAME CUT AS REDRAWN IN THE FRENCH EDITION OF THE 'POLIPHILO,' 1546. (RATHER MORE
REDUCED)
ADAPTATION OF THE COLOGNE CUT FOR THE MALERMI BIBLE. (VENICE, 1490)
ILLUSTRATION ON THE BACK OF THE TITLE-PAGE OF THE 'ARTE DEL BEN MORIRE,' PRINTED IN 1490 BY
JOHANN CLEYN AND PIERO HIMEL, PROBABLY AT VENICE
FLORENTINE ADAPTATION OF THE SAME CUT USED ON THE TITLE-PAGE OF THE SOMMA 'OMNIS
MORTALIUM CURA' OF S. ANTONINO. PACINI, 1507
Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.
textbookfull.com