After a small pause, I resume our exploration of stateless RESTful security by asking THE big question everyone should consider when deciding to go stateless: is it worth it?
Previously we have managed to finally get rid of that Session object and transform our RESTful API security to leverage a stateless authentication solution. We replaced our beloved JSESSIONID with a simple string of text, a token, that allowed us to identify a user. But the solution we used is not secure at all. We still need to find a token with the right characteristics to be safe enough in this world of leaks and breaches. Enter JWTs...
Last time we reviewed how to quickly set up stateful authentication on our Spring-based project. That's very nice 'n' all, and in many cases you won't need anything more. However shouldn't we try to get rid of that session-based dependency and attempt to move to a REST-friendly stateless authentication solution? Let's begin...
After a quick introduction we are now ready to begin our journey towards stateless authentication for RESTful APIs... by setting up a stateful example. Yes I know, but we have to start somewhere, right? In this part we'll set up our project and code a couple of simple endpoints. One of those will be secured using Spring Security's session-based authentication.
A full, secure implementation of a solution for web-client, REST-based systems using AngularJS and Spring and addressing authentication, CORS and CSRF aspects. The full, working code is available on GitHub. In this part, we setup the project and examine how CORS is configured on the server side.
Spring Security offers CSRF (cross-site request forgery) protection by default for Java web applications. In this post I will examine how you can make that CSRF protection work for a web client interacting with REST-based CSRF-protected services. Both the web client's code and the server application's configuration will be described.
So you want to validate the data sent to your application's REST services? Nowadays you can quite easily do that using Spring and the Bean Validation API. And to help you test that validation process, how about bringing in Spring Boot to programmatically start your application and run your tests against it?
Today's web applications expect some RESTful services to provide them with the data they need. But what about securing those accesses? In this post, I provide a full example of form-based RESTful authentication against a Spring Boot + Spring Security back-end.
Back to some technical stuff after my post of last week. This time we'll have a look on how to configure your Spring Security when working on top of a Spring Boot project.