[NEW] Spring Security 7 + OAuth2 + JWT + Auth0 + Keycloak

Explore why security matters in an enterprise app, protecting sensitive data and preventing unauthorized access, defending against CSRF and other attacks, and ensuring regulatory compliance with Spring Security.

Learn how Spring Security provides customizable authentication and authorization, protecting apps from threats with flexible security levels—from open to full lockdown using OAuth2, JWT, and OpenID Connect.

Explore the key Spring Security concepts of authentication and authorization, illustrated with a pub analogy, and learn why servlet filters handle security before your controller.

Understand authentication as proving your identity to access a system, using a login page and a unique key (username and password). A bouncer validates credentials to grant entry.

Understand how authorization grants access after identity is proven, using wristbands to represent roles like vip, regular guest, and staff, and control entry to app panels.

Developers implement security with Spring Security; the framework provides hints, but proper configuration and filters control authentication, authorization, and access control.

Build a minimal Spring Boot app with Spring Security Starter to secure a rest endpoint and learn the default generated password and basic authentication flow.

Explore how Spring security uses http basic authentication by default, encoding username and password in the authorization header with base64; the app decodes and matches them, returning 200 or 401.

Spring security uses convention over configuration to auto-provide http basic, form login, and secure rest endpoints, letting you focus on business logic with sensible defaults and customization when needed.

Customize spring security’s core components—authentication filter, authentication manager, and authentication provider—using a user detail service and password encoder to securely validate credentials and manage the security context.

In POC 2, implement a custom user detail service and password encoder in a security config, use an in-memory user details manager, and show how overriding default beans enables authentication.

Explore the user details manager interface, extending the user detail service to create, update, delete, and change passwords for full user lifecycle management, via interface segregation.

Build an immutable UserDetails object with the built-in user class via the StaticBuilder for username, password, and authorities. Use StaticBuilder and UserBuilder to chain account expiration.

Learn how authentication uses the user details service and user details manager to verify usernames and passwords, while interface segregation guides customizing the service to fetch users from a database.

Learn how to replace hardcoded in-memory user details with a database-backed storage by customizing the user details service, advancing to poc 3.

Build a database-backed custom user detail service by defining a user entity, repository, and service, wired with a password encoder to authenticate at /testme with code and decode.

Fetch saved authentication and authorities from the security context using security context holder, getAuthentication, and getAuthorities, demonstrating how authentication and authorization data flow through F1 and F2 filters.

Learn how authorization follows authentication to restrict access by evaluating requests against configured rules in Spring Security, granting or denying access based on roles or permissions.

See how authentication precedes authorization: the authentication filter verifies the user, stores details in the security context, then the authorization filter checks permissions before granting access or returning 403.

Define the granted authority and explain how authorities drive authorization decisions in Spring Security, including how user details fetch and apply them to gate access to resources.

Compare authorities and roles under granted authorities, showing how authorities denote actions like read, write, update, or delete, while roles bundle multiple authorities, such as admin, as a badge.

Configure the security filter chain for endpoint level authorization, showing that authenticated users do not automatically gain all permissions, with admins and guests enforcing different access in a simple poc.

Implement a security filter chain in a Spring app by creating a simple poc, configuring in-memory user details and a password encoder, and validating authentication.

Modify the security filter chain to customize authorization rules by adjusting the request matcher and rule (anyrequest.authenticated) in http security, ensuring authentication precedes authorization.

Explore how the permit all rule in Spring Security allows access for unauthenticated and authenticated users, and why a failed authentication yields 401 before authorization.

learn how the has authority rule controls access to endpoints by requiring specific user authorities, such as read, and distinguishes authorities from roles, with practical examples and tests.

Demonstrate the has any authority matcher in spring security, supporting multiple authorities like read and write, and illustrate in-memory user details manager and authorization filters.

Explore how roles and authorities map to granted authorities in spring security, using has role and has any role with role prefixes like role_ for admin and manager access rules.

Learn to implement authorization rules with the spring expression language and a web expression authorization manager, requiring authentication and specific read or write authorities, demonstrated with real cases and outcomes.

Explore the advantages of the access method, offering powerful, flexible fine-grain control, context-aware decisions, user-specific rules, and the ability to invoke pre-authorize and custom bean methods within security configurations.

Learn how to apply the deny all rule during maintenance by using a request matcher to permit only the status health endpoint and deny all other requests with a 403.

Explore how matcher methods determine which urls and http methods apply to rules after authentication populates the security context. Apply different matchers per controller and method for production-grade targeted authorization.

Explore the request matcher to apply authorization rules by matching URL patterns and HTTP methods like GET, POST, and PUT.

Explore a real-life buffet analogy to understand request matchers in spring security, showing how VIP access, get method rules, and deny-all rules govern access.

Explore a request matcher that restricts the get /test me endpoint to admin. Require the post /test me endpoint to be accessed by the manager, returning 403 or 200.

Learn how the ant matcher uses ant-style path matching to handle http requests with wildcards like * and ** and the question mark, and why it is deprecated.

Explore why AntMatcher's simple rules like * for single depth, ** for any depth, and ? for a single character made it popular, and how path variables reveal its limitations.

Showcase how AntMatcher operated in older Spring Security 5.x with URL patterns and wildcards, highlighting its deprecation and the transition to modern RequestMatcher usage.

Explore ant matchers as post office address matching: single star under slash foo for one level, double star for the foo city, and star dot html for html endings.

AntMatcher was deprecated with Spring Security 6+ due to limited ant-style pattern flexibility and no regex, causing inconsistencies with Spring MVC path matching; RequestMatcher replaces it as a general solution.

Discover how the mvc matcher in Spring Security matches urls like request mappings, understanding path variables such as id, and respecting the servlet context path, unlike end matcher.

Learn how the MVC matcher aligns with Spring MVC architecture, request mapping, and security configurations, and supports servlet mappings and MVC matcher methods.

Learn mvc matcher code before Spring Security 6, featuring security filter chain beans, http security, lambda-based authorization requests, and mvc matchers for query and request params.

Use mvc matcher like a gps for a delivery route, where the controller's request mapping is the address and path parameters handle wildcards; Entmatcher requires exact apartment numbers.

Explore why MVC matcher was deprecated in Spring 6 as Entmatcher created complexity, and how the request matcher unifies MVC and Entmatcher into a single API.

Replace old entmatcher and mvcmatcher with requestmatcher in Spring Security 6, where entmatcher is easily replaced, and mvcmatcher requires an embedded MVCRequestMatcher for mvc-like behavior; both are deprecated.

Explore a powerful, not-deprecated regex matcher pattern used in Spring 6 and enterprise apps to match all requests with complex regex for url matching, instead of simple wildcards.

Identify when to apply a regex matcher for complex path patterns beyond simple ant matchers and url mappings. Learn to handle multi-segment paths, like /test/v1/test/v2/test/v10, with regex pattern matching.

Demonstrate a regex request matcher in spring security, configuring a requestmatcher with a regex pattern and optional http method to grant access only to admin users for specific urls.

Explore a real-life analogy for the regex matcher, including end matcher concepts, showing how patterns like v followed by digits and users can be matched in API paths using regex.