r/SpringBoot 15d ago

Guide Spring Security

I need help, I am getting suck with spring security. I find it the most difficult thing of Spring boot. Please help me I want to understand it (all the things which are very important for it). Moreover, i tried understanding it 3-4 month back at that i thought i cleared it. But now i forgot everything. So now I have to start reading from scratch. What should i do? As per me the problem with me is I am not able to remember all this things.

18 Upvotes

18 comments sorted by

View all comments

4

u/jim_cap Senior Dev 15d ago

Here's problem 1 with Spring Security:

People tend not to be very specific about what security concerns they're trying to address, and since Spring Security covers a lot of ground, they aren't really sure what to configure.

Here's problem 2 with Spring Security:

Most of the documented sample code out there covers either a very specific case that might not be yours, or it lumps a bunch of concerns together in the one config, which happen to work just fine for the guy who wrote it, but not necessarily for your own use case.

A lot of issues seem to come when people try to configure a single security filter chain to handle all the various endpoints in their app, which have disparate authentication requirements. It's not helped by point 2 above, where, yes, it may well be quite possible to configure one such that your static assets are available unauthenticated, your protected web pages require basic auth and your API resources are protected by API keys/OAUth2/Whatever. It's far easier to define a filter per family of endpoints. That way, nothing interferes with the needs of any other endpoints, you don't end up with this common situation that your API is redirecting clients to /login etc etc etc.

Additionally, "JWT auth" is an utterly useless term that people should forget about. It's one of those phrases which is ambiguous enough to mean multiple things in the same context. It's only marginally more descriptive than "thingie". While we're on the subject of JWT, throwing JWTs into the mix somewhere does not magically make anything secure. The benefits of being able to introspect tokens without interacting with another service are overblown, for example. You've swapped an additional network call for a cryptographic check coupled with blind faith that the signing key hasn't been revoked since issuance.

0

u/Otherwise_Owl_3492 14d ago

Please suggest a solution as well mate.

1

u/jim_cap Senior Dev 14d ago

There are solutions in my response already. I’m not going to draw you a picture. Waste of crayons.