Understanding Spring Security (Without Spring Boot): Request not Authenticated/Authorized

Understanding Spring Security (Without Spring Boot): Request not Authenticated/Authorized

<p>
    Spring Security is a powerful framework for securing Spring-based applications. It provides comprehensive security services
    such as authentication, authorization, and protection against common attacks such as cross-site scripting (XSS),
    cross-site request forgery (CSRF), and others. In this article, we will explore the basics of Spring Security by setting
    up authentication and authorization in a Spring application without using Spring Boot.
</p>

<h3>Basic Security Configuration</h3>

<p>
    To get started with Spring Security, we need to add the following dependencies to our project's build file:
</p>

<code>
    <pre><code>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>5.5.0</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>5.5.0</version>
        </dependency>
    </code></pre>
</code>

<p>
    Next, we need to configure our security settings in a Java-based configuration class. We will define two authentication
    routes: one for authenticated users and another for unauthenticated users:
</p>

<code>
    <pre><code>
        @Configuration
        @EnableWebSecurity
        public class SecurityConfig extends WebSecurityConfigurerAdapter {

            protected void configure(HttpSecurity http) throws Exception {
                http
                    .authorizeRequests()
                        .antMatchers("/authenticated/**").authenticated()
                        .antMatchers("/unauthenticated/**").permitAll()
                        .and()
                    .formLogin()
                        .loginPage("/login")
                        .permitAll()
                        .and()
                    .logout()
                        .logoutSuccessUrl("/")
                        .permitAll();
            }
        }
    </code></pre>
</code>

<h3>Request not Authenticated</h3>

<p>
    If a user tries to access a protected resource (i.e., a resource that requires authentication) without being
    authenticated, Spring Security will redirect the user to the login page. By default, Spring Security uses a simple
    username/password authentication mechanism.
</p>

<code>
    <pre><code>
        @Configuration
        public class LoginConfig extends WebMvcConfigurerAdapter {

            @Override
            public void addViewControllers(ViewControllerRegistry registry) {
                registry.addViewController("/login").setViewName("login");
            }
        }
    </code></pre>
</code>

<p>
    In the example above, if a user tries to access a resource under "/authenticated/**", they will be redirected to the
    login page.
</p>

<h3>Request not Authorized</h3>

<p>
    Spring Security also provides support for fine-grained authorization through the use of roles and privileges. If a
    user tries to access a resource that they are not authorized to access, Spring Security will return a 403 Forbidden
    response.
</p>

<code>
    <pre><code>
        @Configuration
        public class AuthorizationConfig extends WebMvcConfigurerAdapter {

            @Override
            public void addViewControllers(ViewControllerRegistry registry) {
                registry.addViewController("/unauthorized").setViewName("unauthorized");
            }
        }
    </code></pre>
</code>

<p>
    In the example above, if a user tries to access a resource under "/unauthorized" without having the required role,
    they will be redirected to the unauthorized page.
</p>



<ul>
    <li>
        Spring Security provides comprehensive security services for Spring-based applications.
    </li>
    <li>
        To get started with Spring Security, we need to add the necessary dependencies and configure our security
        settings.
    </li>
    <li>
        If a user tries to access a protected resource without being authenticated, Spring Security will redirect them
        to the login page.
    </li>
    <li>
        Spring Security also provides support for fine-grained authorization through the use of roles and privileges.
    </li>
</ul>

<h3>References</h3>
<ul>
    <li>
        <a href="https://spring.io/projects/spring-security">Spring Security Project</a>
    </li>
    <li>
        <a href="https://docs.spring.io/spring-security/reference/">Spring Security Reference</a>
    </li>
    <li>
        <a href="https://www.baeldung.com/spring-security-initializ">Spring Security Initialization</a>
    </li>
    <li>
        <a href="https://www.baeldung.com/spring-security-authentication">Spring Security Authentication</a>
    </li>
    <li>
        <a href="https://www.baeldung.com/spring-security-authorization">Spring Security Authorization</a>
    </li>
</ul>