Spring Boot Security and Authentication

Spring Boot Security is a powerful and customizable framework for securing Spring-based applications. It provides comprehensive support for authentication and authorization, making it easy to integrate security features into your application. Below is an overview of how to implement authentication and security in a Spring Boot application.

1. Add Spring Security Dependency

To get started, include the Spring Security dependency in your pom.xml (for Maven) or build.gradle (for Gradle).

Maven:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Gradle:

implementation 'org.springframework.boot:spring-boot-starter-security'

2. Basic Authentication

By default, Spring Security enables basic authentication. When you add the dependency, all endpoints in your application will be secured with a default username (user) and a randomly generated password (printed in the console at startup).

To customize the username and password, add the following properties to your application.properties or application.yml:

`application.properties`:

spring.security.user.name=admin
spring.security.user.password=password

3. Customizing Security Configuration

To customize security settings, create a configuration class that extends WebSecurityConfigurerAdapter (for Spring Boot 2.x) or define a SecurityFilterChain bean (for Spring Boot 3.x).

Example for Spring Boot 3.x:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll() // Public endpoints
                .anyRequest().authenticated() // All other endpoints require authentication
            )
            .httpBasic(); // Use HTTP Basic Authentication
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

4. Authentication Mechanisms

Spring Security supports multiple authentication mechanisms:

a. In-Memory Authentication

Store user credentials in memory (as shown above).

b. Database Authentication

Use a database to store user credentials. Implement a UserDetailsService to load user details from the database.

@Service
public class CustomUserDetailsService implements UserDetailsService {

    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("User not found"));
        return new org.springframework.security.core.userdetails.User(
            user.getUsername(),
            user.getPassword(),
            user.getAuthorities()
        );
    }
}

c. OAuth2 / JWT Authentication

For modern applications, you can use OAuth2 or JWT (JSON Web Tokens) for stateless authentication.

5. Role-Based Authorization

You can restrict access to endpoints based on user roles.

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/admin/**").hasRole("ADMIN") // Only ADMIN can access
            .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN") // USER or ADMIN can access
            .anyRequest().authenticated()
        )
        .httpBasic();
    return http.build();
}

6. Password Encoding

Always encode passwords before storing them in the database. Use PasswordEncoder for this purpose.

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

When creating users, encode their passwords:

UserDetails user = User.builder()
    .username("user")
    .password(passwordEncoder.encode("password"))
    .roles("USER")
    .build();

7. CSRF Protection

Spring Security enables CSRF protection by default. For stateless APIs (e.g., RESTful services), you may want to disable it:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf.disable()) // Disable CSRF for stateless APIs
        .authorizeHttpRequests(auth -> auth
            .anyRequest().authenticated()
        )
        .httpBasic();
    return http.build();
}

8. Testing Security

Use tools like Postman or cURL to test your secured endpoints. For example:

curl -u user:password http://localhost:8080/secure-endpoint

9. Advanced Features

OAuth2 Login: Integrate with third-party providers like Google, GitHub, etc.
JWT Authentication: Use JSON Web Tokens for stateless authentication.
Method-Level Security: Secure methods using annotations like @PreAuthorize and @PostAuthorize.

By following these steps, you can implement robust authentication and authorization in your Spring Boot application. Let me know if you need further assistance!