Getting started

Access to some web pages, files, or other classified resources of a web application is often restricted to authorized users only. Spring Security is a module of the Spring framework that deals with authentication and authorization (or access control). It stands between the client and the application, intercepts all requests, and allows for configuring what functionalities and data are available to which users. It also helps to secure your app against common security vulnerabilities and attacks.

Some of the features of this framework:

• Easily configurable and extensible to meet the needs of a specific application.
• Protection against common attacks: session fixation, clickjacking, CSRF, and so on.
• Open source and regular updates.
• Supports integration with: HTTP basic access authentication, form-based authentication, LDAP, and many more.
• Provides a secure and flexible set of tools for managing user passwords.

In this topic, you'll learn how to start working with Spring Security and we'll create a secured single-page app.

Dependency

The first step in securing a Spring app is to add the Spring Boot Security starter dependency:

• Gradle
• Maven

This dependency includes autoconfiguration and by default enables security-related features like HTTP basic authentication, form-based authentication, protection against CSRF, and other things. It will be easier to get acquainted with Spring Security by looking at some examples first. So let's create a simple app, run it, and see what happens!

Preparation

Let's assume that we started a new Spring Boot project, added a web and security starter dependency, and created a simple index.html file located in the /resources/static folder.

Here's the content of the file:

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>Security Test</title>
</head>
<body>
    <h1>Access granted!</h1>
</body>
</html>

Now let's run the app and try to access the file.

Secured app