JAVA
Php
Application
Start by creating a simple Spring Boot java project with no authentication. Select Spring Web and Thymeleaf as dependencies.
// src/main/java/com/example/securingweb/App.java
package com.example.securingweb;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class App {
public static void main(String[] args) {
SpringApplication.run(App.class, args);
}
}
// src/main/java/com/example/securingweb/MvcConfig.java
package com.example.securingweb;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
@Configuration
public class MvcConfig implements WebMvcConfigurer {
public void addViewControllers(ViewControllerRegistry registry) {
registry.addViewController("/").setViewName("hello");
}
}
/*
// src/main/resources/templates/hello.html
<h1>Hello World</h1>
*/
http://localhost:8080/
# Hello World
AUTH
Add Spring Security dependency in pom.xml Spring Boot automatically secures all HTTP enpoints with basic authentication.
// pom.xml
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
// src/main/resources/application.properties
spring.security.user.name=myuser
spring.security.user.password=mypass
// src/main/resources/templates/hello.html
<h1 th:inline="text">Hello [[${#httpServletRequest.remoteUser}]]!</h1>
<form th:action="@{/logout}" method="post">
<input type="submit" value="Sign Out"/>
</form>
http://localhost:8080/
# Please sign in
ENCRYPT
To avoid storing raw password, bcrypt it with and Spring CLI.
spring encodepassword mypass
// {bcrypt}$2a$10$2wRXv3x28CiFAq966H93PeAvaRHKMF.ItkMC.CsPBdYTZ2xLO2sLy
// src/main/resources/application.properties
spring.security.user.name=myuser
spring.security.user.password={bcrypt}$2a$10$2wRXv3x28CiFAq966H93...
➥ Questions
