Skip to content

Commit 899734b

Browse files
sunilsonisunilsoni
committed
Spring Security
1 parent d1dec7c commit 899734b

File tree

3 files changed

+127
-5
lines changed

3 files changed

+127
-5
lines changed

‎docs/spring/security/security.md

+127
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,127 @@
1+
---
2+
title: Security
3+
parent: Spring
4+
has_children: true
5+
resource: true
6+
nav_order: 3
7+
desc: "Security interview questions and answers."
8+
categories: [Security]
9+
---
10+
11+
# Security
12+
{: .no_toc }
13+
14+
<details open markdown="block">
15+
<summary>
16+
Table of contents
17+
</summary>
18+
{: .text-delta }
19+
1. TOC
20+
{:toc}
21+
</details>
22+
23+
---
24+
25+
26+
---
27+
28+
## Spring Security
29+
30+
Spring Security is essentially just a bunch of servlet filters that enable Java applications to include authentication and authorization functionality. It is one of the most powerful, and highly customizable access-control frameworks (security framework) that provide authentication, authorization, and other security features for Java EE (Enterprise edition) based enterprise applications. The real power of Spring Security lies in its ability to be extended to meet custom needs. Its main responsibility is to authenticate and authorize incoming requests for accessing any resource, including rest API endpoints, MVC (Model-View-Controller) URLs, static resources, etc.
31+
32+
33+
### Features of Spring Security
34+
35+
Some essential features of Spring Security include:
36+
37+
- Supports authentication and authorization in a flexible and comprehensive manner.
38+
- Detection and prevention of attacks including session fixation, clickjacking, cross-site request forgery, etc.
39+
- Integrate with Servlet API.
40+
- Offers optional integration with Spring Web MVC (Model-View-Controller).
41+
- Java Authentication and Authorization Service (JAAS) is used for authentication purposes.
42+
- Allows Single Sign-On so that users can access multiple applications with just one account (username and password).
43+
44+
### Authentication and Authorization
45+
46+
#### Authentication:
47+
This refers to the process of verifying the identity of the user, using the credentials provided when accessing certain restricted resources. Two steps are involved in authenticating a user, namely identification and verification. An example is logging into a website with a username and a password. This is like answering the question Who are you?
48+
#### Authorization:
49+
It is the ability to determine a user's authority to perform an action or to view data, assuming they have successfully logged in. This ensures that users can only access the parts of a resource that they are authorized to access. It could be thought of as an answer to the question Can a user do/read this?
50+
51+
52+
---
53+
54+
## Authentication Types
55+
56+
### Basic authentication
57+
58+
RESTful web services can be authenticated in many ways, but the most basic one is basic authentication. For basic authentication, we send a username and password using the HTTP [Authorization] header to enable us to access the resource. Usernames and passwords are encoded using base64 encoding (not encryption) in Basic Authentication. The encoding is not secure since it can be easily decoded.
59+
60+
Syntax:
61+
62+
63+
```log
64+
Value = username:password
65+
Encoded Value = base64(Value)
66+
Authorization Value = Basic <Encoded Value>
67+
//Example: Authorization: Basic VGVzdFVzZXI6dGVzdDEyMw==
68+
//Decode it'll give back the original username:password UserName:user123
69+
```
70+
71+
### digest authentication
72+
73+
RESTful web services can be authenticated in many ways, but advanced authentication methods include digest authentication. It applies a hash function to username, password, HTTP method, and URI in order to send credentials in encrypted form. It generates more complex cryptographic results by using the hashing technique which is not easy to decode.
74+
75+
Syntax:
76+
77+
```log
78+
Hash1=MD5(username:realm:password)
79+
Hash2=MD5(method:digestURI)
80+
response=MD5(Hash1:nonce:nonceCount:cnonce:qop:Hash2)
81+
//Example, this got generated by running this example
82+
Authorization: Digest username="TestAdmin", realm="admin-digest-realm", nonce="MTYwMDEwMTUyMDM4OToxM2M1Y2I4MGFjMjk4OGI1ODQzZjc3NDUzOGFlMjZjYw==", uri="/admin/hello?name=User", response="2f080edbec53be2bdf3853d477e4a543", qop=auth, nc=00000002, cnonce="11ecd9bf947dbcf4"
83+
```
84+
85+
86+
---
87+
88+
## Spring Security Modules
89+
90+
In Spring Security, the Security module comprises separate jar files based on its functionality. The primary use is to allow the user to integrate according to the requirements. To include minimal spring security for your Maven project, include below dependencies in your pom.xml.
91+
92+
**Core – spring-security-core.jar**
93+
- This module contains core authentication and access-control related classes, basic provisioning APIs. This is mandatory for providing spring security to any J2EE based enterprise application. This module supports non-web applications, too.
94+
95+
**Web – spring-security-web.jar**
96+
–This module contains filters and web-based authentication, like access control for URLs in a Servlet environment. This module is responsible to provide security to your Spring MVC or any other web application.
97+
98+
**Config- spring-security-config.jar**
99+
–This module used to use the Spring Security XML name-space. It also supports.
100+
101+
**LDAP**
102+
– Modules supporting the LDAP authentication. We may need this if you want to have LDAP authentication for our application.
103+
104+
**OAuth 2.0 Core**
105+
– Provides support for the OAuth 2.0 authorization.
106+
107+
**OAuth 2.0 Client**
108+
– Spring Security’s client support for OAuth 2.0 Authorization Framework and OpenID Connect Core 1.0.
109+
110+
**Secure:**
111+
112+
Spring has provided a separate module for securing the application. Spring Security is a Java SE/Java EE security framework to provide Authentication, Authorization, SSO and other Security features for Web Applications or Enterprise Applications. Spring Security supports the various types of security such as :
113+
114+
1. Authentication and Authorization.
115+
2. BASIC,Digest and Form-Based Authentication.
116+
3. LDAP Authentication.
117+
4. OpenID Authentication.
118+
5. SSO (Single Sign-On) Implementation.
119+
6. Cross-Site Request Forgery (CSRF) Implementation.
120+
7. `Remember-Me` Feature through HTTP Cookies.
121+
8. Implementation of ACLs.
122+
9. `Channel Security` that means automatically switching between HTTP and HTTPS.
123+
10. JAAS (Java Authentication and Authorization Service).
124+
11. Flow Authorization using Spring WebFlow Framework.
125+
12. WS-Security using Spring Web Services.
126+
127+

‎docs/spring/spring-security.md

-4
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,3 @@ Spring has provided a separate module for securing the application. Spring Secur
125125

126126

127127

128-
129-
## Reference Links
130-
- [Spring AOP tutorial-java2blog.com](https://java2blog.com/spring-aop-tutorial/)
131-
- [Spring Security Interview Questions](https://www.interviewbit.com/spring-security-interview-questions/)

‎docs/ui/angular/angular-routing.md

-1
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,6 @@ Routing.
6464

6565
## Let's create below Angular Single Page Application (SPA) with Routing and Navigation feature:
6666

67-
<img src="images/1.1-spa-single-page-app-home.png">
6867

6968
<p>
7069
<figure>

0 commit comments

Comments
 (0)