In the article Implement OAuth Resource Server using Spring Security OAuth2 Resource Server, I showed you how to protect resources managed by Resource Server using an access token issued by Authorization Server. In the example of this article Implement OAuth Resource Server using Spring Security… Read More

In the previous post, I showed you how to configure Spring Security using the WebSecurityConfigurerAdapter class. From Spring Security version 6.x onwards, Spring removed this class and recommends configuring Spring Security with a bean of SecurityFilterChain and Spring Security Lambda DSL. How is it in… Read More

Resource Server in OAuth2 is used to protect access to resources, APIs. It will validate the access token passed by the Client Application, with the Authorization Server to decide if the Client Application has access to the resources and APIs it wants. In this tutorial,… Read More

In the tutorial Overview about request processing in Spring Security, I gave you a brief introduction to the main components in a flow for the authentication part of the Spring Security framework. In this tutorial, we will learn in more detail how Spring Security handles… Read More

In real projects, you may encounter some cases where the application needs to use two different login methods depending on the user’s role, for example, there are applications that will need normal users to login using tokens or QR code, and admin login using username… Read More

As I said in the tutorial about Overview about request processing in Spring Security, the UsernamePasswordAuthenticationFilter class is a filter that will take care of authentication in Spring Security and by default, the user’s username and password information will be used for the authentication process.… Read More

Normally, we won’t use Spring Security’s default login page for applications deployed to production, you can guess why, right? This default login page for us to learn mainly. So to replace this default login page, how do we do? In this tutorial, I will guide… Read More

I showed you how to install and configure to use Spring Security in Spring MVC applications. With Spring Boot application, configuring Spring Security will be much simpler. We do not need to go through each step to configure the authentication and authorization of the application.… Read More

The WebSecurityConfigurerAdapter class has been deprecated since version 5.7.0 of Spring Security and has been removed since version 6.x, so if you are using the latest version of Spring Security to configure your project, please read the tutorial Configure Spring Security to use SecurityFilterChain and Spring… Read More

To be able to make authentication and authorization for the requests to the web application, Spring Security must act as an interceptor of these applications. It will intercept and process the requests before those requests are actually processed by the application and return results. In… Read More