Cargo Surabaya | Ekspedisi Vendor Langsung

If you are a Java Spring developer and working with Spring Security then you may be familiar with the "Learn Spring Security" course by Eugen Paraschiv of Baeldung.com. It is one of the most advanced and comprehensive courses on Spring Security and the best part of this course is that Eugen always keeps it up-to-date with new Spring Security release. Now that version Spring Security 5 is out - he has updated his course to use new features of Spring Security 5. Btw, there is some really cool new functionality coming in Spring Security 5 for the reactive programming model, and many other improvements and new features. But, the most important one is the release of OAuth2. This means: No more picking spring-social modules to integrate with third-parties OAuth providers. No more limitations in the way the OAuth2 spec is implemented. On Spring Security side, It took a big rewrite - which very, very rarely happens in the Spring ecosystem - but Spring Security 5 fixed all of that. Wh...

The Spring Security is one of the leading open source, security framework which allows you to implement security in Java based web applications. It provides several security features e.g. authentication, authorization, remember me out-of-the-box, which means you can directly use them without adding code or changing your class. Yes, Spring Security implements security at application level i.e. you can even secure your non-secure resource without modifying them. It is also the leading framework to secure RESTful Web Services. Because of all these, the demand for Java developers with good knowledge of Spring Security is very high. They are also some of the highly paid Java developers. Many Java and Spring developer, particularly those who are involved in enterprise and Java web development are learning Spring Security. One of the frequently asked question by my readers is about some good courses/training to learn Spring Security . After answering many of them on Facebook, I decided to wri...

The SecurityContext and SecurityContextHolder are two fundamental classes of Spring Security. The SecurityContext is used to store the details of the currently authenticated user, also known as a principle. So, if you have to get the username or any other user details, you need to get this SecurityContext first. The SecurityContextHolder is a helper class, which provide access to the security context. By default, it uses a ThreadLocal object to store security context, which means that the security context is always available to methods in the same thread of execution, even if you don't pass the SecurityContext object around. Don't worry about the ThreadLocal memory leak in web application though, Spring Security takes care of cleaning ThreadLocal. Btw, that's not the only way a SecurityContextHolder can store current SecurityContext, it can be configured with a strategy on startup to specify how you would the context to be stored. For example, you can use SecurityContextHol...

The LDAP authentication is one of the most popular authentication mechanism around the world for enterprise application and Active directory (an LDAP implementation by Microsoft for Windows) is another widely used LDAP server. In many projects, we need to authenticate against active directory using LDAP by credentials provided in the login screen. Sometimes this simple task gets tricky because of various issues faced during implementation and integration and no standard way of doing LDAP authentication in a Java web application . Even though Java provides LDAP support but in this article, I will mostly talk about spring security because of it's my preferred Java framework for authentication, authorization, and security-related stuff. We can do the same thing in Java by writing ower own program for doing LDAP search and then LDAP bind but as I said its much easier and cleaner when you use spring security for LDAP authentication. Along with LDAP Support, Spring Security also pro...

In the last article, I have shown you how to enable Spring security in Java application and today we'll talk about how to enable Basic HTTP authentication in your Java web application using Spring Security. I'll show you how to do that using both the Java configuration and XML configuration if you are using Spring Security 3.1 or lower version, but before that let's understand what is Http basic authentication and why do you need that? One of the most common ways to authenticate a user in a web application is by using form login like you provide a login page and user will enter his username and password for authentication. This works great for human users but sometimes there are situations where you can't use a login form for authentication. For example, if your application user is non-human or other applications then form login is not appropriate. This is quite common as well for example in case of RESTful web services clients are not human, instead of some other app...

If you don't know, Spring security can limit the number of sessions a user can have in a Java web application. If you are developing a web application especially a secure web application in Java JEE then you must have come up with the requirement similar to many online banking portals have like only one session per user at a time or no concurrent session per user . If the user tries to open a new session then either an alert is shown or his previous session is closed. Even though you can also implement this functionality without using spring security but with Spring security, its just piece of cake with coffee :).  You just need to add a couple of lines of XML in your spring security configuration file and you are done. In order to implement this functionality, you can use the <concurrency-control> tag. You can configure a maximum number of the session your application support and then Spring security will automatically detect if user breach that limits and direct them to ...

Spring Security is one of the big projects under the Spring framework umbrella which address the security requirements of modern web applications. Since Security is a paramount concern for enterprise Java applications, good knowledge of a security framework like Spring security goes a long way in someone's career. It not only helps you to become a full-stack developer but also opens a lot of opportunities in terms of job and career growth. There is a lot of demand for Java developers who know the Spring framework and understand how to secure their application on the web. They are also one of the highest-paid professionals in the Java world, where a Java developer with Spring + Spring Security getting anywhere to 120,000 - 150,000 USD or equivalent across the globe. Even in India, you get a lot of excellent opportunities, exciting work, and a higher salary if you have these skills. There is a lot of emphasis on securities and many organizations and using third-party security audit a...

Spring Security is one of the most popular open-source frameworks to implement security in Java web applications in a declarative way. It provides several essential security features likeLDAP authentication, authorization, role-based access control,  remembers the password, URL protection, concurrent active sessions management, etc. To enable Spring security in Java Web application, you need to configure three things -  declare a delegating proxy filter in web.xml, add the ContextLoaderListener in web.xml and provide actual security constraints on applicationContext-Security.xml file. Since Spring security uses a chain of filters to implement various security constraints, also known as Spring's "security chain filter" , it relies on web container for the initialization of delegating filter proxy. If you remember, filters are created, maintained, and destroyed by a Servlet container like Tomcat or Jetty. You declare filters in web.xml, and web container initializes them b...

In the last article, you have learned how to enable Http basic authentication in Spring security-based Java application, and now we'll go one step further to understand how exactly http basic authentication works in Spring security. If you remember, when you use HTTP Basic for authentication purposes, the client, like a browser or a rest client sends login credentials in the http request header. The header is aptly named as "Authorization," and it contains a Base64 encoded string, which is created by concatenating username and password using a colon. For example, if the username is "johnsmith" and password is "JOHN3214" then they will be concatenated as "johnsmith:JOHN3214" before encoded using base 64 encoding algorithms. The server, when receives such a request, extracts the value of "Authorization" header and decodes the content of this header using the same algorithm Base64 for authenticating the user. If you remember, we used ...