Chapter 5: Securing and Testing Your Backend

This chapter explains how to secure and test your Spring Boot backend. Securing your backend is a crucial part of code development. In the testing part of this chapter, we will create some unit tests in relation to our backend—these will make your backend code easier to maintain. We will use the database application that we created in the previous chapter as a starting point.

In this chapter, we will cover the following topics:

• Understanding Spring Security
• Securing your backend with a JSON Web Token (JWT)
• Testing in Spring Boot
• Creating unit tests

Technical requirements

The Spring Boot application that we created in the previous chapters is required.

The following GitHub link will also be required: https://github.com/PacktPublishing/Full-Stack-Development-with-Spring-Boot-and-React/tree/main/Chapter05.

Check out the following video to see the Code in Action: https://bit.ly/3Gv9wVD

Understanding Spring Security

Spring Security (https://spring.io/projects/spring-security) provides security services for Java-based web applications. The Spring Security project was started in 2003 and was previously named Acegi Security System for Spring.

By default, Spring Security enables the following features:

• An AuthenticationManager bean with an in-memory single user. The username is user, and the password is printed to the console output.
• Ignored paths for common static resource locations, such as /css and /images. HyperText Transfer Protocol (HTTP) basic security for all other endpoints.
• Security events published to Spring's ApplicationEventPublisher interface.
• Common low-level features are on by default (HTTP Strict Transport Security (HSTS), cross-site scripting (XSS), cross-site request forgery (CSRF), and so forth).
• Default autogenerated login page.

You can include Spring Security in your application by adding the following dependencies...

Securing your backend using a JWT

In the previous section, we covered how to use basic authentication with a RESTful web service. This method cannot be used when we develop our own frontend with React, so we are going to use JWT authentication instead. A JWT is a compact way to implement authentication in modern web applications. A JWT is really small in size and can therefore be sent in the Uniform Resource Locator (URL), in the POST parameter, or inside the header. It also contains all the necessary information pertaining to the user.

A JWT contains three different parts, separated by dots: xxxxx.yyyyy.zzzzz. These parts are broken up as follows:

• The first part (xxxxx) is the header that defines the type of the token and the hashing algorithm.
• The second part (yyyyy) is the payload that, typically, in the case of authentication, contains user information.
• The third part (zzzzz) is the signature that is used to verify that the token hasn't been changed along...

Testing in Spring Boot

The Spring Boot test starter package is added to the pom.xml file by Spring Initializr when we create our project. This is added automatically without any selection in the Spring Initializr page. The code can be seen in the following snippet:

<dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
</dependency>

The Spring Boot test starter provides lots of handy libraries for testing, such as JUnit, Mockito, and AssertJ. In this book, we are using the JUnit 5 version (JUnit Jupiter). If you take a look, your project structure already has its own package created for test classes, as we can see in the following screenshot:

Figure 5.16 – Test classes

By default, Spring Boot uses an in-memory database for...

Creating unit tests

For unit testing, we are using JUnit, which is a popular Java-based unit testing library. The following source code shows an example skeleton of the Spring Boot test class. The @SpringBootTest annotation specifies that the class is a regular test class that runs Spring Boot-based tests. The @Test annotation before the method specifies to JUnit that the method can be run as a test case:

@SpringBootTest
public  class  MyTestsClass  {
  @Test
  public  void  testMethod()  {
    // Test case code
  }
}

First, we will create our first test case that will test the major functionality of our application before we create any formal test cases. Proceed as follows:

1. Open the CardatabaseApplicationTest test class that has already been made for your application. There is one test method called contextLoads here, and this is where we will add the test. The...

Summary

In this chapter, we focused on securing and testing the Spring Boot backend. First, securing was done with Spring Security. The frontend will be developed with React in upcoming chapters; therefore, we implemented JWT authentication, which is a lightweight authentication method suitable for our needs.

We also covered the basics of testing a Spring Boot application. We used JUnit for unit testing and implemented test cases for JPA and RESTful web service authentication.

In the next chapter, we will set up the environment and tools related to frontend development.

Questions

1. What is Spring Security?
2. How can you secure your backend with Spring Boot?
3. What is a JWT?
4. How can you secure your backend with a JWT?
5. How can you create unit tests with Spring Boot?
6. How can you run and check the results of unit tests?

Further reading

Packt has other great resources available for you to learn about Spring Security and testing. These are listed here:

• Spring Security – Third Edition. Mick Knutson, Robert Winch, and Peter Mularien. (https://www.packtpub.com/application-development/spring-security-third-edition)
• Mastering Software Testing with JUnit 5. Boni García. (https://www.packtpub.com/web-development/mastering-software-testing-junit-5)