Securing Your Backend

This chapter explains how to secure your Spring Boot backend. Securing your backend is a crucial part of code development. It is essential for protecting sensitive data, complying with regulations, and preventing unauthorized access. The backend often handles the user authentication and authorization process. Securing these aspects properly ensures that only authorized users can access the application and perform specific actions. We will use the database application that we created in the previous chapter as a starting point.

In this chapter, we will cover the following topics:

• Understanding Spring Security
• Securing your backend with a JSON Web Token
• Role-based security
• Using OAuth2 with Spring Boot

Technical requirements

The Spring Boot application that we created in the previous chapters is required.

The following GitHub link will also be required: https://github.com/PacktPublishing/Full-Stack-Development-with-Spring-Boot-3-and-React-Fourth-Edition/tree/main/Chapter05.

Understanding Spring Security

Spring Security (https://spring.io/projects/spring-security) provides security services for Java-based web applications. The Spring Security project was started in 2003 and was previously named Acegi Security System for Spring.

By default, Spring Security enables the following features:

• An AuthenticationManager bean with an in-memory single user. The username is user and the password is printed to the console output.
• Ignored paths for common static resource locations, such as /css and /images. HTTP basic authentication for all other endpoints.
• Security events published to Spring’s ApplicationEventPublisher interface.
• Common low-level features turned on by default, including HTTP Strict Transport Security (HSTS), cross-site scripting (XSS), and cross-site request forgery (CSRF).
• A default autogenerated login page.

You can include Spring Security in your application by adding the following highlighted...

Securing your backend with a JSON Web Token

In the previous section, we covered how to use basic authentication with a RESTful web service. Basic authentication doesn’t provide a way to handle tokens or manage sessions. When a user logs in, the credentials are sent with each request, which can cause session management challenges and potential security risks. This method is not usable when we develop our own frontend with React, so we are going to use JSON Web Token (JWT) authentication instead (https://jwt.io/). This will also give you an idea of how you can configure Spring Security in more detail.

The other option for securing your RESTful web service is OAuth 2. OAuth2 (https://oauth.net/2/) is the industry standard for authorization and it can be used quite easily in Spring Boot applications. There is a section later on in the chapter that will give you a basic idea about how to use it in your applications.

JWTs are commonly used in RESTful APIs for...

Before you begin: Join our book community on Discord

Give your feedback straight to the author himself and chat to other early readers on our Discord server (find the "full-stack-dev-spring-boot-3-react-4e" channel under EARLY ACCESS SUBSCRIPTION).

https://packt.link/EarlyAccess

This chapter explains how to secure your Spring Boot backend. Securing your backend is a crucial part of code development. Securing your backend is essential to protect sensitive data, comply with regulations and prevent unauthorized access. The backend often handles user authentication and authorization process. Securing these aspects properly ensures that only authorized users can access the application and perform specific actions. We will use the database application that we created in the previous chapter as a starting point.In this chapter, we will cover the following topics:

• Understanding Spring Security
• Securing your backend with a JSON Web Token (JWT)

Technical requirements

The Spring Boot application that we created in the previous chapters is required.The following GitHub link will also be required: https://github.com/PacktPublishing/Full-Stack-Development-with-Spring-Boot-3-and-React-Fourth-Edition/tree/main/Chapter05

Understanding Spring Security

Spring Security (https://spring.io/projects/spring-security) provides security services for Java-based web applications. The Spring Security project was started in 2003 and was previously named Acegi Security System for Spring.By default, Spring Security enables the following features:

• An AuthenticationManager bean with an in-memory single user. The username is user, and the password is printed to the console output.
• Ignored paths for common static resource locations, such as /css and /images. HTTP basic security for all other endpoints.
• Security events published to Spring's ApplicationEventPublisher interface.
• Common low-level features are on by default HTTP Strict Transport Security (HSTS), cross-site scripting (XSS), cross-site request forgery (CSRF), and so forth).
• Default autogenerated login page.

You can include Spring Security in your application by adding the following dependencies to the build.gradle file. The first dependency is for the application...

Securing your backend using a JWT

In the previous section, we covered how to use basic authentication with a RESTful web service. This method cannot be used when we develop our own frontend with React, so we are going to use JWT authentication instead (https://jwt.io/). A JWT is commonly used in RESTful APIs for authentication and authorization purposes. A JWT is a compact way to implement authentication in modern web applications. A JWT is really small in size and can therefore be sent in the URL, in the POST parameter, or inside the header. It also contains all the necessary information about the user such as username and role.A JWT contains three different parts, separated by dots: xxxxx.yyyyy.zzzzz. These parts are broken up as follows:

• The first part (xxxxx) is the header that defines the type of token and the hashing algorithm.
• The second part (yyyyy) is the payload that, typically, in the case of authentication, contains user information.
• The third part (zzzzz) is the signature...

Summary

In this chapter, we focused was on making our Spring Boot backend more secure. We started by adding extra protection using Spring Security. As we get ready to create the frontend using React in the next chapters, we decided to use a method called JWT authentication. JWT is commonly used to secure RESTful APIs and it is a lightweight authentication method suitable for our needs.In the next chapter, we will learn the basics of testing in Spring Boot application.