Chapter 4. Securing and Testing Your Backend

This chapter explains how to secure and test your Spring Boot backend. We will use the database application that we created in the previous chapter as a starting point.

In this chapter, we will look into the following:

• How to secure your Spring Boot backend with Spring Boot
• How to secure your Spring Boot backend with JWT
• How to test your backend

Technical requirements

The Spring Boot application that was created in previous chapters is necessary.

Spring Security

Spring Security (https://spring.io/projects/spring-security) provides security services for Java-based web applications. The Spring Security project started in 2003 and was previously named The Acegi Security System for Spring.

By default, Spring Security enables the following features:

• An AuthenticationManager bean with an in-memory single user. The username is user and the password is printed to the console output.
• Ignored paths for common static resource locations, such as /css, /images, and more.
• HTTP basic security for all other endpoints.
• Security events published to Spring ApplicationEventPublisher.
• Common low-level features are on by default (HSTS, XSS, CSRF, and so forth).

You can include Spring Security in your application by adding the following dependency to the pom.xml file:

 <dependency>
   <groupId>org.springframework.boot</groupId>
   <artifactId...

Summary

In this chapter, we focused on securing and testing the Spring Boot backend. Securing was first done with Spring Security. The frontend will be developed with React in upcoming chapters; therefore, we implemented JWT authentication, which is a lightweight authentication method suitable for our needs. We also covered the basics of testing a Spring Boot application. We used JUnit for unit testing and implemented test cases for JPA and RESTful web service authentication. In the next chapter, we will setup the environment and tools for the frontend development.

Questions

1. What is Spring Security?
2. How can you secure your backend with Spring Boot?
3. What is JWT?
4. How can you secure your backend with JWT?
5. How can you create unit tests with Spring Boot?
6. How can you run and check the results of unit tests?

Further reading

Packt has other great resources for learning about Spring Security and Testing:

• https://www.packtpub.com/application-development/spring-security-third-edition
• https://www.packtpub.com/web-development/mastering-software-testing-junit-5