Getting Started with Spring Security

In this chapter, we'll apply a minimal Spring Security configuration to start addressing our first finding—inadvertent privilege escalation due to a lack of 
URL protection, and general authentication from the security audit discussed in Chapter 1, Anatomy of an Unsafe Application. We will then build on the basic configuration to provide a customized experience for our users. This chapter is intended to get you up and running with Spring Security and to provide a foundation for any other security-related tasks you will need to perform.

During the course of this chapter, we will cover the following topics:

• Implementing a basic level of security on the JBCP calendar application, using the automatic configuration option in Spring Security
• Learning how to customize both the login and logout experience
• Configuring Spring Security...

Hello Spring Security

Although Spring Security can be extremely difficult to configure, the creators of the product have been thoughtful and have provided us with a very simple mechanism to enable much of the software's functionality with a strong baseline. From this baseline, additional configuration will allow for a fine level of detailed control over the security behavior of the application.

We'll start with our unsecured calendar application from Chapter 1, Anatomy of an Unsafe Application, and turn it into a site that's secured with a rudimentary username and password authentication. This authentication serves merely to illustrate the steps involved in enabling Spring Security for our web application; you'll see that there are some obvious flaws in this approach that will lead us to make further configuration refinements.

...

A little bit of polish

Stop at this point and think about what we've just built. You may have noticed some obvious issues that will require some additional work and knowledge of the Spring Security product before our application is production-ready. Try to make a list of the changes that you think are required before this security implementation is ready to roll out on the public-facing website.

Applying the Hello World Spring Security implementation was blindingly fast and has provided us with a login page, username, and password-based authentication, as well as the automatic interception of URLs in our calendar application. However, there are gaps between what the automatic configuration setup provides and what our end goal is, which are listed as follows:

• While the login page is helpful, it's completely generic and doesn't look like the rest of our JBCP calendar...

Summary

In this chapter, we have applied a very basic Spring Security configuration, explained how to customize the user's login and logout experience, and demonstrated how to display basic information, such as a username, in our web application.

In the next chapter, we will discuss how authentication in Spring Security works and how we can customize it to our needs.