0Pricing
Spring Security 6 & JWT Authentication · Lektion

HttpSecurity-Konfiguration im Detail

Meistern Sie die `HttpSecurity`-Konfiguration, um Sicherheitsregeln für verschiedene HTTP-Requests und Endpunkte festzulegen.

HttpSecurity-Konfiguration im Detail ist eine kostenlose Spring Security 6 & JWT Authentication-Lektion auf CoddyKit. Dies ist Lektion 3 von 4. Du kannst die komplette Lektion unten kostenlos lesen – dann übst du sie direkt im Browser mit einem integrierten Code-Editor und einem KI-Tutor rund um die Uhr. Sie ist Teil des Spring Security 6 & JWT Authentication-Lernpfads, und dein Fortschritt wird über Web und CoddyKit-App synchronisiert. Der Spring Security 6 & JWT Authentication-Kurs umfasst insgesamt 4 Lektionen.

Teile dieser Lektion wurden noch nicht übersetzt und werden auf Englisch angezeigt.

What is HttpSecurity?

HttpSecurity is a core component in Spring Security. It's like the security guard for your web application's doors.

It lets you define rules for different HTTP requests, controlling who can access which parts of your application and under what conditions.

  • Authentication: Who are you? (Are you logged in?)
  • Authorization: What are you allowed to do? (Do you have permission?)

Your First Security Chain

You configure HttpSecurity within a SecurityFilterChain bean. This bean defines a chain of filters that Spring Security uses to secure your app.

Here's a minimal setup. Run it and try to access /hello. You'll be redirected to a login page!

Use username: user, password: password.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class SecurityApp {

    public static void main(String[] args) {
        SpringApplication.run(SecurityApp.class, args);
    }

    @GetMapping("/hello")
    public String sayHello() {
        return "Hello, secured world!";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated() // All requests need authentication
            )
            .formLogin(form -> form
                .permitAll() // Allow everyone to see the login page
            )
            .logout(logout -> logout
                .permitAll()); // Allow everyone to logout
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

Setting Access Rules

The .authorizeHttpRequests() method is where you begin defining authorization rules for your application's URLs.

Inside its lambda, you specify patterns and the access requirements for those patterns. Think of it as telling the security guard: "For this path, apply these rules."

This method chain is part of the SecurityFilterChain bean.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

// This snippet shows the core authorizeHttpRequests() part.
// It assumes the surrounding Spring Boot application and 
// SecurityConfig class from the previous scene.

@Configuration
@EnableWebSecurity
class SecurityConfigSnippet {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Your specific rules go here!
                // Example: .requestMatchers("/public/**").permitAll()
                // Example: .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }
}

Public & Restricted Paths

You can define paths that are accessible to everyone (permitAll()) or absolutely no one (denyAll()).

Use requestMatchers() to specify the URL patterns. Remember, rules are processed in order, so more specific rules should come first.

Run this app and try /public, then /private (login as user/password), then /secret.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class PublicPrivateApp {

    public static void main(String[] args) {
        SpringApplication.run(PublicPrivateApp.class, args);
    }

    @GetMapping("/public")
    public String publicContent() {
        return "This is public content!";
    }

    @GetMapping("/private")
    public String privateContent() {
        return "This is private content!";
    }

    @GetMapping("/secret")
    public String secretContent() {
        return "Top secret! No one allowed here.";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfigPublicPrivate {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll() // Anyone can access
                .requestMatchers("/secret/**").denyAll()   // No one can access
                .anyRequest().authenticated()              // All other requests need login
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

Only Logged-In Users

The .authenticated() method is used to ensure that a user has successfully logged in before accessing a specific path.

This is a fundamental rule for any part of your application that requires a user identity, such as a dashboard or profile page.

// Inside your SecurityFilterChain configuration:
http
    .authorizeHttpRequests(auth -> auth
        .requestMatchers("/login", "/register").permitAll() // Public paths
        .requestMatchers("/dashboard/**").authenticated() // Needs login
        .anyRequest().denyAll() // Deny everything else by default
    )
    // ... other http configurations (formLogin, logout) ...

Restricting by User Roles

You can grant access based on a user's role using .hasRole("ROLENAME") or .hasAuthority("ROLE_ROLENAME"). Spring Security automatically prefixes roles with "ROLE_" when using hasRole().

This allows fine-grained control over who can access sensitive resources. Run this app. Login as 'user' (password 'password') to access /user-dashboard. Login as 'admin' (password 'admin') to access /admin-panel.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class RoleBasedApp {

    public static void main(String[] args) {
        SpringApplication.run(RoleBasedApp.class, args);
    }

    @GetMapping("/home")
    public String home() { return "Welcome!"; }

    @GetMapping("/user-dashboard")
    public String userDashboard() { return "User Dashboard!"; }

    @GetMapping("/admin-panel")
    public String adminPanel() { return "Admin Panel!"; }
}

@Configuration
@EnableWebSecurity
class SecurityConfigRoles {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/home").permitAll()
                .requestMatchers("/user-dashboard").hasRole("USER") // Only users with ROLE_USER
                .requestMatchers("/admin-panel").hasRole("ADMIN")   // Only users with ROLE_ADMIN
                .anyRequest().authenticated() // All others need login
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("admin")
            .roles("ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }
}

Rule Order is Crucial

When defining multiple rules with requestMatchers(), their order matters! Spring Security processes them from top to bottom, applying the first matching rule.

  • Most Specific First: Place specific URL patterns (e.g., /api/admin/users) before broader ones (e.g., /api/admin/**).
  • Catch-All Last: The .anyRequest() matcher should almost always be the last rule, acting as a default for anything not matched before.
// Incorrect order example (the second rule is unreachable):
// auth
//   .requestMatchers("/admin/**").authenticated()
//   .requestMatchers("/admin/public").permitAll() 

// Correct order example:
// auth
//   .requestMatchers("/admin/public").permitAll()
//   .requestMatchers("/admin/**").hasRole("ADMIN")
//   .anyRequest().authenticated()

Configuring Form Login

Spring Security provides a default login page. You can customize its behavior using .formLogin() within HttpSecurity.

Key configurations include the login page URL, the URL to process login data, and where to redirect after success or failure.

// Inside your SecurityFilterChain configuration:
http
    .authorizeHttpRequests(auth -> auth
        .anyRequest().authenticated()
    )
    .formLogin(form -> form
        .loginPage("/custom-login")      // Specify custom login page URL
        .loginProcessingUrl("/authenticate") // URL to submit login data
        .defaultSuccessUrl("/dashboard", true) // Redirect after success
        .failureUrl("/custom-login?error")  // Redirect on failure
        .permitAll() // Allow access to login page and its processing
    )
    .logout(logout -> logout.permitAll());

Cross-Site Request Forgery (CSRF)

CSRF is an attack where a malicious website tricks a user's browser into making an unwanted request to another trusted site where the user is authenticated.

Spring Security provides robust CSRF protection by default for stateful applications.

  • Enabled by default: For POST, PUT, DELETE requests, requiring a unique token.
  • Disable with caution: Use .csrf().disable() only for stateless APIs (e.g., REST APIs using JWTs) or when you have other CSRF protection.
// Inside your SecurityFilterChain configuration:
http
    // ... authorization rules ...
    .csrf(csrf -> csrf.disable()) // ONLY disable if you know what you're doing!
                                  // Common for stateless REST APIs.
    // ... formLogin, logout ...
;

HttpSecurity Configuration Check

You're building a Spring Boot application. You need to:

  • Allow public access to /api/public/**.
  • Require users with the ADMIN role to access /api/admin/**.
  • All other requests should require any authenticated user.

Which of the following configurations correctly achieve these requirements? (Select all that apply)

HttpSecurity Deep Dive Recap

Great job! You've mastered the essentials of HttpSecurity configuration.

We covered:

  • The role of HttpSecurity in defining web security rules.
  • Using .authorizeHttpRequests() for path-based authorization.
  • Methods like .permitAll(), .denyAll(), .authenticated(), and .hasRole().
  • The importance of rule order when defining multiple access rules.
  • Configuring .formLogin() for custom login pages.
  • Understanding and managing CSRF protection.

These skills are crucial for building robust and secure Spring Boot applications!

Häufig gestellte Fragen

Ist die Lektion „HttpSecurity-Konfiguration im Detail“ kostenlos?

Ja — der vollständige Text von „HttpSecurity-Konfiguration im Detail“ ist hier im Web kostenlos zu lesen. Um sie interaktiv zu üben (integrierter Code-Editor und 24/7 KI-Tutor) und den Rest des Spring Security 6 & JWT Authentication-Kurses freizuschalten, upgrade auf CoddyKit PRO. Der Spring Security 6 & JWT Authentication-Kurs umfasst insgesamt 4 Lektionen.

Was lerne ich in „HttpSecurity-Konfiguration im Detail“?

Meistern Sie die `HttpSecurity`-Konfiguration, um Sicherheitsregeln für verschiedene HTTP-Requests und Endpunkte festzulegen. Du übst Spring Security 6 & JWT Authentication mit praktischem Code, den du direkt im Browser ausführst, und ein 24/7 KI-Tutor beantwortet deine Fragen während du die Lektion bearbeitest.

Brauche ich Erfahrung, um Spring Security 6 & JWT Authentication zu starten?

Keine Vorkenntnisse erforderlich. Spring Security 6 & JWT Authentication auf CoddyKit ist für Anfänger bis fortgeschrittene Lernende strukturiert, sodass du hier starten oder von Anfang an beginnen und in deinem eigenen Tempo voranschreiten kannst. Dies ist Lektion 3 von 4.

Wie lange dauert die Lektion „HttpSecurity-Konfiguration im Detail“?

Die meisten CoddyKit-Lektionen dauern etwa 5–10 Minuten. Jede ist kompakt und interaktiv, sodass du stetig Fortschritte machst und genau dort weitermachst, wo du aufgehört hast – im Web und in der App.

Kann ich in dieser Spring Security 6 & JWT Authentication-Lektion Code schreiben und ausführen?

Ja. Jede Spring Security 6 & JWT Authentication-Lektion enthält einen integrierten Code-Editor, sodass du echten Code direkt in deinem Browser schreibst und ausführst und sofort KI-Feedback erhältst — ohne lokale Einrichtung erforderlich.

Alle Lektionen in diesem Kurs

  1. Rollenbasierte Zugriffskontrolle (RBAC)
  2. Sicherheit auf Methodenebene mit Annotationen
  3. HttpSecurity-Konfiguration im Detail
  4. Endpunkte mit benutzerdefinierten Zugriffsregeln absichern
← Zurück zu Spring Security 6 & JWT Authentication