GraphQL APIs with Spring Boot · Lección

Autenticación con Spring Security

Integre Spring Security para proteger sus endpoints de GraphQL y gestionar la autenticación de usuarios.

Autenticación con Spring Security es una lección gratuita de GraphQL APIs with Spring Boot en CoddyKit. Esta es la lección 2 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de GraphQL APIs with Spring Boot, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de GraphQL APIs with Spring Boot incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

Why Auth for GraphQL?

Welcome! In this lesson, we'll integrate Spring Security with our GraphQL API. While GraphQL defines how to query and mutate data, it doesn't specify authentication or authorization.

Protecting your API is crucial to ensure only authorized users can access sensitive data and perform specific actions. Spring Security is a powerful and flexible framework for this.

Spring Security Basics

Spring Security is a comprehensive security framework for Spring applications. It provides authentication (verifying who you are) and authorization (what you're allowed to do).

Authentication: Verifies a user's identity (e.g., username/password).
Authorization: Determines if an authenticated user has permission to access a resource or perform an action.

We'll start with basic authentication, which is simple to set up for testing.

Add Security Dependency

First, we need to add the Spring Security starter dependency to our Spring Boot project. This brings in all the necessary components for security.

Add the following to your pom.xml file:

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Don't forget to also include your GraphQL starter, e.g., spring-boot-starter-graphql if you haven't already.

Configure Basic In-Memory Auth

For a quick start, Spring Security can use in-memory user details. We define a SecurityFilterChain bean to configure the HTTP security rules.

This setup creates two users: 'user' and 'admin', both with a password 'password' (encoded using BCrypt) and different roles.

package com.coddykit;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic();
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password"))
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("password"))
            .roles("ADMIN", "USER")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Protecting GraphQL Paths

Now, let's explicitly secure our GraphQL endpoints. We want to make sure that only authenticated users can access the /graphql endpoint where our API lives.

We can modify the SecurityFilterChain to specify access rules for specific paths. For example, requiring the 'USER' role to access GraphQL.

package com.coddykit;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable()) // Disable CSRF for API (consider for production)
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/graphql/**", "/graphiql/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .httpBasic();
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password"))
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("password"))
            .roles("ADMIN", "USER")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

A Simple GraphQL Query

To test our security, let's create a very basic GraphQL query. This query will simply return a greeting message. We'll then try to access it with and without authentication.

This demonstrates a minimal GraphQL API that Spring Security will protect.

package com.coddykit;

import org.springframework.graphql.data.method.annotation.QueryMapping;
import org.springframework.stereotype.Controller;

@Controller
public class GreetingController {

    @QueryMapping
    public String hello() {
        return "Hello, secured GraphQL world!";
    }
}

Full Secure App Example

Here's a complete Spring Boot application integrating Spring Security with a GraphQL endpoint. Run this code, then try to access http://localhost:8080/graphql or /graphiql.

You should be prompted for a username and password (e.g., 'user'/'password'). Without them, access will be denied.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.graphql.data.method.annotation.QueryMapping;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.stereotype.Controller;

@SpringBootApplication
public class SecuredGraphQLApp {

    public static void main(String[] args) {
        SpringApplication.run(SecuredGraphQLApp.class, args);
    }
}

@Controller
class GreetingController {

    @QueryMapping
    public String hello() {
        return "Hello, secured GraphQL world!";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/graphql/**", "/graphiql/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .httpBasic();
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password"))
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("password"))
            .roles("ADMIN", "USER")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Custom UserDetailsService

In-memory users are great for development, but real applications need to load user data from a database or external service. This is where a custom UserDetailsService comes in.

You'd implement this interface to fetch user details (username, password, roles) based on the provided username. Spring Security then uses this to authenticate the user.

package com.coddykit;

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.crypto.password.PasswordEncoder;

@Service
public class MyCustomUserDetailsService implements UserDetailsService {

    private final PasswordEncoder passwordEncoder;

    public MyCustomUserDetailsService(PasswordEncoder passwordEncoder) {
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // In a real app, you'd fetch this from a DB
        // For demonstration, let's hardcode a user
        if ("coddy".equals(username)) {
            return User.builder()
                .username("coddy")
                .password(passwordEncoder.encode("secret")) // Stored encoded password
                .roles("USER")
                .build();
        } else {
            throw new UsernameNotFoundException("User not found: " + username);
        }
    }
}

Understanding PasswordEncoder

Never store passwords in plain text! PasswordEncoder is an interface for encoding and verifying passwords. BCryptPasswordEncoder is a strong, widely recommended implementation.

Encoding: Transforms a plain-text password into a secure hash.
Matching: Compares a raw password with an encoded one.

Spring Security automatically uses the PasswordEncoder bean you provide to handle password verification.

Security Integration Check

You've learned how to set up basic authentication for your GraphQL API. Let's test your understanding of the key components involved.

Lesson Recap: Secure Your API

Great job! You've learned how to integrate Spring Security to protect your GraphQL endpoints. We covered:

The importance of authentication for GraphQL APIs.
Adding the Spring Security dependency.
Configuring a SecurityFilterChain for basic authentication.
Protecting specific GraphQL paths.
Implementing a custom UserDetailsService for real-world user management.
Using PasswordEncoder for secure password handling.

This lays the foundation for building robust and secure GraphQL APIs. Next, you'll explore authorization to control access to fields and operations!

Preguntas frecuentes

¿La lección «Autenticación con Spring Security» es gratis?

Sí — el texto completo de «Autenticación con Spring Security» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de GraphQL APIs with Spring Boot, actualiza a CoddyKit PRO. El curso de GraphQL APIs with Spring Boot incluye 4 lecciones en total.

¿Qué aprenderé en «Autenticación con Spring Security»?

Integre Spring Security para proteger sus endpoints de GraphQL y gestionar la autenticación de usuarios. Practicas GraphQL APIs with Spring Boot con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar GraphQL APIs with Spring Boot?

No se requiere experiencia previa. GraphQL APIs with Spring Boot en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 2 de 4.

¿Cuánto tiempo toma la lección «Autenticación con Spring Security»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de GraphQL APIs with Spring Boot?

Sí. Cada lección de GraphQL APIs with Spring Boot incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

Gestión personalizada de errores en GraphQL
Autenticación con Spring Security
Autorización con directivas y contexto
Limitación de tasa y protección contra la profundidad de consultas

← Volver a GraphQL APIs with Spring Boot