0Pricing
Spring Security 6 & JWT Authentication · Lección

Análisis detallado de la configuración de HttpSecurity

Domine la configuración de `HttpSecurity` para definir reglas de seguridad para distintas solicitudes y endpoints HTTP.

Análisis detallado de la configuración de HttpSecurity es una lección gratuita de Spring Security 6 & JWT Authentication en CoddyKit. Esta es la lección 3 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Spring Security 6 & JWT Authentication, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

Partes de esta lección aún no han sido traducidas y se muestran en inglés.

What is HttpSecurity?

HttpSecurity is a core component in Spring Security. It's like the security guard for your web application's doors.

It lets you define rules for different HTTP requests, controlling who can access which parts of your application and under what conditions.

  • Authentication: Who are you? (Are you logged in?)
  • Authorization: What are you allowed to do? (Do you have permission?)

Your First Security Chain

You configure HttpSecurity within a SecurityFilterChain bean. This bean defines a chain of filters that Spring Security uses to secure your app.

Here's a minimal setup. Run it and try to access /hello. You'll be redirected to a login page!

Use username: user, password: password.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class SecurityApp {

    public static void main(String[] args) {
        SpringApplication.run(SecurityApp.class, args);
    }

    @GetMapping("/hello")
    public String sayHello() {
        return "Hello, secured world!";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated() // All requests need authentication
            )
            .formLogin(form -> form
                .permitAll() // Allow everyone to see the login page
            )
            .logout(logout -> logout
                .permitAll()); // Allow everyone to logout
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

Setting Access Rules

The .authorizeHttpRequests() method is where you begin defining authorization rules for your application's URLs.

Inside its lambda, you specify patterns and the access requirements for those patterns. Think of it as telling the security guard: "For this path, apply these rules."

This method chain is part of the SecurityFilterChain bean.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

// This snippet shows the core authorizeHttpRequests() part.
// It assumes the surrounding Spring Boot application and 
// SecurityConfig class from the previous scene.

@Configuration
@EnableWebSecurity
class SecurityConfigSnippet {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Your specific rules go here!
                // Example: .requestMatchers("/public/**").permitAll()
                // Example: .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }
}

Public & Restricted Paths

You can define paths that are accessible to everyone (permitAll()) or absolutely no one (denyAll()).

Use requestMatchers() to specify the URL patterns. Remember, rules are processed in order, so more specific rules should come first.

Run this app and try /public, then /private (login as user/password), then /secret.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class PublicPrivateApp {

    public static void main(String[] args) {
        SpringApplication.run(PublicPrivateApp.class, args);
    }

    @GetMapping("/public")
    public String publicContent() {
        return "This is public content!";
    }

    @GetMapping("/private")
    public String privateContent() {
        return "This is private content!";
    }

    @GetMapping("/secret")
    public String secretContent() {
        return "Top secret! No one allowed here.";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfigPublicPrivate {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll() // Anyone can access
                .requestMatchers("/secret/**").denyAll()   // No one can access
                .anyRequest().authenticated()              // All other requests need login
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

Only Logged-In Users

The .authenticated() method is used to ensure that a user has successfully logged in before accessing a specific path.

This is a fundamental rule for any part of your application that requires a user identity, such as a dashboard or profile page.

// Inside your SecurityFilterChain configuration:
http
    .authorizeHttpRequests(auth -> auth
        .requestMatchers("/login", "/register").permitAll() // Public paths
        .requestMatchers("/dashboard/**").authenticated() // Needs login
        .anyRequest().denyAll() // Deny everything else by default
    )
    // ... other http configurations (formLogin, logout) ...

Restricting by User Roles

You can grant access based on a user's role using .hasRole("ROLENAME") or .hasAuthority("ROLE_ROLENAME"). Spring Security automatically prefixes roles with "ROLE_" when using hasRole().

This allows fine-grained control over who can access sensitive resources. Run this app. Login as 'user' (password 'password') to access /user-dashboard. Login as 'admin' (password 'admin') to access /admin-panel.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class RoleBasedApp {

    public static void main(String[] args) {
        SpringApplication.run(RoleBasedApp.class, args);
    }

    @GetMapping("/home")
    public String home() { return "Welcome!"; }

    @GetMapping("/user-dashboard")
    public String userDashboard() { return "User Dashboard!"; }

    @GetMapping("/admin-panel")
    public String adminPanel() { return "Admin Panel!"; }
}

@Configuration
@EnableWebSecurity
class SecurityConfigRoles {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/home").permitAll()
                .requestMatchers("/user-dashboard").hasRole("USER") // Only users with ROLE_USER
                .requestMatchers("/admin-panel").hasRole("ADMIN")   // Only users with ROLE_ADMIN
                .anyRequest().authenticated() // All others need login
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("admin")
            .roles("ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }
}

Rule Order is Crucial

When defining multiple rules with requestMatchers(), their order matters! Spring Security processes them from top to bottom, applying the first matching rule.

  • Most Specific First: Place specific URL patterns (e.g., /api/admin/users) before broader ones (e.g., /api/admin/**).
  • Catch-All Last: The .anyRequest() matcher should almost always be the last rule, acting as a default for anything not matched before.
// Incorrect order example (the second rule is unreachable):
// auth
//   .requestMatchers("/admin/**").authenticated()
//   .requestMatchers("/admin/public").permitAll() 

// Correct order example:
// auth
//   .requestMatchers("/admin/public").permitAll()
//   .requestMatchers("/admin/**").hasRole("ADMIN")
//   .anyRequest().authenticated()

Configuring Form Login

Spring Security provides a default login page. You can customize its behavior using .formLogin() within HttpSecurity.

Key configurations include the login page URL, the URL to process login data, and where to redirect after success or failure.

// Inside your SecurityFilterChain configuration:
http
    .authorizeHttpRequests(auth -> auth
        .anyRequest().authenticated()
    )
    .formLogin(form -> form
        .loginPage("/custom-login")      // Specify custom login page URL
        .loginProcessingUrl("/authenticate") // URL to submit login data
        .defaultSuccessUrl("/dashboard", true) // Redirect after success
        .failureUrl("/custom-login?error")  // Redirect on failure
        .permitAll() // Allow access to login page and its processing
    )
    .logout(logout -> logout.permitAll());

Cross-Site Request Forgery (CSRF)

CSRF is an attack where a malicious website tricks a user's browser into making an unwanted request to another trusted site where the user is authenticated.

Spring Security provides robust CSRF protection by default for stateful applications.

  • Enabled by default: For POST, PUT, DELETE requests, requiring a unique token.
  • Disable with caution: Use .csrf().disable() only for stateless APIs (e.g., REST APIs using JWTs) or when you have other CSRF protection.
// Inside your SecurityFilterChain configuration:
http
    // ... authorization rules ...
    .csrf(csrf -> csrf.disable()) // ONLY disable if you know what you're doing!
                                  // Common for stateless REST APIs.
    // ... formLogin, logout ...
;

HttpSecurity Configuration Check

You're building a Spring Boot application. You need to:

  • Allow public access to /api/public/**.
  • Require users with the ADMIN role to access /api/admin/**.
  • All other requests should require any authenticated user.

Which of the following configurations correctly achieve these requirements? (Select all that apply)

HttpSecurity Deep Dive Recap

Great job! You've mastered the essentials of HttpSecurity configuration.

We covered:

  • The role of HttpSecurity in defining web security rules.
  • Using .authorizeHttpRequests() for path-based authorization.
  • Methods like .permitAll(), .denyAll(), .authenticated(), and .hasRole().
  • The importance of rule order when defining multiple access rules.
  • Configuring .formLogin() for custom login pages.
  • Understanding and managing CSRF protection.

These skills are crucial for building robust and secure Spring Boot applications!

Preguntas frecuentes

¿La lección «Análisis detallado de la configuración de HttpSecurity» es gratis?

Sí — el texto completo de «Análisis detallado de la configuración de HttpSecurity» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Spring Security 6 & JWT Authentication, actualiza a CoddyKit PRO. El curso de Spring Security 6 & JWT Authentication incluye 4 lecciones en total.

¿Qué aprenderé en «Análisis detallado de la configuración de HttpSecurity»?

Domine la configuración de `HttpSecurity` para definir reglas de seguridad para distintas solicitudes y endpoints HTTP. Practicas Spring Security 6 & JWT Authentication con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.

¿Necesito experiencia previa para empezar Spring Security 6 & JWT Authentication?

No se requiere experiencia previa. Spring Security 6 & JWT Authentication en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 3 de 4.

¿Cuánto tiempo toma la lección «Análisis detallado de la configuración de HttpSecurity»?

La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.

¿Puedo escribir y ejecutar código en esta lección de Spring Security 6 & JWT Authentication?

Sí. Cada lección de Spring Security 6 & JWT Authentication incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.

Todas las lecciones de este curso

  1. Control de acceso basado en roles (RBAC)
  2. Seguridad a nivel de método con anotaciones
  3. Análisis detallado de la configuración de HttpSecurity
  4. Protección de endpoints con reglas de acceso personalizadas
← Volver a Spring Security 6 & JWT Authentication