0Pricing
Spring Boot 4 Microservices & REST APIs · Leçon

Sécuriser les points de terminaison REST

Mettez en œuvre Spring Security pour protéger vos points de terminaison d’API REST contre les accès non autorisés.

Sécuriser les points de terminaison REST est une leçon Spring Boot 4 Microservices & REST APIs gratuite sur CoddyKit. Ceci est la leçon 2 sur 3. Tu peux lire la leçon complète ci-dessous gratuitement — puis la pratiquer en direct dans le navigateur avec un éditeur de code intégré et un tuteur IA 24/7. Elle fait partie du parcours d'apprentissage Spring Boot 4 Microservices & REST APIs, et ta progression se synchronise sur le web et l'application CoddyKit. Le cours Spring Boot 4 Microservices & REST APIs comprend 3 leçons au total.

Certaines parties de cette leçon n'ont pas encore été traduites et s'affichent en anglais.

Why Secure Your API Endpoints?

APIs are gateways to your application's data and functionality. Without proper security, anyone could access, modify, or delete sensitive information.

This lesson will show you how Spring Security helps protect your REST APIs from unauthorized access, ensuring only legitimate users can interact with your services.

Spring Security: Your API's Bouncer

Spring Security is a powerful and highly customizable framework for authentication and access control. For REST APIs, it acts like a bouncer, checking credentials before allowing requests to reach your endpoints.

  • It handles user authentication (who you are).
  • It manages authorization (what you can do).
  • It protects against common web vulnerabilities.

Get Started: Add Dependency

To integrate Spring Security into your Spring Boot project, you need to add its starter dependency to your pom.xml file (if using Maven).

This dependency brings in all the necessary Spring Security components and auto-configuration.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Default Security Behavior

Once the Spring Security dependency is added, your Spring Boot application automatically secures all HTTP endpoints!

When you run the app, Spring Security generates a random password and logs it to the console. You'll need this password, along with the default username "user", to access any endpoint.

Customizing Security Rules

The default security is a good start, but you'll want to define your own rules. We do this by creating a security configuration class.

This class uses @Configuration and @EnableWebSecurity, and defines a SecurityFilterChain bean to customize HTTP security.

Try running this basic setup. It will still require authentication, but we'll add users next!

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic(); // Enable basic auth
        http.authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated() // All requests need auth
        );
        return http.build();
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured World!";
    }
}

Defining Users in Memory

For simple applications or testing, you can define users directly in your security configuration using an InMemoryUserDetailsManager bean.

We'll add a user named "user" with password "password" and role "USER". Note: withDefaultPasswordEncoder() is for quick demos; in production, use strong password encoders.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured User!";
    }
}

Endpoint-Specific Authorization

You can define different security rules for different URL patterns using requestMatchers(). The anyRequest().authenticated() rule ensures all other requests require authentication.

Here, we'll make our /hello endpoint require authentication, while other paths will be public.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/hello").authenticated() // /hello requires auth
            .anyRequest().permitAll() // All other requests are public
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured User!";
    }

    @GetMapping("/public")
    public String publicEndpoint() {
        return "Hello, Public!";
    }
}

Public Endpoints with permitAll()

Sometimes you need endpoints that don't require any authentication, like a health check or public information. For these, you use .permitAll().

Order matters! More specific rules (like /public/**) should come before more general ones (like anyRequest()).

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll() // Public access
            .requestMatchers("/secure/**").authenticated() // Requires authentication
            .anyRequest().denyAll() // Deny all other requests by default
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class MyController {
    @GetMapping("/public/info")
    public String publicInfo() {
        return "This is public information!";
    }

    @GetMapping("/secure/data")
    public String secureData() {
        return "This is secure data!";
    }
}

CSRF Protection & REST APIs

CSRF (Cross-Site Request Forgery) protection is crucial for browser-based applications. However, for stateless REST APIs typically consumed by non-browser clients (like mobile apps or other services), CSRF protection is generally not needed and can sometimes cause issues.

You can explicitly disable it in your security configuration:

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // Disable CSRF for REST APIs
            .httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/secure/**").authenticated()
            .anyRequest().denyAll()
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class MyController {
    @GetMapping("/public/info")
    public String publicInfo() {
        return "This is public information!";
    }

    @GetMapping("/secure/data")
    public String secureData() {
        return "This is secure data!";
    }
}

Quick Check: Security Access

Consider the following SecurityConfig. What would happen if you try to access /api/status without providing any credentials?

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/api/public/**").permitAll()
            .requestMatchers("/api/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        );
        return http.build();
    }
}

Lesson Recap: Securing Endpoints

In this lesson, you learned the foundational steps to secure your Spring Boot REST API endpoints:

  • Added the Spring Security dependency.
  • Understood the default security behavior.
  • Configured a SecurityFilterChain to define custom rules.
  • Set up in-memory users for basic authentication.
  • Used requestMatchers() with permitAll() and authenticated() to define access for specific paths.
  • Disabled CSRF protection for stateless REST APIs.

This knowledge is crucial for building robust and secure microservices!

Questions Fréquemment Posées

La leçon « Sécuriser les points de terminaison REST » est-elle gratuite ?

Oui — le texte complet de « Sécuriser les points de terminaison REST » est gratuit à lire ici sur le web. Pour la pratiquer de manière interactive (un éditeur de code intégré et un tuteur IA 24/7) et déverrouiller le reste du cours Spring Boot 4 Microservices & REST APIs, passe à CoddyKit PRO. Le cours Spring Boot 4 Microservices & REST APIs comprend 3 leçons au total.

Qu'est-ce que j'apprendrai dans « Sécuriser les points de terminaison REST » ?

Mettez en œuvre Spring Security pour protéger vos points de terminaison d’API REST contre les accès non autorisés. Tu pratiques Spring Boot 4 Microservices & REST APIs avec du code pratique que tu exécutes directement dans le navigateur, et un tuteur IA 24/7 répond à tes questions au fur et à mesure que tu avances dans la leçon.

Dois-je avoir de l'expérience pour commencer Spring Boot 4 Microservices & REST APIs ?

Aucune expérience préalable n'est requise. Spring Boot 4 Microservices & REST APIs sur CoddyKit est structuré pour les débutants jusqu'aux apprenants avancés, donc tu peux commencer ici ou depuis le début et avancer à ton rythme. Ceci est la leçon 2 sur 3.

Combien de temps prend la leçon « Sécuriser les points de terminaison REST » ?

La plupart des leçons CoddyKit prennent environ 5–10 minutes. Chacune est courte et interactive, tu progresses régulièrement et tu repiques exactement où tu t'es arrêté sur le web et l'app.

Peux-tu écrire et exécuter du code dans cette leçon Spring Boot 4 Microservices & REST APIs ?

Oui. Chaque leçon Spring Boot 4 Microservices & REST APIs inclut un éditeur de code intégré, tu écris et exécutes du vrai code directement dans ton navigateur et tu reçois des retours IA instantanés — aucune configuration locale requise.

Toutes les leçons de ce cours

  1. Principes fondamentaux d’OAuth2 et des JWT
  2. Sécuriser les points de terminaison REST
  3. Contrôle d’accès fondé sur les rôles
← Retour à Spring Boot 4 Microservices & REST APIs