WebSockets & Real-Time Systems with Spring · Leçon

Intégration de Spring Security

Intégrez Spring Security afin de protéger les connexions WebSocket et les flux de messages.

Intégration de Spring Security est une leçon WebSockets & Real-Time Systems with Spring gratuite sur CoddyKit. Ceci est la leçon 2 sur 4. Tu peux lire la leçon complète ci-dessous gratuitement — puis la pratiquer en direct dans le navigateur avec un éditeur de code intégré et un tuteur IA 24/7. Elle fait partie du parcours d'apprentissage WebSockets & Real-Time Systems with Spring, et ta progression se synchronise sur le web et l'application CoddyKit. Le cours WebSockets & Real-Time Systems with Spring comprend 4 leçons au total.

Certaines parties de cette leçon n'ont pas encore été traduites et s'affichent en anglais.

Secure Your Real-Time Apps

Integrating real-time features like WebSockets into your applications is exciting, but security is paramount. Just like traditional HTTP endpoints, your WebSocket connections and message flows need protection.

Data Integrity: Prevent unauthorized tampering with messages.
Confidentiality: Ensure only authorized users can read sensitive data.
Access Control: Control who can connect, send messages, or subscribe to topics.

Spring Security offers a powerful framework to secure your WebSocket endpoints effectively.

Essential Security Dependencies

To begin securing your Spring WebSocket application, you'll need to add the necessary Spring Security dependencies to your project. If you're using Spring Boot, these are typically straightforward.

You'll primarily need:

spring-boot-starter-security: Provides core Spring Security features.
spring-security-messaging: Specifically for securing Spring's messaging infrastructure, including WebSockets and STOMP.

If you used Spring Initializr, ensure these are included in your pom.xml (Maven) or build.gradle (Gradle).

HTTP Security Foundation

WebSocket connections typically start with an HTTP handshake. This means that your existing HTTP security configuration in Spring Security forms the foundation for WebSocket security.

Before messages flow over WebSockets, the user is usually authenticated via a standard HTTP login process. Spring Security then leverages this authenticated session to secure subsequent WebSocket interactions. A minimal HTTP security setup might look like this:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  http
    .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
    .formLogin(withDefaults());
  return http.build();
}

This ensures all HTTP requests require authentication, which is crucial for the WebSocket handshake.

Activate WebSocket Security

Once you have your basic HTTP security in place, you need to tell Spring Security to secure your WebSocket messages. This is done by adding the @EnableWebSocketSecurity annotation.

You'll typically place this annotation on a configuration class that extends WebSocketMessageBrokerConfigurer. This allows you to customize both the WebSocket message broker and its security rules within a single configuration.

The @EnableWebSocketSecurity annotation enables Spring Security's message-based authorization for STOMP messages, allowing you to define fine-grained access control.

Guarding STOMP Destinations

Spring Security integrates with the STOMP protocol, allowing you to secure specific message destinations. You achieve this by overriding the configureInbound() method in your WebSocketMessageBrokerConfigurer.

Inside this method, you use a MessageSecurityMetadataSourceRegistry to define rules based on destination patterns:

.simpDestMatchers("/app/private-chat").authenticated(): Only authenticated users can send messages to this destination.
.simpDestMatchers("/topic/admin-updates").hasRole("ADMIN"): Only users with the 'ADMIN' role can subscribe to this topic.

This provides powerful, URL-like security for your real-time messages.

User Identity in WebSockets

A key benefit of integrating Spring Security is how it handles user authentication. When a user connects to a WebSocket endpoint after authenticating via HTTP, Spring Security automatically associates their Principal (user identity) with the WebSocket session.

This means that any security rules you define for WebSocket messages can leverage the same authentication and authorization context as your regular HTTP requests. You don't need to re-authenticate users separately for WebSockets.

The Principal object will be available in the WebSocket session, allowing you to make authorization decisions based on the authenticated user's roles or details.

Control Message Sending

You can define authorization rules for messages that clients send to the server (e.g., publishing to an /app destination). This is done using .simpMessageSending() in the MessageSecurityMetadataSourceRegistry.

For example, to allow only authenticated users to send messages:

messages.simpMessageSending().authenticated();

Or, to restrict sending to a specific role:

messages.simpMessageSending().hasRole("USER");

This ensures that only authorized clients can publish messages to your application's internal handlers.

Restrict Subscriptions

Controlling who can subscribe to a particular topic is equally important. You can use .simpSubscribe() within the MessageSecurityMetadataRegistry to apply authorization rules for subscription requests.

For instance, to allow anyone to subscribe to a public topic, but only admins to a private one:

messages
  .simpSubscribeDestMatchers("/topic/public").permitAll()
  .simpSubscribeDestMatchers("/topic/private-admin").hasRole("ADMIN");

This prevents unauthorized users from receiving messages meant for specific groups or roles.

Example: Securing Destinations

Let's see a minimal Spring Boot application that integrates Spring Security to protect WebSocket STOMP destinations. This example defines different access rules for public, admin, and authenticated-only channels.

When this application starts, it enables WebSocket security and configures rules for sending and subscribing to specific paths. For a real application, you'd also need an HTTP security config (as mentioned in Scene 3) and a user service for authentication.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry;
import org.springframework.security.config.annotation.web.socket.EnableWebSocketSecurity;
import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker;
import org.springframework.web.socket.config.annotation.WebSocketMessageBrokerConfigurer;
import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
import org.springframework.messaging.simp.config.MessageBrokerRegistry;

@SpringBootApplication
@EnableWebSocketMessageBroker // Enables STOMP over WebSockets
@EnableWebSocketSecurity // Enables Spring Security for WebSocket messages
@Configuration
public class Main implements WebSocketMessageBrokerConfigurer {

  public static void main(String[] args) {
    SpringApplication.run(Main.class, args);
    System.out.println("WebSocket Security Demo Started!");
    System.out.println("Access at ws://localhost:8080/ws");
  }

  // Configure STOMP endpoints (e.g., /ws)
  @Override
  public void registerStompEndpoints(StompEndpointRegistry registry) {
    registry.addEndpoint("/ws").withSockJS();
  }

  // Configure message broker (e.g., /topic, /app)
  @Override
  public void configureMessageBroker(MessageBrokerRegistry registry) {
    registry.enableSimpleBroker("/topic", "/queue");
    registry.setApplicationDestinationPrefixes("/app");
  }

  // Configure message security rules for inbound messages
  @Override
  protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
    messages
      // Allow anyone to subscribe to /topic/public
      .simpSubscribeDestMatchers("/topic/public").permitAll()
      // Only ADMIN role can subscribe to /topic/admin
      .simpSubscribeDestMatchers("/topic/admin").hasRole("ADMIN")
      // Authenticated users can send messages to /app/private
      .simpDestMatchers("/app/private").authenticated()
      // Deny all other message types/destinations by default
      .anyMessage().denyAll();
  }
}

Configure Access

Imagine you're building a real-time application with chat rooms. You need to set up the following security rules for your STOMP messages:

Clients can send messages to /app/general-chat only if they are authenticated.
Only users with the MODERATOR role can subscribe to /topic/moderator-alerts.
All other message types or destinations not explicitly allowed should be denied by default.

Which Spring Security rules would you apply from the options below?

Recap: Secure Your Real-Time Apps

You've learned how to integrate Spring Security with your WebSocket applications to protect real-time communication. Here's a quick summary:

Add spring-boot-starter-security and spring-security-messaging dependencies.
Ensure a basic HTTP security configuration exists, as WebSocket security builds on it.
Use @EnableWebSocketSecurity to activate message-level security.
Override configureInbound() in WebSocketMessageBrokerConfigurer to define rules.
Utilize MessageSecurityMetadataSourceRegistry with .simpDestMatchers(), .simpMessageSending(), and .simpSubscribeDestMatchers() to apply authorization.
Leverage .authenticated(), .hasRole(), and .permitAll(), along with .anyMessage().denyAll() for a robust security posture.

By following these steps, you can ensure your real-time applications are secure and reliable!

Questions Fréquemment Posées

La leçon « Intégration de Spring Security » est-elle gratuite ?

Oui — le texte complet de « Intégration de Spring Security » est gratuit à lire ici sur le web. Pour la pratiquer de manière interactive (un éditeur de code intégré et un tuteur IA 24/7) et déverrouiller le reste du cours WebSockets & Real-Time Systems with Spring, passe à CoddyKit PRO. Le cours WebSockets & Real-Time Systems with Spring comprend 4 leçons au total.

Qu'est-ce que j'apprendrai dans « Intégration de Spring Security » ?

Intégrez Spring Security afin de protéger les connexions WebSocket et les flux de messages. Tu pratiques WebSockets & Real-Time Systems with Spring avec du code pratique que tu exécutes directement dans le navigateur, et un tuteur IA 24/7 répond à tes questions au fur et à mesure que tu avances dans la leçon.

Dois-je avoir de l'expérience pour commencer WebSockets & Real-Time Systems with Spring ?

Aucune expérience préalable n'est requise. WebSockets & Real-Time Systems with Spring sur CoddyKit est structuré pour les débutants jusqu'aux apprenants avancés, donc tu peux commencer ici ou depuis le début et avancer à ton rythme. Ceci est la leçon 2 sur 4.

Combien de temps prend la leçon « Intégration de Spring Security » ?

La plupart des leçons CoddyKit prennent environ 5–10 minutes. Chacune est courte et interactive, tu progresses régulièrement et tu repiques exactement où tu t'es arrêté sur le web et l'app.

Peux-tu écrire et exécuter du code dans cette leçon WebSockets & Real-Time Systems with Spring ?

Oui. Chaque leçon WebSockets & Real-Time Systems with Spring inclut un éditeur de code intégré, tu écris et exécutes du vrai code directement dans ton navigateur et tu reçois des retours IA instantanés — aucune configuration locale requise.

Toutes les leçons de ce cours

← Retour à WebSockets & Real-Time Systems with Spring