PricingLoginStart free
Spring Security 6 & JWT Authentication · Pelajaran

Pengendalian Akses Berbasis Peran (RBAC)

Terapkan otorisasi berbasis peran untuk membatasi akses ke sumber daya tertentu berdasarkan peran dan izin pengguna.

Pelajaran 1 dari 412 langkah

Pengendalian Akses Berbasis Peran (RBAC) adalah pelajaran Spring Security 6 & JWT Authentication gratis di CoddyKit. Ini adalah pelajaran 1 dari 4. Kamu bisa membaca pelajaran lengkapnya di bawah secara gratis — lalu praktikkan langsung di browser dengan editor kode bawaan dan tutor AI 24/7. Ini adalah bagian dari jalur belajar Spring Security 6 & JWT Authentication, dan progresmu tersinkronisasi di web dan aplikasi CoddyKit. Kursus Spring Security 6 & JWT Authentication mencakup 4 pelajaran total.

Bagian dari pelajaran ini belum diterjemahkan dan ditampilkan dalam bahasa Inggris.

Understanding RBAC Basics

Welcome! Today we'll dive into Role-Based Access Control (RBAC). It's a fundamental security concept for managing who can do what in an application.

Imagine a school: students can view grades, teachers can post grades, and administrators can manage all users. Each group has a 'role' with specific 'permissions'.

  • Role: A collection of permissions.
  • Permission: The ability to perform a specific action (e.g., read, write, delete).

Roles in Spring Security

Spring Security uses roles to enforce authorization. When you define a user, you also assign them one or more roles.

Internally, Spring Security treats roles as Granted Authorities. By convention, roles are often prefixed with ROLE_ (e.g., ROLE_ADMIN, ROLE_USER). This helps distinguish them from other types of authorities.

Assigning Roles to Users

Before we can use RBAC, users need roles! When a user logs in, Spring Security's authentication process retrieves their assigned roles.

These roles are typically loaded from a database via a UserDetailsService, or for simpler cases, defined directly in memory. We'll use in-memory users for our examples to keep things clear.

Securing URLs with `hasRole()`

The core of RBAC in Spring Security for web applications is configuring HttpSecurity. We use methods like hasRole() to specify which roles can access certain URL patterns.

For example, to protect an 'admin' page, you might write: .requestMatchers("/admin/**").hasRole("ADMIN"). Spring Security automatically adds the ROLE_ prefix when you use hasRole().

RBAC Web Security Config

Let's see a simple Spring Security configuration. This setup defines two in-memory users (user and admin) and secures two endpoints: /user and /admin.

Try running this code and accessing the URLs!

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class Main {

  public static void main(String[] args) {
    SpringApplication.run(Main.class, args);
  }

  @GetMapping("/user")
  public String userEndpoint() {
    return "Hello, User!";
  }

  @GetMapping("/admin")
  public String adminEndpoint() {
    return "Hello, Admin!";
  }

  @Configuration
  @EnableWebSecurity
  static class WebSecurityConfig {

    @Bean
    public UserDetailsService userDetailsService() {
      UserDetails user = User.withDefaultPasswordEncoder()
          .username("user")
          .password("password")
          .roles("USER")
          .build();
      UserDetails admin = User.withDefaultPasswordEncoder()
          .username("admin")
          .password("password")
          .roles("ADMIN", "USER")
          .build();
      return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
      http
          .authorizeHttpRequests(authorize -> authorize
              .requestMatchers("/user/**").hasRole("USER")
              .requestMatchers("/admin/**").hasRole("ADMIN")
              .anyRequest().authenticated()
          )
          .formLogin(org.springframework.security.config.Customizer.withDefaults());
      return http.build();
    }
  }
}

Testing Our RBAC Setup

After running the previous example, open your browser and try to access these URLs:

  • http://localhost:8080/user: Log in with user/password or admin/password. Both should work!
  • http://localhost:8080/admin: Log in with admin/password. This should work.
  • http://localhost:8080/admin: Log in with user/password. You should see an 'Access Denied' error (403 Forbidden).

This demonstrates how roles restrict access!

Multiple Roles: `hasAnyRole()`

What if an endpoint can be accessed by more than one role? Spring Security provides hasAnyRole() for this.

Instead of listing multiple hasRole() calls, you can do: .requestMatchers("/dashboard/**").hasAnyRole("USER", "ADMIN"). This grants access if the authenticated user has EITHER the USER role OR the ADMIN role.

`hasRole()` vs `hasAuthority()`

You might also see hasAuthority() being used. What's the difference?

  • hasRole("ADMIN"): This implicitly adds the ROLE_ prefix, so it checks for ROLE_ADMIN.
  • hasAuthority("ROLE_ADMIN"): This requires the exact authority string, including the ROLE_ prefix if it's part of the authority name.

Generally, hasRole() is preferred for clarity when dealing with roles defined with the ROLE_ prefix.

Securing Specific HTTP Methods

RBAC can also be applied to specific HTTP methods for a given path. This is useful for REST APIs where different actions (GET, POST, PUT, DELETE) require different permissions.

You can chain requestMatchers() with HttpMethod:

.requestMatchers(HttpMethod.POST, "/products/**").hasRole("ADMIN")
.requestMatchers(HttpMethod.GET, "/products/**").hasAnyRole("USER", "ADMIN")

Here, only ADMIN can create products, but both USER and ADMIN can view them.

Best Practices for RBAC

To make RBAC effective and manageable:

  • Keep Roles Simple: Don't create too many roles. Roles should represent distinct job functions.
  • Least Privilege: Grant only the necessary roles/permissions to users.
  • Centralized Management: Manage roles and their assignments from a single, secure place.
  • Audit Regularly: Periodically review role assignments and permissions to ensure they are still appropriate.

RBAC Knowledge Check

You've learned about implementing Role-Based Access Control in Spring Security. Let's quickly test your understanding!

Jawab di pelajaran interaktif

Recap: Role-Based Access Control

Great job! In this lesson, you learned about:

  • What RBAC is and its importance for authorization.
  • How Spring Security uses roles (as GrantedAuthority).
  • Configuring URL-based RBAC with HttpSecurity.
  • Using hasRole() and hasAnyRole() to protect endpoints.
  • Distinguishing between hasRole() and hasAuthority().
  • Applying RBAC to specific HTTP methods.
  • Key best practices for effective RBAC implementation.

You now have a solid foundation for controlling access based on user roles!

Gratis untuk memulai

Belajar Java dengan tutor AI — gratis

Tulis dan jalankan kode asli di browser kamu, dapatkan bantuan instan dari tutor AI 24/7, dan lanjutkan di mana kamu tinggalkan di web atau aplikasi.

Kursus
12
Pelajaran
48
Mulai belajar gratisLihat kursus lengkapnya

Pertanyaan yang Sering Diajukan

Apakah pelajaran “Pengendalian Akses Berbasis Peran (RBAC)” gratis?

Ya — teks lengkap “Pengendalian Akses Berbasis Peran (RBAC)” gratis dibaca di sini di web. Untuk praktiknya secara interaktif (editor kode bawaan dan tutor AI 24/7) dan buka sisa kursus Spring Security 6 & JWT Authentication, upgrade ke CoddyKit PRO. Kursus Spring Security 6 & JWT Authentication mencakup 4 pelajaran total.

Apa yang akan aku pelajari di “Pengendalian Akses Berbasis Peran (RBAC)”?

Terapkan otorisasi berbasis peran untuk membatasi akses ke sumber daya tertentu berdasarkan peran dan izin pengguna. Kamu berlatih Spring Security 6 & JWT Authentication dengan kode praktik yang langsung kamu jalankan di browser, dan tutor AI 24/7 menjawab pertanyaanmu saat kamu mengerjakan pelajaran ini.

Apakah aku perlu pengalaman untuk memulai Spring Security 6 & JWT Authentication?

Tidak diperlukan pengalaman sebelumnya. Spring Security 6 & JWT Authentication di CoddyKit dirancang untuk pemula hingga pelajar tingkat lanjut, jadi kamu bisa memulai di sini atau dari awal dan belajar sesuai kecepatan kamu sendiri. Ini adalah pelajaran 1 dari 4.

Berapa lama pelajaran “Pengendalian Akses Berbasis Peran (RBAC)” memakan waktu?

Sebagian besar pelajaran CoddyKit memakan waktu sekitar 5–10 menit. Setiap pelajaran ringkas dan interaktif, jadi kamu membuat kemajuan stabil dan melanjutkan dari tempat kamu tinggalkan di web dan aplikasi.

Bisakah aku menulis dan menjalankan kode dalam pelajaran Spring Security 6 & JWT Authentication ini?

Ya. Setiap pelajaran Spring Security 6 & JWT Authentication menyertakan editor kode bawaan, jadi kamu menulis dan menjalankan kode nyata langsung di browser dan mendapatkan umpan balik AI instan — tidak diperlukan penyiapan lokal.

Semua pelajaran dalam kursus ini

  1. Pengendalian Akses Berbasis Peran (RBAC)
  2. Keamanan Tingkat Metode dengan Anotasi
  3. Pendalaman Konfigurasi HttpSecurity
  4. Mengamankan Titik Akhir dengan Aturan Akses Khusus
← Kembali ke Spring Security 6 & JWT Authentication