Spring Boot 4 Microservices & REST APIs · Pelajaran

Mengamankan Titik Akhir REST

Terapkan Spring Security untuk melindungi titik akhir API REST Anda dari akses tidak sah.

Mengamankan Titik Akhir REST adalah pelajaran Spring Boot 4 Microservices & REST APIs gratis di CoddyKit. Ini adalah pelajaran 2 dari 3. Kamu bisa membaca pelajaran lengkapnya di bawah secara gratis — lalu praktikkan langsung di browser dengan editor kode bawaan dan tutor AI 24/7. Ini adalah bagian dari jalur belajar Spring Boot 4 Microservices & REST APIs, dan progresmu tersinkronisasi di web dan aplikasi CoddyKit. Kursus Spring Boot 4 Microservices & REST APIs mencakup 3 pelajaran total.

Bagian dari pelajaran ini belum diterjemahkan dan ditampilkan dalam bahasa Inggris.

Why Secure Your API Endpoints?

APIs are gateways to your application's data and functionality. Without proper security, anyone could access, modify, or delete sensitive information.

This lesson will show you how Spring Security helps protect your REST APIs from unauthorized access, ensuring only legitimate users can interact with your services.

Spring Security: Your API's Bouncer

Spring Security is a powerful and highly customizable framework for authentication and access control. For REST APIs, it acts like a bouncer, checking credentials before allowing requests to reach your endpoints.

It handles user authentication (who you are).
It manages authorization (what you can do).
It protects against common web vulnerabilities.

Get Started: Add Dependency

To integrate Spring Security into your Spring Boot project, you need to add its starter dependency to your pom.xml file (if using Maven).

This dependency brings in all the necessary Spring Security components and auto-configuration.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Default Security Behavior

Once the Spring Security dependency is added, your Spring Boot application automatically secures all HTTP endpoints!

When you run the app, Spring Security generates a random password and logs it to the console. You'll need this password, along with the default username "user", to access any endpoint.

Customizing Security Rules

The default security is a good start, but you'll want to define your own rules. We do this by creating a security configuration class.

This class uses @Configuration and @EnableWebSecurity, and defines a SecurityFilterChain bean to customize HTTP security.

Try running this basic setup. It will still require authentication, but we'll add users next!

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic(); // Enable basic auth
        http.authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated() // All requests need auth
        );
        return http.build();
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured World!";
    }
}

Defining Users in Memory

For simple applications or testing, you can define users directly in your security configuration using an InMemoryUserDetailsManager bean.

We'll add a user named "user" with password "password" and role "USER". Note: withDefaultPasswordEncoder() is for quick demos; in production, use strong password encoders.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured User!";
    }
}

Endpoint-Specific Authorization

You can define different security rules for different URL patterns using requestMatchers(). The anyRequest().authenticated() rule ensures all other requests require authentication.

Here, we'll make our /hello endpoint require authentication, while other paths will be public.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/hello").authenticated() // /hello requires auth
            .anyRequest().permitAll() // All other requests are public
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured User!";
    }

    @GetMapping("/public")
    public String publicEndpoint() {
        return "Hello, Public!";
    }
}

Public Endpoints with permitAll()

Sometimes you need endpoints that don't require any authentication, like a health check or public information. For these, you use .permitAll().

Order matters! More specific rules (like /public/**) should come before more general ones (like anyRequest()).

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll() // Public access
            .requestMatchers("/secure/**").authenticated() // Requires authentication
            .anyRequest().denyAll() // Deny all other requests by default
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class MyController {
    @GetMapping("/public/info")
    public String publicInfo() {
        return "This is public information!";
    }

    @GetMapping("/secure/data")
    public String secureData() {
        return "This is secure data!";
    }
}

CSRF Protection & REST APIs

CSRF (Cross-Site Request Forgery) protection is crucial for browser-based applications. However, for stateless REST APIs typically consumed by non-browser clients (like mobile apps or other services), CSRF protection is generally not needed and can sometimes cause issues.

You can explicitly disable it in your security configuration:

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // Disable CSRF for REST APIs
            .httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/secure/**").authenticated()
            .anyRequest().denyAll()
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class MyController {
    @GetMapping("/public/info")
    public String publicInfo() {
        return "This is public information!";
    }

    @GetMapping("/secure/data")
    public String secureData() {
        return "This is secure data!";
    }
}

Quick Check: Security Access

Consider the following SecurityConfig. What would happen if you try to access /api/status without providing any credentials?

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/api/public/**").permitAll()
            .requestMatchers("/api/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        );
        return http.build();
    }
}

Lesson Recap: Securing Endpoints

In this lesson, you learned the foundational steps to secure your Spring Boot REST API endpoints:

Added the Spring Security dependency.
Understood the default security behavior.
Configured a SecurityFilterChain to define custom rules.
Set up in-memory users for basic authentication.
Used requestMatchers() with permitAll() and authenticated() to define access for specific paths.
Disabled CSRF protection for stateless REST APIs.

This knowledge is crucial for building robust and secure microservices!

Pertanyaan yang Sering Diajukan

Apakah pelajaran “Mengamankan Titik Akhir REST” gratis?

Ya — teks lengkap “Mengamankan Titik Akhir REST” gratis dibaca di sini di web. Untuk praktiknya secara interaktif (editor kode bawaan dan tutor AI 24/7) dan buka sisa kursus Spring Boot 4 Microservices & REST APIs, upgrade ke CoddyKit PRO. Kursus Spring Boot 4 Microservices & REST APIs mencakup 3 pelajaran total.

Apa yang akan aku pelajari di “Mengamankan Titik Akhir REST”?

Terapkan Spring Security untuk melindungi titik akhir API REST Anda dari akses tidak sah. Kamu berlatih Spring Boot 4 Microservices & REST APIs dengan kode praktik yang langsung kamu jalankan di browser, dan tutor AI 24/7 menjawab pertanyaanmu saat kamu mengerjakan pelajaran ini.

Apakah aku perlu pengalaman untuk memulai Spring Boot 4 Microservices & REST APIs?

Tidak diperlukan pengalaman sebelumnya. Spring Boot 4 Microservices & REST APIs di CoddyKit dirancang untuk pemula hingga pelajar tingkat lanjut, jadi kamu bisa memulai di sini atau dari awal dan belajar sesuai kecepatan kamu sendiri. Ini adalah pelajaran 2 dari 3.

Berapa lama pelajaran “Mengamankan Titik Akhir REST” memakan waktu?

Sebagian besar pelajaran CoddyKit memakan waktu sekitar 5–10 menit. Setiap pelajaran ringkas dan interaktif, jadi kamu membuat kemajuan stabil dan melanjutkan dari tempat kamu tinggalkan di web dan aplikasi.

Bisakah aku menulis dan menjalankan kode dalam pelajaran Spring Boot 4 Microservices & REST APIs ini?

Ya. Setiap pelajaran Spring Boot 4 Microservices & REST APIs menyertakan editor kode bawaan, jadi kamu menulis dan menjalankan kode nyata langsung di browser dan mendapatkan umpan balik AI instan — tidak diperlukan penyiapan lokal.

Semua pelajaran dalam kursus ini

← Kembali ke Spring Boot 4 Microservices & REST APIs