WebSockets & Real-Time Systems with Spring · レッスン

Spring Securityの統合

Spring Securityを統合し、WebSocket接続とメッセージフローを保護します。

「Spring Securityの統合」はCoddyKit上の無料WebSockets & Real-Time Systems with Springレッスンです。これはレッスン2/4です。下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。これはWebSockets & Real-Time Systems with Spring学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 WebSockets & Real-Time Systems with Springコースには全4レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Secure Your Real-Time Apps

Integrating real-time features like WebSockets into your applications is exciting, but security is paramount. Just like traditional HTTP endpoints, your WebSocket connections and message flows need protection.

Data Integrity: Prevent unauthorized tampering with messages.
Confidentiality: Ensure only authorized users can read sensitive data.
Access Control: Control who can connect, send messages, or subscribe to topics.

Spring Security offers a powerful framework to secure your WebSocket endpoints effectively.

Essential Security Dependencies

To begin securing your Spring WebSocket application, you'll need to add the necessary Spring Security dependencies to your project. If you're using Spring Boot, these are typically straightforward.

You'll primarily need:

spring-boot-starter-security: Provides core Spring Security features.
spring-security-messaging: Specifically for securing Spring's messaging infrastructure, including WebSockets and STOMP.

If you used Spring Initializr, ensure these are included in your pom.xml (Maven) or build.gradle (Gradle).

HTTP Security Foundation

WebSocket connections typically start with an HTTP handshake. This means that your existing HTTP security configuration in Spring Security forms the foundation for WebSocket security.

Before messages flow over WebSockets, the user is usually authenticated via a standard HTTP login process. Spring Security then leverages this authenticated session to secure subsequent WebSocket interactions. A minimal HTTP security setup might look like this:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
  http
    .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
    .formLogin(withDefaults());
  return http.build();
}

This ensures all HTTP requests require authentication, which is crucial for the WebSocket handshake.

Activate WebSocket Security

Once you have your basic HTTP security in place, you need to tell Spring Security to secure your WebSocket messages. This is done by adding the @EnableWebSocketSecurity annotation.

You'll typically place this annotation on a configuration class that extends WebSocketMessageBrokerConfigurer. This allows you to customize both the WebSocket message broker and its security rules within a single configuration.

The @EnableWebSocketSecurity annotation enables Spring Security's message-based authorization for STOMP messages, allowing you to define fine-grained access control.

Guarding STOMP Destinations

Spring Security integrates with the STOMP protocol, allowing you to secure specific message destinations. You achieve this by overriding the configureInbound() method in your WebSocketMessageBrokerConfigurer.

Inside this method, you use a MessageSecurityMetadataSourceRegistry to define rules based on destination patterns:

.simpDestMatchers("/app/private-chat").authenticated(): Only authenticated users can send messages to this destination.
.simpDestMatchers("/topic/admin-updates").hasRole("ADMIN"): Only users with the 'ADMIN' role can subscribe to this topic.

This provides powerful, URL-like security for your real-time messages.

User Identity in WebSockets

A key benefit of integrating Spring Security is how it handles user authentication. When a user connects to a WebSocket endpoint after authenticating via HTTP, Spring Security automatically associates their Principal (user identity) with the WebSocket session.

This means that any security rules you define for WebSocket messages can leverage the same authentication and authorization context as your regular HTTP requests. You don't need to re-authenticate users separately for WebSockets.

The Principal object will be available in the WebSocket session, allowing you to make authorization decisions based on the authenticated user's roles or details.

Control Message Sending

You can define authorization rules for messages that clients send to the server (e.g., publishing to an /app destination). This is done using .simpMessageSending() in the MessageSecurityMetadataSourceRegistry.

For example, to allow only authenticated users to send messages:

messages.simpMessageSending().authenticated();

Or, to restrict sending to a specific role:

messages.simpMessageSending().hasRole("USER");

This ensures that only authorized clients can publish messages to your application's internal handlers.

Restrict Subscriptions

Controlling who can subscribe to a particular topic is equally important. You can use .simpSubscribe() within the MessageSecurityMetadataRegistry to apply authorization rules for subscription requests.

For instance, to allow anyone to subscribe to a public topic, but only admins to a private one:

messages
  .simpSubscribeDestMatchers("/topic/public").permitAll()
  .simpSubscribeDestMatchers("/topic/private-admin").hasRole("ADMIN");

This prevents unauthorized users from receiving messages meant for specific groups or roles.

Example: Securing Destinations

Let's see a minimal Spring Boot application that integrates Spring Security to protect WebSocket STOMP destinations. This example defines different access rules for public, admin, and authenticated-only channels.

When this application starts, it enables WebSocket security and configures rules for sending and subscribing to specific paths. For a real application, you'd also need an HTTP security config (as mentioned in Scene 3) and a user service for authentication.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry;
import org.springframework.security.config.annotation.web.socket.EnableWebSocketSecurity;
import org.springframework.web.socket.config.annotation.EnableWebSocketMessageBroker;
import org.springframework.web.socket.config.annotation.WebSocketMessageBrokerConfigurer;
import org.springframework.web.socket.config.annotation.StompEndpointRegistry;
import org.springframework.messaging.simp.config.MessageBrokerRegistry;

@SpringBootApplication
@EnableWebSocketMessageBroker // Enables STOMP over WebSockets
@EnableWebSocketSecurity // Enables Spring Security for WebSocket messages
@Configuration
public class Main implements WebSocketMessageBrokerConfigurer {

  public static void main(String[] args) {
    SpringApplication.run(Main.class, args);
    System.out.println("WebSocket Security Demo Started!");
    System.out.println("Access at ws://localhost:8080/ws");
  }

  // Configure STOMP endpoints (e.g., /ws)
  @Override
  public void registerStompEndpoints(StompEndpointRegistry registry) {
    registry.addEndpoint("/ws").withSockJS();
  }

  // Configure message broker (e.g., /topic, /app)
  @Override
  public void configureMessageBroker(MessageBrokerRegistry registry) {
    registry.enableSimpleBroker("/topic", "/queue");
    registry.setApplicationDestinationPrefixes("/app");
  }

  // Configure message security rules for inbound messages
  @Override
  protected void configureInbound(MessageSecurityMetadataSourceRegistry messages) {
    messages
      // Allow anyone to subscribe to /topic/public
      .simpSubscribeDestMatchers("/topic/public").permitAll()
      // Only ADMIN role can subscribe to /topic/admin
      .simpSubscribeDestMatchers("/topic/admin").hasRole("ADMIN")
      // Authenticated users can send messages to /app/private
      .simpDestMatchers("/app/private").authenticated()
      // Deny all other message types/destinations by default
      .anyMessage().denyAll();
  }
}

Configure Access

Imagine you're building a real-time application with chat rooms. You need to set up the following security rules for your STOMP messages:

Clients can send messages to /app/general-chat only if they are authenticated.
Only users with the MODERATOR role can subscribe to /topic/moderator-alerts.
All other message types or destinations not explicitly allowed should be denied by default.

Which Spring Security rules would you apply from the options below?

Recap: Secure Your Real-Time Apps

You've learned how to integrate Spring Security with your WebSocket applications to protect real-time communication. Here's a quick summary:

Add spring-boot-starter-security and spring-security-messaging dependencies.
Ensure a basic HTTP security configuration exists, as WebSocket security builds on it.
Use @EnableWebSocketSecurity to activate message-level security.
Override configureInbound() in WebSocketMessageBrokerConfigurer to define rules.
Utilize MessageSecurityMetadataSourceRegistry with .simpDestMatchers(), .simpMessageSending(), and .simpSubscribeDestMatchers() to apply authorization.
Leverage .authenticated(), .hasRole(), and .permitAll(), along with .anyMessage().denyAll() for a robust security posture.

By following these steps, you can ensure your real-time applications are secure and reliable!

よくある質問

「Spring Securityの統合」レッスンは無料ですか？

はい。「Spring Securityの統合」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、WebSockets & Real-Time Systems with Springコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 WebSockets & Real-Time Systems with Springコースには全4レッスンが含まれています。

「Spring Securityの統合」で何を学びますか？

Spring Securityを統合し、WebSocket接続とメッセージフローを保護します。ブラウザで直接実行するハンズオンコードでWebSockets & Real-Time Systems with Springを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

WebSockets & Real-Time Systems with Springを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのWebSockets & Real-Time Systems with Springは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。これはレッスン2/4です。

「Spring Securityの統合」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このWebSockets & Real-Time Systems with Springレッスンでコードを書いて実行できますか？

はい。すべてのWebSockets & Real-Time Systems with Springレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

← WebSockets & Real-Time Systems with Springに戻る