PricingLoginStart free
GraphQL APIs with Spring Boot · Lekcja

Uwierzytelnianie za pomocą Spring Security

Zintegruj Spring Security, aby chronić endpointy GraphQL i zarządzać uwierzytelnianiem użytkowników.

Lekcja 2 z 411 kroki

Uwierzytelnianie za pomocą Spring Security to bezpłatna lekcja GraphQL APIs with Spring Boot na CoddyKit. To lekcja 2 z 4. Możesz przeczytać całą lekcję poniżej za darmo — a potem ćwiczyć ją interaktywnie w przeglądarce z wbudowanym edytorem kodu i tutorem AI dostępnym 24/7. To część ścieżki edukacyjnej GraphQL APIs with Spring Boot, a Twój postęp synchronizuje się między webem a aplikacją CoddyKit. Kurs GraphQL APIs with Spring Boot zawiera 4 lekcji w sumie.

Części tej lekcji nie zostały jeszcze przetłumaczone i są wyświetlane po angielsku.

Why Auth for GraphQL?

Welcome! In this lesson, we'll integrate Spring Security with our GraphQL API. While GraphQL defines how to query and mutate data, it doesn't specify authentication or authorization.

Protecting your API is crucial to ensure only authorized users can access sensitive data and perform specific actions. Spring Security is a powerful and flexible framework for this.

Spring Security Basics

Spring Security is a comprehensive security framework for Spring applications. It provides authentication (verifying who you are) and authorization (what you're allowed to do).

  • Authentication: Verifies a user's identity (e.g., username/password).
  • Authorization: Determines if an authenticated user has permission to access a resource or perform an action.

We'll start with basic authentication, which is simple to set up for testing.

Add Security Dependency

First, we need to add the Spring Security starter dependency to our Spring Boot project. This brings in all the necessary components for security.

Add the following to your pom.xml file:

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Don't forget to also include your GraphQL starter, e.g., spring-boot-starter-graphql if you haven't already.

Configure Basic In-Memory Auth

For a quick start, Spring Security can use in-memory user details. We define a SecurityFilterChain bean to configure the HTTP security rules.

This setup creates two users: 'user' and 'admin', both with a password 'password' (encoded using BCrypt) and different roles.

package com.coddykit;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authorize -> authorize
                .anyRequest().authenticated()
            )
            .httpBasic();
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password"))
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("password"))
            .roles("ADMIN", "USER")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Protecting GraphQL Paths

Now, let's explicitly secure our GraphQL endpoints. We want to make sure that only authenticated users can access the /graphql endpoint where our API lives.

We can modify the SecurityFilterChain to specify access rules for specific paths. For example, requiring the 'USER' role to access GraphQL.

package com.coddykit;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable()) // Disable CSRF for API (consider for production)
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/graphql/**", "/graphiql/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .httpBasic();
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password"))
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("password"))
            .roles("ADMIN", "USER")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

A Simple GraphQL Query

To test our security, let's create a very basic GraphQL query. This query will simply return a greeting message. We'll then try to access it with and without authentication.

This demonstrates a minimal GraphQL API that Spring Security will protect.

package com.coddykit;

import org.springframework.graphql.data.method.annotation.QueryMapping;
import org.springframework.stereotype.Controller;

@Controller
public class GreetingController {

    @QueryMapping
    public String hello() {
        return "Hello, secured GraphQL world!";
    }
}

Full Secure App Example

Here's a complete Spring Boot application integrating Spring Security with a GraphQL endpoint. Run this code, then try to access http://localhost:8080/graphql or /graphiql.

You should be prompted for a username and password (e.g., 'user'/'password'). Without them, access will be denied.

package com.coddykit;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.graphql.data.method.annotation.QueryMapping;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.stereotype.Controller;

@SpringBootApplication
public class SecuredGraphQLApp {

    public static void main(String[] args) {
        SpringApplication.run(SecuredGraphQLApp.class, args);
    }
}

@Controller
class GreetingController {

    @QueryMapping
    public String hello() {
        return "Hello, secured GraphQL world!";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/graphql/**", "/graphiql/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .httpBasic();
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
        UserDetails user = User.builder()
            .username("user")
            .password(passwordEncoder.encode("password"))
            .roles("USER")
            .build();
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder.encode("password"))
            .roles("ADMIN", "USER")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Custom UserDetailsService

In-memory users are great for development, but real applications need to load user data from a database or external service. This is where a custom UserDetailsService comes in.

You'd implement this interface to fetch user details (username, password, roles) based on the provided username. Spring Security then uses this to authenticate the user.

package com.coddykit;

import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.crypto.password.PasswordEncoder;

@Service
public class MyCustomUserDetailsService implements UserDetailsService {

    private final PasswordEncoder passwordEncoder;

    public MyCustomUserDetailsService(PasswordEncoder passwordEncoder) {
        this.passwordEncoder = passwordEncoder;
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // In a real app, you'd fetch this from a DB
        // For demonstration, let's hardcode a user
        if ("coddy".equals(username)) {
            return User.builder()
                .username("coddy")
                .password(passwordEncoder.encode("secret")) // Stored encoded password
                .roles("USER")
                .build();
        } else {
            throw new UsernameNotFoundException("User not found: " + username);
        }
    }
}

Understanding PasswordEncoder

Never store passwords in plain text! PasswordEncoder is an interface for encoding and verifying passwords. BCryptPasswordEncoder is a strong, widely recommended implementation.

  • Encoding: Transforms a plain-text password into a secure hash.
  • Matching: Compares a raw password with an encoded one.

Spring Security automatically uses the PasswordEncoder bean you provide to handle password verification.

Security Integration Check

You've learned how to set up basic authentication for your GraphQL API. Let's test your understanding of the key components involved.

Odpowiedz w interaktywnej lekcji

Lesson Recap: Secure Your API

Great job! You've learned how to integrate Spring Security to protect your GraphQL endpoints. We covered:

  • The importance of authentication for GraphQL APIs.
  • Adding the Spring Security dependency.
  • Configuring a SecurityFilterChain for basic authentication.
  • Protecting specific GraphQL paths.
  • Implementing a custom UserDetailsService for real-world user management.
  • Using PasswordEncoder for secure password handling.

This lays the foundation for building robust and secure GraphQL APIs. Next, you'll explore authorization to control access to fields and operations!

Bezpłatny start

Ucz się GraphQL APIs with Spring Boot dzięki korepetycjom AI — za darmo

Pisz i uruchamiaj kod w przeglądarce, otrzymuj natychmiastową pomoc od korepetytora AI dostępnego 24/7 i kontynuuj naukę w sieci lub w aplikacji.

Kursy
12
Lekcje
48
Zacznij naukę bezpłatnieWyświetl pełny kurs

Często zadawane pytania

Czy lekcja „Uwierzytelnianie za pomocą Spring Security” jest bezpłatna?

Tak — pełny tekst „Uwierzytelnianie za pomocą Spring Security” jest dostępny za darmo tutaj w sieci. Aby ćwiczyć ją interaktywnie (wbudowany edytor kodu i tutor AI dostępny 24/7) i odblokować resztę kursu GraphQL APIs with Spring Boot, przejdź na CoddyKit PRO. Kurs GraphQL APIs with Spring Boot zawiera 4 lekcji w sumie.

Co nauczysz się w „Uwierzytelnianie za pomocą Spring Security”?

Zintegruj Spring Security, aby chronić endpointy GraphQL i zarządzać uwierzytelnianiem użytkowników. Ćwiczysz GraphQL APIs with Spring Boot z praktycznym kodem, który uruchamiasz bezpośrednio w przeglądarce, a tutor AI dostępny 24/7 odpowiada na Twoje pytania podczas pracy nad lekcją.

Czy potrzebuję doświadczenia, aby zacząć GraphQL APIs with Spring Boot?

Nie wymagamy żadnego doświadczenia. GraphQL APIs with Spring Boot w CoddyKit jest strukturyzowany dla początkujących i zaawansowanych użytkowników, więc możesz zacząć tutaj lub od początku i uczyć się w swoim tempie. To lekcja 2 z 4.

Ile czasu zajmuje lekcja „Uwierzytelnianie za pomocą Spring Security”?

Większość lekcji CoddyKit trwa około 5–10 minut. Każda lekcja to mały, interaktywny krok, dzięki czemu robisz systematyczne postępy i zawsze wracasz dokładnie do tego samego miejsca — na webie i w aplikacji.

Czy mogę pisać i uruchamiać kod w tej lekcji GraphQL APIs with Spring Boot?

Tak. Każda lekcja GraphQL APIs with Spring Boot zawiera wbudowany edytor kodu, więc piszesz i uruchamiasz prawdziwy kod bezpośrednio w przeglądarce i od razu otrzymujesz sprzężenie zwrotne od AI — bez konfiguracji na komputerze.

Wszystkie lekcje w tym kursie

  1. Niestandardowa obsługa błędów w GraphQL
  2. Uwierzytelnianie za pomocą Spring Security
  3. Autoryzacja za pomocą dyrektyw i kontekstu
  4. Ograniczanie częstotliwości i ochrona przed zbyt głębokimi zapytaniami
← Powrót do GraphQL APIs with Spring Boot