0Pricing
Spring Security 6 & JWT Authentication · Ders

HttpSecurity Yapılandırmasına Derinlemesine Bakış

Çeşitli HTTP istekleri ve uç noktaları için güvenlik kuralları tanımlamak üzere `HttpSecurity` yapılandırmasında ustalaşın.

HttpSecurity Yapılandırmasına Derinlemesine Bakış, CoddyKit'te ücretsiz bir Spring Security 6 & JWT Authentication dersidir. Bu, 4 dersinin 3. dersidir. Aşağıdan dersin tamamını ücretsiz okuyabilir, sonra tarayıcıda yerleşik kod editörü ve 7/24 yapay zeka koçu ile uygulamalı olarak pratik yapabilirsin. Bu, Spring Security 6 & JWT Authentication öğrenme yolunun bir parçasıdır ve ilerlemeniz web ve CoddyKit uygulaması arasında senkronize olur. Spring Security 6 & JWT Authentication kursu toplamda 4 dersten oluşur.

Bu dersin bazı bölümleri henüz çevrilmemiş olup İngilizce olarak gösterilmektedir.

What is HttpSecurity?

HttpSecurity is a core component in Spring Security. It's like the security guard for your web application's doors.

It lets you define rules for different HTTP requests, controlling who can access which parts of your application and under what conditions.

  • Authentication: Who are you? (Are you logged in?)
  • Authorization: What are you allowed to do? (Do you have permission?)

Your First Security Chain

You configure HttpSecurity within a SecurityFilterChain bean. This bean defines a chain of filters that Spring Security uses to secure your app.

Here's a minimal setup. Run it and try to access /hello. You'll be redirected to a login page!

Use username: user, password: password.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class SecurityApp {

    public static void main(String[] args) {
        SpringApplication.run(SecurityApp.class, args);
    }

    @GetMapping("/hello")
    public String sayHello() {
        return "Hello, secured world!";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .anyRequest().authenticated() // All requests need authentication
            )
            .formLogin(form -> form
                .permitAll() // Allow everyone to see the login page
            )
            .logout(logout -> logout
                .permitAll()); // Allow everyone to logout
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

Setting Access Rules

The .authorizeHttpRequests() method is where you begin defining authorization rules for your application's URLs.

Inside its lambda, you specify patterns and the access requirements for those patterns. Think of it as telling the security guard: "For this path, apply these rules."

This method chain is part of the SecurityFilterChain bean.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

// This snippet shows the core authorizeHttpRequests() part.
// It assumes the surrounding Spring Boot application and 
// SecurityConfig class from the previous scene.

@Configuration
@EnableWebSecurity
class SecurityConfigSnippet {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Your specific rules go here!
                // Example: .requestMatchers("/public/**").permitAll()
                // Example: .anyRequest().authenticated()
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }
}

Public & Restricted Paths

You can define paths that are accessible to everyone (permitAll()) or absolutely no one (denyAll()).

Use requestMatchers() to specify the URL patterns. Remember, rules are processed in order, so more specific rules should come first.

Run this app and try /public, then /private (login as user/password), then /secret.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class PublicPrivateApp {

    public static void main(String[] args) {
        SpringApplication.run(PublicPrivateApp.class, args);
    }

    @GetMapping("/public")
    public String publicContent() {
        return "This is public content!";
    }

    @GetMapping("/private")
    public String privateContent() {
        return "This is private content!";
    }

    @GetMapping("/secret")
    public String secretContent() {
        return "Top secret! No one allowed here.";
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfigPublicPrivate {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll() // Anyone can access
                .requestMatchers("/secret/**").denyAll()   // No one can access
                .anyRequest().authenticated()              // All other requests need login
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

Only Logged-In Users

The .authenticated() method is used to ensure that a user has successfully logged in before accessing a specific path.

This is a fundamental rule for any part of your application that requires a user identity, such as a dashboard or profile page.

// Inside your SecurityFilterChain configuration:
http
    .authorizeHttpRequests(auth -> auth
        .requestMatchers("/login", "/register").permitAll() // Public paths
        .requestMatchers("/dashboard/**").authenticated() // Needs login
        .anyRequest().denyAll() // Deny everything else by default
    )
    // ... other http configurations (formLogin, logout) ...

Restricting by User Roles

You can grant access based on a user's role using .hasRole("ROLENAME") or .hasAuthority("ROLE_ROLENAME"). Spring Security automatically prefixes roles with "ROLE_" when using hasRole().

This allows fine-grained control over who can access sensitive resources. Run this app. Login as 'user' (password 'password') to access /user-dashboard. Login as 'admin' (password 'admin') to access /admin-panel.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
@RestController
public class RoleBasedApp {

    public static void main(String[] args) {
        SpringApplication.run(RoleBasedApp.class, args);
    }

    @GetMapping("/home")
    public String home() { return "Welcome!"; }

    @GetMapping("/user-dashboard")
    public String userDashboard() { return "User Dashboard!"; }

    @GetMapping("/admin-panel")
    public String adminPanel() { return "Admin Panel!"; }
}

@Configuration
@EnableWebSecurity
class SecurityConfigRoles {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/home").permitAll()
                .requestMatchers("/user-dashboard").hasRole("USER") // Only users with ROLE_USER
                .requestMatchers("/admin-panel").hasRole("ADMIN")   // Only users with ROLE_ADMIN
                .anyRequest().authenticated() // All others need login
            )
            .formLogin(form -> form.permitAll())
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("admin")
            .roles("ADMIN")
            .build();
        return new InMemoryUserDetailsManager(user, admin);
    }
}

Rule Order is Crucial

When defining multiple rules with requestMatchers(), their order matters! Spring Security processes them from top to bottom, applying the first matching rule.

  • Most Specific First: Place specific URL patterns (e.g., /api/admin/users) before broader ones (e.g., /api/admin/**).
  • Catch-All Last: The .anyRequest() matcher should almost always be the last rule, acting as a default for anything not matched before.
// Incorrect order example (the second rule is unreachable):
// auth
//   .requestMatchers("/admin/**").authenticated()
//   .requestMatchers("/admin/public").permitAll() 

// Correct order example:
// auth
//   .requestMatchers("/admin/public").permitAll()
//   .requestMatchers("/admin/**").hasRole("ADMIN")
//   .anyRequest().authenticated()

Configuring Form Login

Spring Security provides a default login page. You can customize its behavior using .formLogin() within HttpSecurity.

Key configurations include the login page URL, the URL to process login data, and where to redirect after success or failure.

// Inside your SecurityFilterChain configuration:
http
    .authorizeHttpRequests(auth -> auth
        .anyRequest().authenticated()
    )
    .formLogin(form -> form
        .loginPage("/custom-login")      // Specify custom login page URL
        .loginProcessingUrl("/authenticate") // URL to submit login data
        .defaultSuccessUrl("/dashboard", true) // Redirect after success
        .failureUrl("/custom-login?error")  // Redirect on failure
        .permitAll() // Allow access to login page and its processing
    )
    .logout(logout -> logout.permitAll());

Cross-Site Request Forgery (CSRF)

CSRF is an attack where a malicious website tricks a user's browser into making an unwanted request to another trusted site where the user is authenticated.

Spring Security provides robust CSRF protection by default for stateful applications.

  • Enabled by default: For POST, PUT, DELETE requests, requiring a unique token.
  • Disable with caution: Use .csrf().disable() only for stateless APIs (e.g., REST APIs using JWTs) or when you have other CSRF protection.
// Inside your SecurityFilterChain configuration:
http
    // ... authorization rules ...
    .csrf(csrf -> csrf.disable()) // ONLY disable if you know what you're doing!
                                  // Common for stateless REST APIs.
    // ... formLogin, logout ...
;

HttpSecurity Configuration Check

You're building a Spring Boot application. You need to:

  • Allow public access to /api/public/**.
  • Require users with the ADMIN role to access /api/admin/**.
  • All other requests should require any authenticated user.

Which of the following configurations correctly achieve these requirements? (Select all that apply)

HttpSecurity Deep Dive Recap

Great job! You've mastered the essentials of HttpSecurity configuration.

We covered:

  • The role of HttpSecurity in defining web security rules.
  • Using .authorizeHttpRequests() for path-based authorization.
  • Methods like .permitAll(), .denyAll(), .authenticated(), and .hasRole().
  • The importance of rule order when defining multiple access rules.
  • Configuring .formLogin() for custom login pages.
  • Understanding and managing CSRF protection.

These skills are crucial for building robust and secure Spring Boot applications!

Sıkça Sorulan Sorular

“HttpSecurity Yapılandırmasına Derinlemesine Bakış” dersi ücretsiz mi?

Evet — “HttpSecurity Yapılandırmasına Derinlemesine Bakış” dersin tüm metni burada web'de ücretsiz olarak okunabilir. Etkileşimli olarak pratik yapmak (yerleşik kod editörü ve 7/24 yapay zeka koçu) ve Spring Security 6 & JWT Authentication kursunun geri kalanını açmak için CoddyKit PRO'ya yükselt. Spring Security 6 & JWT Authentication kursu toplamda 4 dersten oluşur.

“HttpSecurity Yapılandırmasına Derinlemesine Bakış” dersinde ne öğreneceğim?

Çeşitli HTTP istekleri ve uç noktaları için güvenlik kuralları tanımlamak üzere `HttpSecurity` yapılandırmasında ustalaşın. Spring Security 6 & JWT Authentication ile uygulamalı kodu tarayıcıda doğrudan çalıştırarak pratik yaparsın ve 7/24 yapay zeka koçu dersi çalışırken sorularını yanıtlar.

Spring Security 6 & JWT Authentication öğrenmeye başlamak için deneyim gerekli mi?

Önceden deneyim gerekmez. CoddyKit'te Spring Security 6 & JWT Authentication, başlangıçtan ileri seviyeye kadar yapılandırıldığı için buradan başlayabilir veya başından başlayıp kendi hızında ilerleme yapabilirsin. Bu, 4 dersinin 3. dersidir.

“HttpSecurity Yapılandırmasına Derinlemesine Bakış” dersi ne kadar sürer?

Çoğu CoddyKit dersi yaklaşık 5–10 dakika sürer. Her biri kısa ve etkileşimli olduğu için sabit ilerleme yaparsın ve web ile uygulama arasında tam olarak bıraktığın yerden devam edebilirsin.

Bu Spring Security 6 & JWT Authentication dersinde kod yazıp çalıştırabilir miyim?

Evet. Her Spring Security 6 & JWT Authentication dersi yerleşik bir kod editörü içerir, bu sayede tarayıcıda gerçek kod yazıp çalıştırabilir ve anlık yapay zeka geri bildirimi alırsın — yerel kurulum gerekli değildir.

Bu kursun tüm dersleri

  1. Role Dayalı Erişim Denetimi (RBAC)
  2. Ek Açıklamalarla Yöntem Düzeyinde Güvenlik
  3. HttpSecurity Yapılandırmasına Derinlemesine Bakış
  4. Özel Erişim Kurallarıyla Uç Noktaları Güvenceye Alma
← Spring Security 6 & JWT Authentication Sayfasına Dön