Spring Boot 4 Microservices & REST APIs · Ders

REST Uç Noktalarının Güvenliğini Sağlama

REST API uç noktalarınızı yetkisiz erişime karşı korumak için Spring Security uygulayın.

REST Uç Noktalarının Güvenliğini Sağlama, CoddyKit'te ücretsiz bir Spring Boot 4 Microservices & REST APIs dersidir. Bu, 3 dersinin 2. dersidir. Aşağıdan dersin tamamını ücretsiz okuyabilir, sonra tarayıcıda yerleşik kod editörü ve 7/24 yapay zeka koçu ile uygulamalı olarak pratik yapabilirsin. Bu, Spring Boot 4 Microservices & REST APIs öğrenme yolunun bir parçasıdır ve ilerlemeniz web ve CoddyKit uygulaması arasında senkronize olur. Spring Boot 4 Microservices & REST APIs kursu toplamda 3 dersten oluşur.

Bu dersin bazı bölümleri henüz çevrilmemiş olup İngilizce olarak gösterilmektedir.

Why Secure Your API Endpoints?

APIs are gateways to your application's data and functionality. Without proper security, anyone could access, modify, or delete sensitive information.

This lesson will show you how Spring Security helps protect your REST APIs from unauthorized access, ensuring only legitimate users can interact with your services.

Spring Security: Your API's Bouncer

Spring Security is a powerful and highly customizable framework for authentication and access control. For REST APIs, it acts like a bouncer, checking credentials before allowing requests to reach your endpoints.

It handles user authentication (who you are).
It manages authorization (what you can do).
It protects against common web vulnerabilities.

Get Started: Add Dependency

To integrate Spring Security into your Spring Boot project, you need to add its starter dependency to your pom.xml file (if using Maven).

This dependency brings in all the necessary Spring Security components and auto-configuration.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Default Security Behavior

Once the Spring Security dependency is added, your Spring Boot application automatically secures all HTTP endpoints!

When you run the app, Spring Security generates a random password and logs it to the console. You'll need this password, along with the default username "user", to access any endpoint.

Customizing Security Rules

The default security is a good start, but you'll want to define your own rules. We do this by creating a security configuration class.

This class uses @Configuration and @EnableWebSecurity, and defines a SecurityFilterChain bean to customize HTTP security.

Try running this basic setup. It will still require authentication, but we'll add users next!

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic(); // Enable basic auth
        http.authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated() // All requests need auth
        );
        return http.build();
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured World!";
    }
}

Defining Users in Memory

For simple applications or testing, you can define users directly in your security configuration using an InMemoryUserDetailsManager bean.

We'll add a user named "user" with password "password" and role "USER". Note: withDefaultPasswordEncoder() is for quick demos; in production, use strong password encoders.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .anyRequest().authenticated()
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured User!";
    }
}

Endpoint-Specific Authorization

You can define different security rules for different URL patterns using requestMatchers(). The anyRequest().authenticated() rule ensures all other requests require authentication.

Here, we'll make our /hello endpoint require authentication, while other paths will be public.

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/hello").authenticated() // /hello requires auth
            .anyRequest().permitAll() // All other requests are public
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class HelloController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, Secured User!";
    }

    @GetMapping("/public")
    public String publicEndpoint() {
        return "Hello, Public!";
    }
}

Public Endpoints with permitAll()

Sometimes you need endpoints that don't require any authentication, like a health check or public information. For these, you use .permitAll().

Order matters! More specific rules (like /public/**) should come before more general ones (like anyRequest()).

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll() // Public access
            .requestMatchers("/secure/**").authenticated() // Requires authentication
            .anyRequest().denyAll() // Deny all other requests by default
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class MyController {
    @GetMapping("/public/info")
    public String publicInfo() {
        return "This is public information!";
    }

    @GetMapping("/secure/data")
    public String secureData() {
        return "This is secure data!";
    }
}

CSRF Protection & REST APIs

CSRF (Cross-Site Request Forgery) protection is crucial for browser-based applications. However, for stateless REST APIs typically consumed by non-browser clients (like mobile apps or other services), CSRF protection is generally not needed and can sometimes cause issues.

You can explicitly disable it in your security configuration:

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class Main {
    public static void main(String[] args) {
        SpringApplication.run(Main.class, args);
    }
}

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable() // Disable CSRF for REST APIs
            .httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/secure/**").authenticated()
            .anyRequest().denyAll()
        );
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();
        return new InMemoryUserDetailsManager(user);
    }
}

@RestController
class MyController {
    @GetMapping("/public/info")
    public String publicInfo() {
        return "This is public information!";
    }

    @GetMapping("/secure/data")
    public String secureData() {
        return "This is secure data!";
    }
}

Quick Check: Security Access

Consider the following SecurityConfig. What would happen if you try to access /api/status without providing any credentials?

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .httpBasic();
        http.authorizeHttpRequests(authorize -> authorize
            .requestMatchers("/api/public/**").permitAll()
            .requestMatchers("/api/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        );
        return http.build();
    }
}

Lesson Recap: Securing Endpoints

In this lesson, you learned the foundational steps to secure your Spring Boot REST API endpoints:

Added the Spring Security dependency.
Understood the default security behavior.
Configured a SecurityFilterChain to define custom rules.
Set up in-memory users for basic authentication.
Used requestMatchers() with permitAll() and authenticated() to define access for specific paths.
Disabled CSRF protection for stateless REST APIs.

This knowledge is crucial for building robust and secure microservices!

Sıkça Sorulan Sorular

“REST Uç Noktalarının Güvenliğini Sağlama” dersi ücretsiz mi?

Evet — “REST Uç Noktalarının Güvenliğini Sağlama” dersin tüm metni burada web'de ücretsiz olarak okunabilir. Etkileşimli olarak pratik yapmak (yerleşik kod editörü ve 7/24 yapay zeka koçu) ve Spring Boot 4 Microservices & REST APIs kursunun geri kalanını açmak için CoddyKit PRO'ya yükselt. Spring Boot 4 Microservices & REST APIs kursu toplamda 3 dersten oluşur.

“REST Uç Noktalarının Güvenliğini Sağlama” dersinde ne öğreneceğim?

REST API uç noktalarınızı yetkisiz erişime karşı korumak için Spring Security uygulayın. Spring Boot 4 Microservices & REST APIs ile uygulamalı kodu tarayıcıda doğrudan çalıştırarak pratik yaparsın ve 7/24 yapay zeka koçu dersi çalışırken sorularını yanıtlar.

Spring Boot 4 Microservices & REST APIs öğrenmeye başlamak için deneyim gerekli mi?

Önceden deneyim gerekmez. CoddyKit'te Spring Boot 4 Microservices & REST APIs, başlangıçtan ileri seviyeye kadar yapılandırıldığı için buradan başlayabilir veya başından başlayıp kendi hızında ilerleme yapabilirsin. Bu, 3 dersinin 2. dersidir.

“REST Uç Noktalarının Güvenliğini Sağlama” dersi ne kadar sürer?

Çoğu CoddyKit dersi yaklaşık 5–10 dakika sürer. Her biri kısa ve etkileşimli olduğu için sabit ilerleme yaparsın ve web ile uygulama arasında tam olarak bıraktığın yerden devam edebilirsin.

Bu Spring Boot 4 Microservices & REST APIs dersinde kod yazıp çalıştırabilir miyim?

Evet. Her Spring Boot 4 Microservices & REST APIs dersi yerleşik bir kod editörü içerir, bu sayede tarayıcıda gerçek kod yazıp çalıştırabilir ve anlık yapay zeka geri bildirimi alırsın — yerel kurulum gerekli değildir.

Bu kursun tüm dersleri

OAuth2 ve JWT Temelleri
REST Uç Noktalarının Güvenliğini Sağlama
Role Dayalı Erişim Denetimi

← Spring Boot 4 Microservices & REST APIs Sayfasına Dön