Securing REST APIs with Spring Security – in Spring Boot

What You’ll Learn 📚

In this tutorial, we’ll cover:

• An introduction to REST APIs and Spring Security
• Key terminology and concepts
• Step-by-step examples from simple to complex
• Common questions and troubleshooting tips

Introduction to REST APIs and Spring Security

Before we dive into the code, let’s understand what REST APIs and Spring Security are all about.

What is a REST API?

A REST API (Representational State Transfer Application Programming Interface) allows different software applications to communicate with each other over the internet. Think of it as a waiter in a restaurant who takes your order (request) and brings back your food (response). 🍽️

What is Spring Security?

Spring Security is a powerful and customizable authentication and access-control framework for Java applications. It helps protect your applications from unauthorized access, much like a security guard at a building entrance. 🚪

Key Terminology

• Authentication: Verifying the identity of a user or system. It’s like checking an ID card.
• Authorization: Determining what an authenticated user is allowed to do. It’s like having a VIP pass to certain areas.
• Endpoint: A specific URL where an API can be accessed.

Getting Started with a Simple Example

Let’s start with the simplest example of securing a REST API using Spring Security in Spring Boot.

# Step 1: Create a new Spring Boot project using Spring Initializr

// Step 2: Add Spring Security dependency in your pom.xml file

    org.springframework.boot
    spring-boot-starter-security

// Step 3: Create a simple REST controller
@RestController
public class HelloWorldController {
    @GetMapping("/hello")
    public String hello() {
        return "Hello, World!";
    }
}

// Step 4: Run your application and access the /hello endpoint
// You will be prompted to enter a username and password

Progressively Complex Examples

Example 2: Custom User Details

Let’s customize the user details for authentication.

// Step 1: Create a custom user details service
@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        // For simplicity, we're hardcoding a user
        return User.withUsername("student")
                   .password("password")
                   .roles("USER")
                   .build();
    }
}

// Step 2: Configure Spring Security to use the custom user details service
@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Autowired
    private CustomUserDetailsService userDetailsService;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService);
    }
}

Example 3: Role-Based Access Control

Next, we’ll implement role-based access control.

// Step 1: Update the SecurityConfig to restrict access based on roles
@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .authorizeRequests()
        .antMatchers("/admin/**").hasRole("ADMIN")
        .antMatchers("/user/**").hasRole("USER")
        .and()
        .formLogin();
}

Common Questions and Troubleshooting

1. Why am I getting a 401 Unauthorized error?

   This usually means you’re not authenticated. Check your username and password.

2. How do I disable Spring Security for a specific endpoint?

   Use the permitAll() method in your security configuration.

3. Can I use Spring Security with JWT?

   Yes, Spring Security supports JWT for stateless authentication.

Troubleshooting Common Issues

Ensure your dependencies are correctly added to avoid class not found exceptions.

Remember, practice makes perfect! Try modifying the examples to see how changes affect security.

Practice Exercises

• Create a new endpoint and secure it with a different role.
• Implement JWT authentication in your Spring Boot application.

For more information, check out the Spring Security documentation.