Spring Security for N00bz: A quick introduction for the terminally insecure
summary
Live code shows Spring Security 5 defaults (HTTP firewall, security filter chain, safe headers) and builds a working example: form-based auth with in-memory users (two accounts, roles user/admin), adds a delegating password encoder (bcrypt default) so login works, and returns 403 for unauthorized access. Then it wires OpenID Connect + OAuth2 with Okta and Google, uses WebClient to call a local resource server and successfully reads JWT claims (scopes: openid profile email phone); 2FA via YubiKey works.
AI-written summary · about
chapters (30)
- 0:00Introduction
- 2:57Who am I
- 5:37Outside and Security
- 8:13System Security
- 11:41Spring Security
- 16:06Request Filtering
- 16:40Lets Code
- 16:59Dress Appropriately
- 17:21Lets Get Started
- 19:25My Favorite IDE
- 20:23Form Controller
- 21:36Terminal
- 21:59Spring Security Configuration
- 29:15Login Page
- 29:37Password Encoder
- 31:57Authorization
- 35:24OAuth
- 39:33Generating a new project
- 40:50Adding dependencies
- 41:30Configuration
- 42:30Endpoint Rest Controller
- 43:25Login with Google
- 44:55Resource Servers
- 45:35OAuth2 Resource Server
- 46:20Resource Controller
- 46:55JSON Web Token
- 48:55Creating a Filter
- 51:55Creating Endpoints
- 53:25Customer Customization
- 54:55Demo
related talks
52mSpring Security for N00bz: A quick introduction for the terminally insecure
43mIdentity crisis: bending Spring Security to your advanced use-cases
33mSpring Security Patterns
45mSpring Security: The Good Parts
48mModern Authentication Demystified: A Deep Dive into Spring Security’s Latest Innovations
54mSpring Security Patterns
52mArchitecture Deep Dive in Spring Security
01h 31mGetting Started with Spring Security 3.1