Securing SPAs with Spring
summary
Adds Spring Security starter to a Spring Boot backend and shows exact configs that stop real failures: configure a 401 authentication entry point instead of form-login redirects, enable CORS for localhost:4200, enable CSRF with the CookieCsrfTokenRepository double-submit cookie so Angular can send the X-XSRF header, use @PostAuthorize expressions to prevent insecure direct object references, switch to a BFF with Spring Cloud Gateway + Spring Authorization Server and token relay to use JWT Resource Server auth, and add Content-Security-Policy / X-Frame-Options headers to block XSS and clickjacking.
AI-written summary · about
chapters (17)
- 0:00Start
- 3:49Add the Spring Security Starter Dependency
- 5:31Security Configuration
- 8:54Configure the Authentication Entry Point Interface
- 9:59Customize Form Logging
- 10:37User Credentials
- 15:44Cross Site Request Forgery
- 16:49Double Submit Cookie Pattern
- 21:29The Security Context Holder Class
- 22:33Method Injection
- 25:13The Insecure Direct Object Reference
- 34:03Back and Forth Front-End Pattern
- 36:41Bfs Security Configuration
- 38:18Token Relay Filter
- 38:45Pros and Cons
- 46:27Clickjacking
- 48:13Cross-Site Scripting
related talks
01h 27mHands on Spring Security
33mSpring Security Patterns
49m10 Excellent Ways to Secure Your Spring Boot Application
01h 07mGreat single page apps need great backends
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
01h 30mSecuring Microservices with Spring Cloud Security
52mSpring Security for N00bz: A quick introduction for the terminally insecure
51mEverything new in Spring Security 6 baked with a Spring Boot 3 recipe