Security for Microservices with Spring and OAuth2
summary
Quick, concrete rundown: sets up a Spring Boot REST app protected with HTTP Basic that works from curl, shows Tomcat SSL with x509 client certificates for machine auth, wires spring session to Redis so multiple instances share session tokens, and boots an OAuth2 authorization server plus resource server where a curl password grant returns an access token (opaque or JWT) that the resource accepts. Also covers client credentials for machine-to-machine calls and tradeoffs (token audience, scope, who issued it); most demos run locally, one network GitHub demo fails.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:04Securing microservices
- 2:26Security requirements
- 8:05Basic authentication
- 18:00Network security
- 20:41Certificate-based security
- 30:38Custom tokens and sessions
- 47:02OAuth2 implementation
- 1:02:05Token store and resources
- 1:06:55OAuth2 clients and flows
- 1:15:02Advanced security scenarios
- 1:27:38Conclusion and Q&A
related talks
56mSecured REST Microservices with Spring Cloud
51mSecuring applications with OAuth2 and OpenID Connect using SpringSecurit
46mImplementing Microservices Security Patterns & Protocols with Spring Security
01h 30mSecuring Microservices with Spring Cloud Security
01h 26mSecuring Rest-ful Web Services with OAuth2
50mArchitectural Patterns for Spring Security You Wish Your Tech Lead Knew
51mEnterprise Security with Spring Authorization Server 1.0
01h 02mGetting Started with Spring Authorization Server