Hands on Spring Security
summary
Adds Spring Security 4.1 to a single‑page Spring Boot app, shows exact config: WebSecurityConfigurerAdapter subclass, spring-boot-starter-security, form login plus HTTP Basic, a /csrf JSON endpoint and a JavaScript interceptor that adds the CSRF header. Demonstrates real attacks using Chrome/IE devtools and a Wi‑Fi Pineapple MITM, image‑polyglot upload leading to content sniffing, and reflected/persistent XSS. Applying headers (X-Frame-Options, X-Content-Type-Options) and Content Security Policy blocks the demonstrated exploits; most fixes work despite some demo glitches.
AI-written summary · about
chapters (11)
- 0:00Introduction to Spring Security
- 1:18Starting the demo
- 13:56Adding CSRF protection
- 21:08Custom login page
- 30:10Cross-site request forgery explained
- 35:25Clickjacking attack demo
- 41:56Man-in-the-middle attacks
- 50:10File upload security risks
- 1:01:44Cross-site scripting vulnerabilities
- 1:17:33Content Security Policy
- 1:26:24Q&A and closing
related talks
51mSecuring SPAs with Spring
33mSpring Security Patterns
40mModern Web Application Defense with OWASP Tools
52mSpring Security for N00bz: A quick introduction for the terminally insecure
57mSpring Security for N00bz: A quick introduction for the terminally insecure
45mSpring Security: The Good Parts
49m10 Excellent Ways to Secure Your Spring Boot Application
54mSpring Security Patterns