Spring Security in Action - Part 1. first step

Chapter 1. security today

Spring Security is open source software released under the Apache 2.0 License. It helps with application-level security development along with the Spring framework and uses Spring methods such as annotation, beans, and SpEL (Spring Expression Language) .

• Apache Shiro
• General Data Protection Regulations (GDRR) When it comes to security, you need to consider the architectural nature of the system, whether it is monolithic or a microservice pattern, which is a system made up of multiple applications. And it is important to set the authentication and authorization sections so that no more permissions than necessary can be granted. In addition, when securing data, it is necessary to consider application information security in various aspects, such as security of data being transmitted and stored, internal memory management, and heap dump usage management.

A good open source web security program to look at here is OWASP (Open Web Application Security Project), which covers the top 10 security vulnerabilities. Details include authentication vulnerabilities, session fixation, XSS, CSRF, injection, confidential data exposure, lack of method access removal, and use of dependencies with known vulnerabilities.

Authentication vulnerability

This refers to vulnerabilities in authentication and authorization (authorization), such as the lack of clear distinction between authentication and session management, and the possibility of stealing tokens required for authentication and authorization. Here, authentication refers to the process of identifying an application user, and authorization refers to the process of verifying that the authenticating caller has the right to use functions and data.

Session fixation

If a user logs in and authenticates using a session ID set by an attacker, the attacker will share the same information as the user through session hijacking because the attacker also has the same session ID. ####XSS Cross-site scripting refers to a method in which an unauthorized user inserts a script into the site being attacked and causes the script to be executed. In the book's case, when other users run the site with XSS using comments, the entered comment script is executed and multiple users send requests related to the script.

CSRF

Cross-site forgery refers to a method in which the URL that operates in a specific application is reused externally, allowing the program to be exploited by easily changing it, such as by changing some parameters of the URL.

GET http://banking.com/transfer.do?acct=John&amount=1000 HTTP/1.1
GET http://banking.com/transfer.do?acct=Mike&amount=5000

injection

There are SQL injections, XPath injections, OS command injections, LDAP injections, etc. Important data must be stored in a vault. A vault is generally a cloud-based database and data storage service that provides the ability to safely store and manage important data. What is LDAP (Lightweight Directory Access Protocol)? LDAP is a protocol that helps users find data about organizations, members, and more. Most search requests are lighter than DAP in terms of communication network bandwidth. In the LDAP server, it is mainly used to centrally manage specific data and store or search it in a tree structure.

Confidential data exposed

Public information should not be logged. For example, when a 500 error occurs, if the error details are exposed to the client, it is dangerous because the application structure and its dependencies can be known.

Chapter 2. hi! spring security

Redefine UserDetailService``` and ```PasswordEncoder``` supported in Spring Security to process authentication logic as shown above. Now, there are many parts of the book that explain the WebSecurityConfigurerAdapter, which is now @Decrypted```, so there are some differences, but it would be better to focus on the part where the big flow of configuring the config for authentication logic remains unchanged.

• An object that implements the ``UserDetailService``` contract, which manages detailed information about the user. We register default credentials in internal memory, so they are automatically created when the Spring context is loaded.
• PasswordEncoder not only encrypts passwords by literally encrypting them, but also provides a match method to check whether the encrypted password matches the existing encoded password.

There are many changes from Spring Security, so I only wrote a few examples of the implementation presented in the book.

Example code 1 as an example of implementation

There are various ways to implement UserDetailService and ````PasswordEncoder, but setting both parts' methods to the same config at once without setting them as @Beanis not recommended because it would result in mixed configuration and no separation of responsibilities. In the code below, encryption is implemented usingNoOpPasswordEncoder, which is @Deprecated, but in reality, it is preferable to write it in a way such as return PasswordEncoderFactories.createDelegatingPasswordEncoder();``` or through the developer's own redefinition.

@Configuration
public class UserManagementConfig {
@Bean
public UserDetailsService userDetailsService() {
var userDetailsService = new InMemoryUserDetailsManager();
var user = User.withUsername("john")
.password("12345")
.authorities("read")
.build();
userDetailsService.createUser(user);
return userDetailsService;
}
@Bean
public PasswordEncoder passwordEncoder() {
return NoOpPasswordEncoder.getInstance();
}
}

Example code 2 as an example of implementation

It constructs UserDetailService and PasswordEncoder and implements AuthenticationProvider, which delegates work to these two components. There are also cases where implementation using AuthenticationManagerBuilder is processed by injecting AuthenticationProvider from config.

@Component
public class CustomAuthenticationProvider implements AuthenticationProvider {
@Override
public Authentication authenticate(Authentication authentication) throws AuthenticationException {
String username = authentication.getName();
String password = String.valueOf(authentication.getCredentials());
if ("john".equals(username) && "12345".equals(password)) {
return new UsernamePasswordAuthenticationToken(username, password, Arrays.asList());
} else {
throw new AuthenticationCredentialsNotFoundException("Error!");
}
}
@Override
public boolean supports(Class<?> authenticationType) {
return UsernamePasswordAuthenticationToken.class.isAssignableFrom(authenticationType);
}
}