<div dir="ltr" style="text-align: justify;">
<p>In this<a href="https://dineshonjava.com/spring-security-take-baby-step-to-secure/"> Spring Security tutorial</a>, we’ll take a look at Spring Security Java Configuration. Spring Security provides authentication and access-control features for the web layer of an application. Spring Security is a very powerful and highly customizable authentication and access-control framework. Spring security provides support for authentication and access control via configuring lot of filters in a order to filter any request before accessing any secured resource.</p>
<p>Here we will describe how to configure Spring Security in the web application by java based configuration instead of <a href="https://dineshonjava.com/spring-security-xml-namespace-configuration-example/">XML namespace configuration</a>. Spring Security provides support for Java Based Configuration from Spring Security 3.2. Java developers can easily configure Spring Security in the web application by Java based without the use of any XML.</p>
<div class="separator" style="clear: both; text-align: center;"><a href="https://certification-questions.com/buy-mock-exams.html?affiliateCode=4f5a35d8-0022-4c9c-b8d3-265ed0b825a2&;utm_source=Dineshh&;utm_medium=affiliate&;utm_campaign=affiliate" target="_blank" rel="noopener"><img src="https://i1.wp.com/dineshonjava.com/wp-content/uploads/2013/03/spring-certification-dumps.png" border="0" /></a></div>
<p>Spring Security&#8217;s web infrastructure is nothing but it is collection of standard servlet filters. There is no web components exists into Spring Security infrastructure as like Spring MVC, Struts etc. Spring Security only provides filter to the requests, doesn&#8217;t matter whether requests are coming from any browser, device, AJAX, REST etc.</p>
<div style="background-color: #f2f9fc; border: 1px solid #c9e6f2; border-radius: 3px; padding: 16px; line-height: 1.45;">
<p><span style="color: red; font-size: x-large; text-align: center;"><b>Popular Tutorials</b></span></p>
<ul style="text-align: left;">
<li><b><a href="https://dineshonjava.com/spring-tutorial/"><em><strong>Spring Tutorial</strong> </em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-web-mvc-framework-chapter-38/"><strong><em>Spring MVC Web Tutorial </em></strong></a></b></li>
<li><b><a href="https://dineshonjava.com/introduction-to-spring-boot-a-spring-boot-complete-guide/"><strong>Spring Boot Tutorial</strong> </a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-take-baby-step-to-secure/"><em>Spring Security Tutorial</em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-aop-tutorial-with-example-aspect-advice-pointcut-joinpoint/"><em>Spring AOP Tutorial</em></a></b></li>
<li><b><a href="https://dineshonjava.com/using-spring-jdbc-framework-chapter-32/"><em>Spring JDBC Tutorial</em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-hateoas-hypermedia-driven-restful-web-service/"><em><strong>Spring HATEOAS </strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/microservices-with-spring-boot/"><em><strong>Microservices with Spring Boot</strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/jax-rs-web-service-tutorial/"><strong><em>REST Webservice</em> </strong></a></b></li>
<li><b><a href="https://dineshonjava.com/core-java-baby-step-to-be-best-java-ian/"><em><strong>Core Java </strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/hibernate-3-on-baby-steps/"><em><strong>Hibernate Tutorial</strong></em></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-batch-process-with-example/"><strong><em>Spring Batch</em> </strong></a></b></li>
</ul>
</div>
<p>Even Spring Security provide application security but it is not a panacea which will solve all security issues. So we have also take care about the many potential vulnerabilities such as cross-site scripting, request-forgery when application designed. Let&#8217;s see this java based configuration with an example. Before example let recall some spring security terms with meaning.</p>
<h2><b>Spring Security Terms</b></h2>
<ul style="text-align: left;">
<li><b style="font-size: x-large;">Principal</b>– User, device or system that performs an action</li>
<li><b style="font-size: x-large;">Authentication</b>– Establishing that a principal’s credentials are valid</li>
<li><b style="font-size: x-large;">Authorization</b>– Deciding if a principal is allowed to perform an action</li>
<li><b style="font-size: x-large;">Secured item</b>– Resource that is being secured</li>
</ul>
<h2><b>Spring Security Flow in the Application</b></h2>
<p>Let&#8217;s take a look into flow of Spring Security in the Application with example. In this article we just setup Spring Security into a simple web application. After setup Spring Security will work as below picture.</p>
<div class="separator" style="clear: both; text-align: center;"><img title="Spring Security Java Based Configuration" src="https://dineshonjava.com/wp-content/uploads/2017/02/Spring-Security-Big-Picture.jpg" width="640" height="294" border="0" /></div>
<p>According to the above picture one thread want to access one secured resource at web but security applied by the spring security interceptors so thread should be authenticated and also it have proper access-control to access this secured resource. That means Spring Security provides two main mechanisms one is Authentication and another is Authorization. Authentication provided by AuthenticationManager and access decision taken by AccessDecisionManager in the Spring Security. Irrespective of the authentication mechanism, Spring Security provides a deep set of authorization capabilities. There are three main areas of interest: authorizing web requests, authorizing whether methods can be invoked and authorizing access to individual domain object instances.</p>
<h2><b>1. Setup Spring Security to Web Application</b><br />
<b style="font-size: x-large;"></b></h2>
<h3><b style="font-size: x-large;">1.1 Setup of Spring Security Filter (</b><b>DelegatingFilterProxy</b><b style="font-size: x-large;">)</b></h3>
<p>As I told you already that Spring Security provides lot of filters in the infrastructure. When using servlet filters, you obviously need to declare them in your web.xml, or they will be ignored by the servlet container. These filter classes are also Spring beans in Spring Security so we can define these filter beans in the application context and thus we can take advantage of Spring’s rich dependency-injection facilities and lifecycle interfaces.</p>
<p><i><b>But question is that how to apply these spring security filters to intercepting the requests if you configure these filters in your application context file instead of web.xml?</b></i> Don&#8217;t worry Spring Security also provides solution for this problem. It provides you a special DelegatingFilterProxy filter. Spring’s DelegatingFilterProxy provides the link between web.xml and the application context. So each filter in Spring Security has own corresponding delegating filter to provide the link between web.xml and the application context. DelegatingFilterProxy delegates the Filter &#8216;s methods through to a bean which is obtained from the Spring application context.</p>
<pre class="highlight"><;filter>; 
<;filter-name>;myFilter<;/filter-name>; 
<;filter-class>;org.springframework.web.filter.DelegatingFilterProxy<;/filter-class>; 
<;/filter>; 
 
<;filter-mapping>; 
<;filter-name>;myFilter<;/filter-name>; 
<;url-pattern>;/*<;/url-pattern>; 
<;/filter-mapping>; 
</pre>
<p><b>DelegatingFilterProxy </b>delegates the filter&#8217;s methods to a bean in the application context only when the bean must implement javax.servlet.Filter and it must have the same name as that in the filter-name element.</p>
<h3><b>1.2 Setup Order of Spring Security Filters Chain </b><b style="font-size: x-large;">(</b><b>FilterChainProxy</b><b style="font-size: x-large;">)</b></h3>
<p>As we know Spring Security has lot of filters to be configured in a specific order in the web.xml by using corresponding delegating filter. But it would be cumbersome task to maintain web.xml in case of robust application, have a lot of filters. Spring Security provides us a <b>FilterChainProxy </b>bean to maintain the order filters as below.</p>
<pre class="highlight"><;bean id="filterChainProxy" class="org.springframework.security.web.FilterChainProxy">; 
<;constructor-arg>; 
 <;list>; 
 <;sec:filter-chain pattern="/restful/**" filters=" 
 securityContextPersistenceFilterWithASCFalse, 
 basicAuthenticationFilter, 
 exceptionTranslationFilter, 
 filterSecurityInterceptor" />; 
 <;sec:filter-chain pattern="/**" filters=" 
 securityContextPersistenceFilterWithASCTrue, 
 formLoginFilter, 
 exceptionTranslationFilter, 
 filterSecurityInterceptor" />; 
 <;/list>; 
<;/constructor-arg>; 
<;/bean>; 
</pre>
<p>Now add the delegating filter for <b>FilterChainProxy </b>to <b>web.xml</b> filter name should same as bean name in the application context &#8220;<b>filterChainProxy</b>&#8221; as below:</p>
<pre class="highlight"><;filter>; 
<;filter-name>;filterChainProxy<;/filter-name>; 
<;filter-class>;org.springframework.web.filter.DelegatingFilterProxy<;/filter-class>; 
<;/filter>; 
 
<;filter-mapping>; 
<;filter-name>;filterChainProxy<;/filter-name>; 
<;url-pattern>;/*<;/url-pattern>; 
<;/filter-mapping>; 
</pre>
<p><b>FilterChainProxy </b>add a single entry to <b>web.xml </b>and deal entirely with the application context file for managing our web security beans. It is wired using a DelegatingFilterProxy, just like in the example above, but with the filter-name set to the bean name &#8220;filterChainProxy&#8221;. The filter chain is then declared in the application context with the same bean name.</p>
<div class="separator" style="clear: both; text-align: center;"><img src="https://dineshonjava.com/wp-content/uploads/2017/02/Spring-Security-Filter-Configuration-1.jpg" width="640" height="371" border="0" /></div>
<h2><b>2. Spring Security Java Based Configuration Example</b></h2>
<p>Java configuration creates a Servlet Filter known as the <b>springSecurityFilterChain </b>which is responsible for all the security (protecting the application URLs, validating submitted username and passwords, redirecting to the log in form, etc) within your application. Spring Security provides an abstract class AbstractSecurityWebApplicationInitializer to ensure register the springSecurityFilterChain with the war Filter for every URL in your application. It will be work only on Servlet 3.0+ environment.</p>
<h3><b>2.1 Setup DelegatingFilterProxy and FilterChainProxy </b></h3>
<h3><b>2.1.1 Spring Security Configuration in the Application Context</b></h3>
<pre class="highlight">@Configuration 
@EnableWebSecurity 
public class SecurityConfig extends WebSecurityConfigurerAdapter { 
 @Bean 
 public UserDetailsService userDetailsService() { 
 InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager(); 
 manager.createUser(User.withUsername("user").password("password").roles("USER").build()); 
 return manager; 
 } 
 @Override 
 protected void configure(HttpSecurity http) throws Exception { 
 
 } 
 @Autowired 
 public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
 
 } 
} 
</pre>
<h3><b>2.1.2 AbstractSecurityWebApplicationInitializer without Existing Spring</b></h3>
<p>Suppose if you are using Spring Security in non Spring application then you will need to pass in the SecurityConfig into the superclass to ensure the configuration is picked up.</p>
<pre class="highlight">/** 
 * 
 */ 
package com.doj.app.web; 
 
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer; 
 
/** 
 * @author Dinesh.Rajput 
 * 
 */ 
public class SecurityWebApplicationInitializer extends 
 AbstractSecurityWebApplicationInitializer { 
 public SecurityWebApplicationInitializer() { 
 super(SecurityConfig.class); 
 } 
 
} 
 
</pre>
<p><b>SecurityWebApplicationInitializer </b>class do automatically register the <b>springSecurityFilterChain </b>Filter for every URL in your application and also add a <b><a href="https://dineshonjava.com/difference-between-applicationcontext-webapplicationcontext-in-spring-mvc/">ContextLoaderListener</a> </b>that loads the <b>SecurityConfig </b>class.</p>
<h3><b>2.1.3 AbstractSecurityWebApplicationInitializer with <a href="https://dineshonjava.com/spring-web-mvc-framework-chapter-38/">Spring MVC</a></b></h3>
<p>Suppose if you are using <a href="https://dineshonjava.com/spring-tutorial/">Spring</a> in your application then you can register Spring Security with the existing <a href="https://dineshonjava.com/difference-between-applicationcontext-webapplicationcontext-in-spring-mvc/">ApplicationContext</a>.</p>
<pre class="highlight">/** 
 * 
 */ 
package com.doj.app.web; 
 
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer; 
 
/** 
 * @author Dinesh.Rajput 
 * 
 */ 
public class SecurityWebApplicationInitializer extends 
 AbstractSecurityWebApplicationInitializer { 
 
} 
</pre>
<p>This would simply only register the <b>springSecurityFilterChain </b>Filter for every URL in your application. After that we would ensure that SecurityConfig was loaded in our existing ApplicationInitializer.</p>
<h3><b>2.2 HttpSecurity (authorizeRequests())</b></h3>
<p>Thus far our SecurityConfig file only contains default information about how to authenticate our users. In above our configuration file SecurityConfig extends WebSecurityConfigurerAdapter class for more control over the default configuration. WebSecurityConfigurerAdapter provides a default configuration in the configure(HttpSecurity http) method that is why all users require to be authenticated for accessing any URLs of web application. But we can override this method as below:</p>
<pre class="highlight">//1. Default 
//Default configuration in WebSecurityConfigurerAdapter 
protected void configure(HttpSecurity http) throws Exception { 
 http 
 .authorizeRequests() 
 .anyRequest().authenticated() 
 .and() 
 .formLogin() 
 .and() 
 .httpBasic(); 
} 
</pre>
<p><b>The default configuration above:</b></p>
<ul style="text-align: left;">
<li>Ensures that any request to our application requires the user to be authenticated</li>
<li>Allows users to authenticate with form based login</li>
<li>Allows users to authenticate with HTTP Basic authentication</li>
</ul>
<h2><b>2.3 Custom Login Form Java Configuration</b></h2>
<p>Spring Security generates login form automatically, based on the features that are enabled and using standard values for the URL which processes the submitted login, the default target URL the user will be sent to after logging in and so on.</p>
<pre class="highlight">//2. Custom Login Form 
//Override Default configuration in WebSecurityConfigurerAdapter for custom login form instead auto generated login form by spring security 
//The updated configuration specifies the location of the log in page. 
//We must grant all users (i.e. unauthenticated users) access to our log in page 
protected void configure(HttpSecurity http) throws Exception { 
 http 
 .authorizeRequests() 
 .anyRequest().authenticated() 
 .and() 
 .formLogin() 
 .loginPage("/login") //specifies the location of the log in page 
 .permitAll(); //allows granting access to all users for all URLs 
} 
</pre>
<p>And login file as below <b>login.jsp</b></p>
<pre class="highlight"><;%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>; 
<;c:url value="/login" var="loginUrl"/>; 
<;form action="${loginUrl}" method="post">; 
 <;c:if test="${param.error != null}">; 
 <;p>; 
 Invalid username and password. 
 <;/p>; 
 <;/c:if>; 
 <;c:if test="${param.logout != null}">; 
 <;p>; 
 You have been logged out. 
 <;/p>; 
 <;/c:if>; 
 <;p>; 
 <;label for="username">;Username<;/label>; 
 <;input type="text" id="username" name="username"/>; 
 <;/p>; 
 <;p>; 
 <;label for="password">;Password<;/label>; 
 <;input type="password" id="password" name="password"/>; 
 <;/p>; 
 <;input type="hidden" 
 name="${_csrf.parameterName}" 
 value="${_csrf.token}"/>; 
 <;button type="submit" class="btn">;Log in<;/button>; 
<;/form>; 
</pre>
<h2><b>2.4. Authorize Requests</b></h2>
<ul style="text-align: left;">
<li>Adds specific authorization requirements to URLs</li>
<li>Evaluated in the order listed – first match is used, put specific matches first</li>
</ul>
<p> ;</p>
<pre class="highlight" style="text-align: left;">//3. Customization to authorize request 
//Override Default configuration in WebSecurityConfigurerAdapter for custom login form and authorize requests 
//We specified multiple URL patterns that any user can access like "/resources/", "/scripts/", "/css/" etc. 
http 
.authorizeRequests() 
.antMatchers("/css/**","/images/**","/scripts/**").permitAll() 
.antMatchers("/accounts/edit*").hasRole("ADMIN") 
.antMatchers("/accounts/account*").hasAnyRole("USER",”ADMIN”) 
.anyRequest().authenticated() 
.and() 
.formLogin() 
.loginPage("/login") 
.permitAll(); 
} 
</pre>
<div style="text-align: left;"></div>
<ul>
<li>Any URL that starts with &#8220;/accounts/edit&#8221; will be restricted to users who have the role &#8220;ROLE_ADMIN&#8221;.</li>
<li>Any URL that starts with &#8220;/accounts/account&#8221; requires the user to have both &#8220;ROLE_ADMIN&#8221; and &#8220;ROLE_USER&#8221;.</li>
<li>Any URL that has not already been matched on only requires that the user be authenticated</li>
</ul>
<h2><b>2.5. Handling Logouts</b></h2>
<p>When using the <b>WebSecurityConfigurerAdapter</b>, logout capabilities are automatically applied.<br />
The default is that accessing the URL /logout will log the user out by:</p>
<ul style="text-align: left;">
<li>Invalidating the HTTP Session</li>
<li>Cleaning up any RememberMe authentication that was configured</li>
<li>Clearing the SecurityContextHolder</li>
<li>Redirect to /login?logout</li>
</ul>
<pre class="highlight">protected void configure(HttpSecurity http) throws Exception { 
http 
.authorizeRequests() 
.antMatchers("/aaa*").hasRole("ADMIN") 
.and() // method chaining! 
.formLogin() // setup form-based authentication 
.loginPage("/login.jsp") // URL to use when login is needed 
.permitAll() // any user can access 
.and() // method chaining! 
.logout() // configure logout 
.permitAll(); // any user can access 
} 
</pre>
<h3><b>2.5.1. LogoutHandler</b></h3>
<p>Generally, LogoutHandler implementations indicate classes that are able to participate in logout handling. They are expected to be invoked to perform necessary clean-up.</p>
<h3><b>2.5.2. LogoutSuccessHandler</b></h3>
<p>The LogoutSuccessHandler is called after a successful logout by the LogoutFilter, to handle e.g. redirection or forwarding to the appropriate destination. Note that the interface is almost the same as the LogoutHandler but may raise an exception.</p>
<h2><b>2.6. Configure Authentication</b></h2>
<p>Thus far we have only taken a look at the most basic authentication configuration. Let’s take a look at a few slightly more advanced options for configuring authentication. Spring Security provides various Authentication Provider as below:</p>
<ul style="text-align: left;">
<li>DAO Authentication provider is default
<ul>
<li>Expects a UserDetailsService implementation to provide credentials and authorities
<ul>
<li><b>Built-in:</b> In-memory (properties), JDBC (database), LDAP</li>
<li><b>Custom</b></li>
</ul>
</li>
</ul>
</li>
<li>Or define your own Authentication provider
<ul>
<li>Example: to get pre-authenticated user details when using single sign-on
<ul>
<li>CAS, TAM, SiteMinder</li>
</ul>
</li>
</ul>
</li>
</ul>
<h3><b>2.6.1 Authentication provider: Use a UserDetailsManagerConfigurer</b></h3>
<p>– Three built in options: LDAP, JDBC, in-memory (for quick testing)<br />
– Or use your own UserDetailsService implementation</p>
<p><b>In-Memory Authentication Java Configuration</b></p>
<pre class="highlight">//In memory authentication java configuration 
//Not web-specific 
@Autowired 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
auth 
.inMemoryAuthentication() //Adds a UserDetailsManagerConfigurer 
//login, password and supported role 
.withUser("user").password("password").roles("USER").and() 
.withUser("admin").password("adminpassword").roles("ADMIN").and() 
.withUser("dinesh").password("support").roles("SUPPORT"); 
} 
</pre>
<p><b>JDBC Authentication Java Configuration</b></p>
<pre class="highlight">//JDBC Authentication 
//Provides default queries 
//– SELECT username, password, enabled FROM users WHERE username = ? 
//– SELECT username, authority FROM authorities WHERE username = ? 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
auth.jdbcAuthentication().dataSource(dataSource); 
} 
</pre>
<p>We can customize the default queries by using following methods</p>
<ul style="text-align: left;">
<li>usersByUsernameQuery()</li>
<li>authoritiesByUsernameQuery()</li>
<li>groupAuthoritiesByUsername()</li>
</ul>
<pre class="highlight">//JDBC Authentication 
//Provides default queries 
//– SELECT username, password, enabled FROM users WHERE username = ? 
//– SELECT username, authority FROM authorities WHERE username = ? 
//We can customize the default queries by using following methods 
//usersByUsernameQuery() 
//authoritiesByUsernameQuery() 
//groupAuthoritiesByUsername() 
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { 
auth 
.jdbcAuthentication() 
.usersByUsernameQuery("SELECT username, password, enabled FROM users WHERE username = ?") 
.authoritiesByUsernameQuery("SELECT username, authority FROM authorities WHERE username = ?") 
.dataSource(dataSource); 
} 
</pre>
<h3><b>2.6.2 Password Encoder</b></h3>
<p>You can also customize how passwords are encoded by exposing a PasswordEncoder as a bean. We can encode passwords using a hash – sha, md5, bcrypt etc.</p>
<pre class="highlight">//SHA-256 encoding 
auth.jdbcAuthentication() 
.dataSource(dataSource) 
.passwordEncoder(new StandardPasswordEncoder()); 
</pre>
<h3><b>2.6.3 Use Salting in Password Encoder</b></h3>
<p>Secure passwords using a well-known string known as a &#8216;salt&#8217;, makes brute force attacks harder</p>
<pre class="highlight">//Encoding with salt 
auth.jdbcAuthentication() 
.dataSource(dataSource) 
.passwordEncoder(new StandardPasswordEncoder("sodium-chloride")); 
</pre>
<p><b>Note: <i>Authorization is not affected by changes to Authentication!</i></b></p>
<h3><b>2.7. Configure Multiple HttpSecurity</b></h3>
<p>We can configure multiple HttpSecurity instances. The key is to extend the WebSecurityConfigurationAdapter multiple times.</p>
<h2><b>2.8. Method Security</b></h2>
<p>From Spring version 2.0 Spring Security provides support to adding security to your service layer methods. Spring Security uses AOP for security at the method level.<br />
– annotations based on Spring annotations or JSR-250 annotations<br />
– Java configuration to activate detection of annotations<br />
&#8211; From 3.0 you can also make use of new expression-based annotations.<br />
Typically secure your services<br />
– Do not access repositories directly, bypasses security (and transactions)</p>
<h3><b>2.8.1 EnableGlobalMethodSecurity</b></h3>
<p>We can enable annotation-based security using the @EnableGlobalMethodSecurity annotation on any @Configuration instance.</p>
<h3><b>2.8.2 </b><b>Enable Method Security &#8211; JSR-250</b></h3>
<pre class="highlight">@EnableGlobalMethodSecurity(jsr250Enabled = true) 
public class MethodSecurityConfig { 
// ... 
} 
</pre>
<p> ;</p>
<pre class="highlight">import javax.annotation.security.RolesAllowed; 
 
public class ItemManagerService { 
@RolesAllowed({"ROLE_MEMBER", "ROLE_USER"}) 
public Item findItem(long itemNumber) { 
... 
} 
} 
</pre>
<p><b><i>Note: Only supports role-based security – hence the name</i></b></p>
<h3><b>2.8.3 Enable Spring Security’s @Secured annotation</b></h3>
<pre class="highlight">@EnableGlobalMethodSecurity(securedEnabled = true) 
public class MethodSecurityConfig { 
// ... 
} 
</pre>
<p> ;</p>
<pre class="highlight">import org.springframework.security.annotation.Secured; 
 
public class ItemManagerService { 
@Secured("IS_AUTHENTICATED_FULLY") 
public Item findItem(long itemNumber) { 
... 
} 
} 
</pre>
<p><b>We can also use </b></p>
<ul style="text-align: left;">
<li>@Secured(&#8220;ROLE_MEMBER&#8221;)</li>
<li>@Secured({&#8220;ROLE_MEMBER&#8221;, &#8220;ROLE_USER&#8221;})</li>
</ul>
<p><b><i>Note: Spring 2.0 syntax, so not limited to roles. SpEL not supported.</i></b></p>
<h3><b>2.8.4 Method Security with SpEL</b></h3>
<pre class="highlight">@EnableGlobalMethodSecurity(prePostEnabled = true) 
public class MethodSecurityConfig { 
// ... 
} 
</pre>
<p> ;</p>
<pre class="highlight">public interface ItemManagerService { 
 
@PreAuthorize("isAnonymous()") 
public Item findItem(Long itemNumber); 
 
@PreAuthorize("isAnonymous()") 
public Item[] findItems(); 
 
@PreAuthorize("hasAuthority('ROLE_USER')") 
public Item post(Item item); 
} 
</pre>
<h2><b>Download Java Based Configuration Example</b><br />
<b><br />
</b> <a href="https://github.com/DOJ-SoftwareConsultant/Spring-Security-Java-Config" target="_blank" rel="noopener"><b>Source Code of Example from Git.</b></a></h2>
<div class="separator" style="clear: both; text-align: center;"><img src="https://dineshonjava.com/wp-content/uploads/2017/02/Spring-Security-java-based-cnfiguration-example.jpg" border="0" /></div>
<h2><b>Summary</b></h2>
<ul style="text-align: left;">
<li>Spring Security secure URLs using a chain of Servlet filters and methods on Spring beans using AOP proxies</li>
<li>Out-of-the-box setup usually sufficient – you define:
<ul>
<li>– URL and/or method restrictions</li>
<li>– How to login (typically using an HTML form)</li>
<li>– Supports in-memory, database, LDAP credentials (and more)</li>
<li>– Password encryption using familiar hashing techniques</li>
<li>– Support for security tags in JSP views</li>
</ul>
</li>
</ul>
<p> ;</p>
<div style="background-color: #f2f9fc; border-radius: 3px; border: 1px solid #c9e6f2; line-height: 1.45; padding: 16px;">
<p><span style="color: red; font-size: x-large; text-align: center;"><b>Spring Security Related Posts</b></span></p>
<ul>
<li><b><a href="https://dineshonjava.com/spring-security-interview-questions-and-answers/"><span style="color: red;">Spring Security Interview Questions and Answers</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-java-based-configuration-with-example/"><span style="color: red;">Spring Security Java Based Configuration with Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-xml-namespace-configuration-example/"><span style="color: red;">Spring Security XML Namespace Configuration Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-hello-world-example/"><span style="color: red;">Spring Security XML Based Hello World Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-form-based-login-example/"><span style="color: red;">Spring Security form-based login example </span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-login-form-using/"><span style="color: red;">Spring Security Login Form Based Example Using Database</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-http-basic/"><span style="color: red;">Spring Security Authentication Example Using HTTP Basic </span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-authorized-access/"><span style="color: red;"> Spring Security Authorized Access Control Example </span></a></b></li>
<li><b><a href="https://dineshonjava.com/customize-http-403-access-denied-page/"><span style="color: red;">Spring Security Customized Access Denied Page</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-custom-error-message/"><span style="color: red;">Spring Security Custom Error Message</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-logout-example/"><span style="color: red;"> Spring Security Logout Example</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-fetch-logged-in-username/"><span style="color: red;">Spring Security Fetch Logged in Username</span></a></b></li>
<li><b><a href="https://dineshonjava.com/spring-security-password-hashing/"><span style="color: red;">Spring Security Password Hashing</span></a></b></li>
</ul>
<p> ;</p>
</div>
</div>
<div class="wp-post-navigation"> 
									 <div class="wp-post-navigation-pre"> 
									 <a href="https://dineshonjava.com/spring-security-interview-questions-and-answers/">Previous</a> 
									 </div> 
									 <div class="wp-post-navigation-next"> 
									 <a href="https://dineshonjava.com/spring-security-xml-namespace-configuration-example/">Next</a> 
									 </div> 
									</div>
<script type="text/javascript">
jQuery(document).ready(function($) {
 $.post('https://dineshonjava.com/wp-admin/admin-ajax.php', {action: 'mts_view_count', id: '60'});
});
</script>
Strategy Design Patterns We can easily create a strategy design pattern using lambda. To implement…
Decorator Pattern A decorator pattern allows a user to add new functionality to an existing…
Delegating pattern In software engineering, the delegation pattern is an object-oriented design pattern that allows…
Technology has emerged a lot in the last decade, and now we have artificial intelligence;…
Managing a database is becoming increasingly complex now due to the vast amount of data…
Overview In this article, we will explore Spring Scheduler how we could use it by…