MODULE 8 - Spring Security

Welcome to Module 8! 🔐

Your application works perfectly... but anyone can access it! How do you protect your endpoints? How do you authenticate your users? How do you manage roles and permissions?

Spring Security is THE solution to secure your Spring Boot applications. This module teaches you how to protect your application like a pro.

🎓 Learning Objectives

By the end of this module, you will be able to:

✅ Understand the architecture of Spring Security
✅ Configure form and HTTP Basic authentication
✅ Implement JWT authentication (stateless)
✅ Integrate OAuth2 for social login (Google, GitHub)
✅ Manage roles and permissions
✅ Protect against CSRF, XSS, and other attacks

📚 Prerequisites

Before starting this module, you should have:

✅ Completed Modules 1 to 7
✅ Mastered REST architecture
✅ Understood basic database concepts
✅ Be comfortable with Spring annotations

If these prerequisites are not met, go back to the previous modules!

🗺️ Module Plan

Theoretical Part (5 chapters)

Chapter 1: Introduction to Spring Security

Duration: 45 minutes

Content:

Why secure an application?
Spring Security architecture
Security filters (Filter Chain)
Authentication vs Authorization
SecurityContext and Principal

Why important? Understand the foundations before configuring

Chapter 2: Basic Authentication

Duration: 1 hour

Content:

Modern security configuration (Spring Security 6+)
HTTP Basic and Form Login
UserDetailsService
PasswordEncoder (BCrypt)
Customizing login/logout pages

Why important? The basis of all authentication

Chapter 3: JWT (JSON Web Tokens)

Duration: 1h15

Content:

What is JWT? Why use it?
Structure of a token (Header, Payload, Signature)
Token generation and validation
Refresh Tokens
Integration with Spring Security

Why important? Standard for modern REST APIs

Duration: 1 hour

Content:

OAuth2 concepts (Authorization Code Flow)
Client vs Resource Server
Login with Google, GitHub, Facebook
Spring Security OAuth2 Client configuration
Customizing the flow

Why important? Modern UX, fewer passwords to manage

Chapter 5: Advanced Security

Duration: 45 minutes

Content:

CSRF protection
CORS configuration
Method-level Security (@PreAuthorize, @Secured)
Roles vs Permissions (RBAC)
Security headers

Why important? Defense in depth

Practical Part (4 Labs)

Duration: 1h30

Objective: Secure an application with form authentication

You will:

Configure Spring Security
Create a custom login page
Store users in a database
Manage session and logout

Lab 8.2: REST API with JWT

Duration: 2h

Objective: Create a REST API secured by JWT

You will:

Implement login/register endpoints
Generate and validate JWT tokens
Create an authentication filter
Protect endpoints by role

Lab 8.3: Role and Permission Management

Duration: 1h30

Objective: Implement a complete RBAC system

You will:

Create roles (ADMIN, USER, MANAGER)
Define granular permissions
Use @PreAuthorize with expressions
Test access

Duration: 1h30

Objective: Integrate Google OAuth2 login

You will:

Configure a Google Cloud project
Integrate OAuth2 Client
Retrieve user information
Combine with local authentication

📊 Total Duration

Type	Duration
Theory	4h45 (5 chapters)
Practice	6h30 (4 Labs)
Total	11h15 (~3-4 sessions)

🎯 What You Will Understand

Before this Module

// Your API is open to everyone! 😱
@RestController
@RequestMapping("/api/users")
public class UserController {
    
    @GetMapping
    public List<User> getAllUsers() {
        return userService.findAll();  // Anyone can see!
    }
    
    @DeleteMapping("/{id}")
    public void deleteUser(@PathVariable Long id) {
        userService.delete(id);  // Anyone can delete!
    }
}

After this Module

@RestController
@RequestMapping("/api/users")
public class UserController {
    
    @GetMapping
    @PreAuthorize("hasRole('USER')")  // ← Authenticated users
    public List<User> getAllUsers() {
        return userService.findAll();
    }
    
    @DeleteMapping("/{id}")
    @PreAuthorize("hasRole('ADMIN')")  // ← Admins only!
    public void deleteUser(@PathVariable Long id) {
        userService.delete(id);
    }
}

You will know:

✅ Who can access what
✅ How to authenticate users
✅ How to manage JWT tokens
✅ How to integrate OAuth2
✅ How to protect against attacks

🚀 Why This Module Is Essential

1. Security Is Not Optional

Without security:
- Personal data theft 💀
- Unauthorized modification 💀
- Identity theft 💀
- GDPR fines (up to 4% of revenue) 💀

2. Highly Demanded Skill

Java/Spring job offers:
- "Spring Security experience required" ✓
- "Knowledge of JWT/OAuth2" ✓
- "Securing REST APIs" ✓

3. Common Interview Questions

Typical questions:

"Explain the difference between Authentication and Authorization"
"How does JWT work?"
"How do you protect against CSRF attacks?"
"What is OAuth2 Authorization Code Flow?"

🗺️ Training Progression

Module 8 = Make your application production-ready!

📖 How to Approach This Module

Theory BEFORE Practice

Read the 5 theoretical chapters
- Chapter 1: Understand the architecture
- Chapter 2: Basic authentication
- Chapter 3: JWT (most used in API)
- Chapter 4: OAuth2 (social login)
- Chapter 5: Advanced security
Do the Labs in order
- Lab 8.1: Form Login (foundations)
- Lab 8.2: JWT (REST API)
- Lab 8.3: Roles and permissions
- Lab 8.4: OAuth2 Google

Recommended Time

Intensive Option (2 days):

Day 1 Morning: Chapters 1-2 + Lab 8.1
Day 1 Afternoon: Chapter 3 + Lab 8.2
Day 2 Morning: Chapters 4-5 + Lab 8.3
Day 2 Afternoon: Lab 8.4 + Review

Progressive Option (3-4 sessions):

Session 1: Chapters 1-2 + Lab 8.1
Session 2: Chapter 3 + Lab 8.2
Session 3: Chapters 4-5 + Lab 8.3
Session 4: Lab 8.4 + Personal project

✅ Self-Assessment

Before starting, answer:

Do you know what "authentication" means? ☐ Yes ☐ No
Do you know the difference with "authorization"? ☐ Yes ☐ No
Have you ever heard of JWT? ☐ Yes ☐ No
Do you know what OAuth2 is? ☐ Yes ☐ No
Are you familiar with CSRF attacks? ☐ Yes ☐ No

If you answered "No" to any question → This module will teach you everything!

⚠️ Important Warning

caution

Security is a critical field.

NEVER copy security configurations without understanding them
ALWAYS test your configurations
Keep your dependencies up to date (security vulnerabilities)
NEVER store passwords in plain text

🎯 Next Step

Ready to secure your application?

➡️ Start with Chapter 1: Introduction to Spring Security

⬅️ Back to Course Plan

Welcome to Module 8! 🔐​

🎓 Learning Objectives​

📚 Prerequisites​

🗺️ Module Plan​

Theoretical Part (5 chapters)​

Practical Part (4 Labs)​

📊 Total Duration​

🎯 What You Will Understand​

Before this Module​

After this Module​

🚀 Why This Module Is Essential​

1. Security Is Not Optional​

2. Highly Demanded Skill​

3. Common Interview Questions​

🗺️ Training Progression​

📖 How to Approach This Module​

Theory BEFORE Practice​

Recommended Time​

✅ Self-Assessment​

⚠️ Important Warning​

🎯 Next Step​

Welcome to Module 8! 🔐

🎓 Learning Objectives

📚 Prerequisites

🗺️ Module Plan

Theoretical Part (5 chapters)

Practical Part (4 Labs)

📊 Total Duration

🎯 What You Will Understand

Before this Module

After this Module

🚀 Why This Module Is Essential

1. Security Is Not Optional

2. Highly Demanded Skill

3. Common Interview Questions

🗺️ Training Progression

📖 How to Approach This Module

Theory BEFORE Practice

Recommended Time

✅ Self-Assessment

⚠️ Important Warning

🎯 Next Step