1. Introduction FREE CHAPTER

• Introduction
• What Will You Build in Your Spring Security Course?
• Getting the Most Out of Your Course!
• Setting up Your Development Environment

2. Introduction to Spring Security

• Introduction
• Application Security 101
• Introducing Spring Security
• Open Web Application Security Project (OWASP) Common Web Vulnerabilities
• Cross-Site Scripting (XSS)
• Cross-Site Request Forgery (CSRF)

3. HTTP Basic Auth

• Introduction
• Overview of HTTP Basic Authentication
• SFG Brewery Code Review
• Spring Security Default Basic Auth
• Customizing Username and Password
• Testing Spring Security with JUnit 5
• Testing HTTP Basic Auth
• Spring Security Filter Chain

4. Spring Security Java Configuration

• Introduction
• Permit All with URL Pattern Matching
• HTTP Method Matching
• Spring Model-View-Controller (MVC) Path Matchers

5. In-Memory Authentication Provider

• Introduction
• Spring Security Authentication Process
• User Details Service
• In-Memory Authentication Fluent API
• Assignment - Add User

6. Password Security

• Introduction
• Password Encoding
• Message-Digest Algorithm (MD5) Hash and Password Salt
• NoOpPasswordEncoder
• LdapPasswordEncoder
• Secured Hash Algorithm 256 (SHA-256) Password Encoder
• BCryptPasswordEncoder
• Delegating Password Encoder
• Custom Delegating Password Encoder
• Assignment - Add Custom Bcrypt Encoder

7. Custom Authentication Filter

• Introduction
• Custom Authentication Filter Overview
• Delete Beer by the ID MockMvc Test
• Custom Authentication Filter
• Spring Security Configuration
• Debugging Spring Security
• Custom doFilter Method
• Custom Failure Handler

8. Database Authentication

• Introduction
• Database Authentication Overview
• Java Persistence API (JPA) Entities
• Project Lombok Configuration
• Spring Data Java Persistence API (JPA) Repositories
• Assignment - Bootstrap User Data
• Hypersonic 2 (H2) Database Console Access
• User Details Service
• Spring Security Configuration
• 8.10Spring Boot Test Context

9. User Roles

• Introduction
• Authorization in Spring Security
• Configuring User Roles
• Verify Role in Filter - Delete
• Assignment - Limit List Breweries to Customer
• Allow Multiple Roles
• Refactor JUnit 5 Tests
• Assignment - Use Multiple Roles
• Introduction to Method Security
• Security Expression Based Syntax
• Assignment - Use Method Expression

10. User Authorities

• Introduction
• Overview Database Refactoring
• Update Java Persistence API (JPA) Configuration
• Defining Roles for Beer Operations
• Assignment - Define Roles for Customer Operations
• Update Spring Security for RESTful Beer API
• Assignment - Update Remaining Controllers
• Custom Authorization Annotations
• Assignment - Update to Use Custom Auth Annotations

11. Multi-tenancy Security

• Introduction
• Multi-tenancy Overview
• Order Controller Code Review
• Define Roles for Beer Orders
• Update Java Persistence API (JPA) User
• User Customer Java Persistence API (JPA) Mapping
• Refactor Bootstrap Data
• Test-driven development (TDD) - Write Failing Tests
• Custom Authentication Manager
• Secure Read Order
• Using Authentication Principle
• Spring Security with Spring Data Java Persistence API (JPA)

12. Cross-Site Request Forgery (CSRF) Protection with Spring Security

• Enable Cross-Site Request Forgery (CSRF) Protection in Spring Security
• Cross-Site Request Forgery (CSRF) with Spring MockMvc
• Update Customer Forms with Cross-Site Request Forgery (CSRF)
• Assignment - Update Beer Form with Cross-Site Request Forgery (CSRF)

13. Login Form

• Tag Library Overview
• Add Login Form to Index Page
• Add Logout Action
• Update Java Configuration for Login Form
• Login and Logout Messages
• Show Elements by User Permission

14. Remember Me

• Remember Me Overview
• Simple Hash-Based Token Remember Me
• Persistent Token Remember Me

15. User Lockout Using Spring Security Events

• Overview of Spring Security Authentication Events
• Configuration of Spring Security Event Publisher
• Logging Off Authentication Success Events
• Persistence of Authentication Success Events
• Locking User Account After Failed Attempts
• Account Locked Message
• Automatically Unlocking Accounts After a Period of Time

16. Two-factor Authentication (2FA)

• Two-factor Authentication (2FA) Overview
• Google Authenticator with Spring Security
• Configure User Entity for Two-factor Authentication (2FA)
• Configure Two-factor Authentication (2FA) Registration Controller
• Configure Google Secret Persistence
• Generate Quick Response Code (QR Code) for Google Authenticator
• Verify Two-factor Authentication (2FA) Opt-In
• Two-factor Authentication (2FA) Verification UI
• Spring Security Two-factor Authentication (2FA) Filter
• Spring Security Two-factor Authentication (2FA) Failure Handler
• Exclude Static Resources from Filter
• Java Configuration and Two-factor Authentication (2FA) Demo
• Two-factor Authentication (2FA) Retrospective

17. Cross-Origin Resource Sharing (CORS)

• Overview of Cross-Origin Resource Sharing (CORS)
• Disable Spring Security for Testing
• Spring Model-View-Controller (MVC) Cross-Origin Resource Sharing (CORS) Configuration
• Spring Model-View-Controller (MVC) Cross-Origin Resource Sharing (CORS) Annotation Config
• Spring Security Cross-Origin Resource Sharing (CORS) Configuration