Summary

In this chapter, we have covered most of the remaining areas in standard Spring Security implementations that deal with authorization. We’ve learned enough to take a thorough pass through the JBCP calendar application and verify that proper authorization checks are in place in all tiers of the application, to ensure that malicious users cannot manipulate or access data to which they do not have access.

We developed two techniques for micro-authorization, namely filtering out in-page content based on authorization or other security criteria using the Thymeleaf Spring Security tag library and Spring MVC controller data binding. We also explored several methods of securing business functions and data in the business tier of our application and supporting a rich, declarative security model that was tightly integrated with the code. We also learned how to secure our Spring MVC controllers and the differences between interface and class proxy objects.

At this point,...