0

I need to make simple CRUD application with user registration and authentication using Spring boot, but I have some trouble figuring out how to do this right. I have created user table at RDMS and set up Redis for storing user sessions as explained here.

At Spring boot docs it's said that

If Spring Security is on the classpath then web applications will be secure by default with ‘basic’ authentication on all HTTP endpoints.

But I defined several CrudRepository intefaces and after starting my application I can GET it's data using browser without authentication. I thought that it should work out of the box without additional tuning and therefore checked if Spring Security is on the classpath with gradlew dependencies command and it appears to be there:

console

Also default user password that should be displayed during application start up does not show up. So maybe I am missing something here?

Also I am not sure if that would be the best option for mobile app because it possibly uses short-living tokens. There are several other options, among which using a WebView and cookies (as was recommended by Google long ago), creating a custom authentication entry point, using approach that was used in Angular web app and finally stateless authentication with OAuth 2.0. Directly in opposite to author of Angular web app tutorial who claims

The main point to take on board here is that security is stateful. You can’t have a secure, stateless application.

So how do we need to pass token? How long should it live? Do we need to make additional XSRF token or not? Should we use out of the box solution or implement own one? Can we make it stateless?

Community
  • 1
  • 1
Poliakoff
  • 1,592
  • 1
  • 21
  • 40
  • You miss to mention what version of Spring Boot you're using. SB permits all the methods you refer to above as the security is based in Spring Security. I think your first question (the one referring to the CRUD Repo not being protected) fits here in SO, the rest of what you ask is just a matter of requirements (and too long to be answered here, there are entire books about these topics). How long should the token live? If you use OAuth2 based authorization you'll be able to specify a short-lived and a long-lived token. – Aritz Apr 19 '16 at 06:21
  • Thanks. Spring Boot version is `1.3.3.RELEASE` – Poliakoff Apr 19 '16 at 11:58
  • @XtremeBiker I figured out that it's problem with basic HTTP auth is my own fault: I changed basic configuration and therefore auth wasn't required. I thought that changes will be applied only to session management, not authentication. Thanks. – Poliakoff Apr 19 '16 at 17:18

0 Answers0