Видео

You're welcome

tesekkurler mustafa, yorumun beni mutlu etti

Unfortunately, I couldn't prioritise youtube. Something I need to work on to get back. <3

Glad it helped! Yes, I should release a new video with upgrade. Meanwhile you can read this blog. backendstory.com/spring-security-how-to-replace-websecurityconfigureradapter/

Glad it helped! Yes, I should release a new video with upgrade. Meanwhile you can read this blog. backendstory.com/spring-security-how-to-replace-websecurityconfigureradapter/

@@BackendStory Thanks again 🙏🙏

if you don't set it, then the request will not be authenticated. So, the request can't access the endpoint. You can check the following blog to understand why. backendstory.com/spring-security-authorization-mechanism/

@@BackendStory Thank you for the article. Would like to further understand: In scenario 3, since now the customJWTTokenFilter is invoked before UsernamePasswordAuthenticationFilter, will the UsernamePasswordAuthenticationFilter still get invoked and fully run through the filter logic if the request is authenticated in JWTTokenFilter and setContext()? Will the result be different if we did not setContext()?

​@@grayyeung757 Sorry for the late response. UsernamePasswordAuthenticationFilter will not be invoked if the request is authenticated. The reason for that is UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter. If you check AbstractAuthenticationProcessingFilter, you will see that doFilter() method checks if the given request is already authenticated or not. I know this sounds a bit complicated, but things get easier once you debug these flows by putting breakpoints in Spring Security classes. So, I would suggest to debug these classes to check if the behaviour is expected.

@@BackendStory Thank you so much for the guide.

At 44:40, I first validate JWT token, so we know that username and password is already checked before. This is because, user gets JWT token after username and password verification. At 44:40, we validate JWT token. Once it is validated, we do not need to provide password. Short answer: Provide password for login attempt. AuthenticationManager will need it to verify user authentication. You don't need to provide for authorization if you are validating JWT token already.

Hey Dino, sorry for late response. That's exactly how I used same code over different codebases before. You can have a common library that handles authentication and authorization, so just import it as a dependency. So, it is a good approach. :)

I'm little confused about UsernamePasswordAuthenticationToken . why sometimes we use this token with 2 parameters and 3 . What are the differences?. And last question: when we set authentication to contextholder is UsernamePassword filter going to check for authorization again or bypass.

Glad to hear you liked it!

Hi! I will try to answer your questions paragraph by paragraph. I recorded this video for educational purpose, so I wouldn't rely on the code samples I shared in the video directly since your requirements might be different. What I tried to explain is how things work under the hood. That was the goal. :) Framework is changing during time as you say and WebSecurityConfigurerAdapter is the latest change. I wrote a blog about how to replace WebSecurityConfigurerAdapter. I believe you will find it useful as well. backendstory.com/spring-security-how-to-replace-websecurityconfigureradapter/ Regarding encryption, yes you need to use it. I use BCryptPasswordEncoder in the video and can suggest it. It is safe for rainbow attacks by adding random salt into generated hash. If you don't know what is hashing and salt, this video is great summary. ruclips.net/video/--tnZMuoK3E/видео.html&ab_channel=Seytonic You can use custom UserDetailsService most of the cases, yes. However, I need to understand your business needs first before giving clear advice. If you want 1-1 meeting, please send me an email regarding this thread. So, we can schedule a meeting. ugurcanlacin@gmail.com

That's a great suggestion! I am adding it to my todo list.

@@BackendStory and i also wonder what does the below code mean , is it mean let spring security remember this user is already authenticated to avoid authenticated again when the request comes again ? ``` UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(username, null, new ArrayList<>()); authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); SecurityContextHolder.getContext().setAuthentication(authToken); ```

@@user-yw8np2ph3w No, it is only one time thing for this scenario, because we use stateless session management. The code piece that you quoted authenticate the incoming request only in request's thread, so request can hit the controller class. When controller class finishes its job like calling underlying service or util classes, request ends with returning a response. Once response is sent, SecurityContext is wiped out from thread. For every request, create a completely new and empty SecurityContext, hence with no stored authentication etc. This response might also be helpful. stackoverflow.com/a/67681782

@@BackendStory 牛逼！！👍👍👍

Glad you liked the video Rakib! I am creating content for both blog and youtube. However, youtube takes more energy to finalize a video unfortunately. But I hear you and will work on it for the next video as soon as possible. Thanks for the feedback! You can have a look at the blog meanwhile: backendstory.com/

This comment made my day. Thanks for your kind words. :)

this comment made my day. thank you for your kind words!

I agree. This is the best course I found so far that explains Spring Security so well. Many thanks to Ugurcan.

He is simply a genius of it. I am just keeping it as my best tutorial. However, it looks so simple because we have watched several of security videos also, so we acknowledge the effort of those we had watched in the past. So sweet explanation. God bless you.

Happy to hear that you liked it! :)

@@BackendStory Can you just come up with OAuth2 Authentication along with JWT token format where all the roles are defined clearly in the MySql db

@@rathinmaheswaran Yes, it is in my todo list actually. I will do it.

Yes, you are right. However, I do not think I will record another 70 minutes video just for couple of deprecated classes. :( If you would choose one scenario here, which one would be your interest with up to date Spring Security version? :)

@@BackendStory You know the current trend is authenticating and authorizing with JWT, and if I was you I would just do a simple example with an admin / user log-in authentications with roles, also I have to disagree with the concept that it was just a few deprecated classes as that the classes don't actually matter more than it is about how to build and configure security and little things like using the Lambda DSL to name a few .. but you are right not worth making a 2 hours long video for it because your amazing slides explaining what goes under the hood with spring boot does not need to get repeated, you can have a straight coding example and refer people to this video as a foundation. I hope I did thank you in my previews reply because I see your explaining professional and straight to the point. but thanks again and consider me as a subscriber.

@@BackendStory and please don't do what everyone else is doing with in-memory authentication spring-jpa couldn't be any easier.

​@@maxjustmax521 Thanks a lot for spending time for the comments. These are gold to me. I added into my todo list following video prep => create video for proper JWT authentication/authorization coding with jpa and up to date Spring Security.

Hi Max, I updated the code with component based configuration by removing deprecated WebSecurityConfigurerAdapter. You can have a look at it if you still need it. For your information :) backendstory.com/spring-security-how-to-replace-websecurityconfigureradapter/

Great to hear that this helped you!

Glad it was helpful!

thank you for your contribution!

It depends on your design. But here it does not work like that. I trigger authentication manager in my login endpoint. Then, authentication manager triggers authentication provider and so on. My custom filter checks if there is JWT token provided in incoming request. If so, I create an authentication object and give it to SecurityContext. I wrote an article that explains why we give this authentication object to SecurityContext. backendstory.com/spring-security-authorization-mechanism/

@@BackendStory Thank you sir

Glad you liked it!