Spring Security

https://docs.spring.io/spring-security/reference/6.5
Admin
Spring Security is a powerful and highly customizable framework for securing Spring-based...
Tokens:2,797,061
Snippets:34,159
Trust Score:10
Update:15 hours ago
Show doc for...
Tokens:
Raw
### start()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/ldap/server/UnboundIdContainer.html

Starts the embedded LDAP server.

```APIDOC
## Method: start

### Description
Starts the embedded LDAP server.

### Signature
`public void start()`
```

--------------------------------

### start()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/ldap/server/ApacheDSContainer.html

Starts the container. Deprecated for removal.

```APIDOC
## start()

### Description
Starts the container. Deprecated for removal.

### Method
void

```

--------------------------------

### start() - ApacheDSContainer

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/index-all.html

Method in ApacheDSContainer to start the container.

```APIDOC
## start() - ApacheDSContainer

### Description
Starts the ApacheDS container.

### Method
start

### Signature
start()

### Deprecated
This method is deprecated.
```

--------------------------------

### withDefaults()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/index-all.html

Starts the configuration of SecurityObservationSettings.

```APIDOC
## withDefaults()

### Description
Begin the configuration of a `SecurityObservationSettings`.

### Method
Static method in class `org.springframework.security.config.observation.SecurityObservationSettings`

### Returns
A `SecurityObservationSettings.Builder`.
```

--------------------------------

### start() - UnboundIdContainer

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/index-all.html

Method in UnboundIdContainer to start the container.

```APIDOC
## start() - UnboundIdContainer

### Description
Starts the UnboundId container.

### Method
start

### Signature
start()
```

--------------------------------

### Async request example (Java/Kotlin)

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/integrations/servlet-api.html

Example of an asynchronous request that starts a new thread. The thread is not known to Spring Security, so the SecurityContext is not propagated to it. This can cause loss of the logged-in user when the response is committed.

```java
httpServletRequest.startAsync();
new Thread("AsyncThread") {
	@Override
	public void run() {
		try {
			// Do work
			TimeUnit.SECONDS.sleep(1);

			// Write to and commit the httpServletResponse
			httpServletResponse.getOutputStream().flush();
		} catch (Exception ex) {
			ex.printStackTrace();
		}
	}
}.start();
```

```kotlin
httpServletRequest.startAsync()
object : Thread("AsyncThread") {
    override fun run() {
        try {
            // Do work
            TimeUnit.SECONDS.sleep(1)

            // Write to and commit the httpServletResponse
            httpServletResponse.outputStream.flush()
        } catch (ex: java.lang.Exception) {
            ex.printStackTrace()
        }
    }
}.start()
```

--------------------------------

### withDefaultPasswordEncoder()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/core/userdetails/User.html

Creates a UserBuilder with a default password encoder. Deprecated: not considered safe for production, but acceptable for demos and getting started.

```APIDOC
## Method: static User.UserBuilder withDefaultPasswordEncoder()

### Description
Creates a UserBuilder with a default password encoder.

### Deprecated
Using this method is not considered safe for production, but is acceptable for demos and getting started.

### Returns
- **User.UserBuilder** - A builder for constructing a User.
```

--------------------------------

### Add Spring Boot OAuth2 Resource Server Starter (Maven)

Source: https://docs.spring.io/spring-security/reference/6.5/reactive/oauth2/index.html

Add the spring-boot-starter-oauth2-resource-server dependency to your Maven pom.xml to get started with OAuth2 Resource Server.

```xml
<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
Copied!

```

--------------------------------

### fromOidcConfiguration example

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/oauth2/client/registration/ClientRegistrations.html

Shows how to manually fetch the OpenID Provider Configuration and pass it to fromOidcConfiguration. Useful when the configuration is not at a well-known location or custom issuer validation is needed.

```java
 RequestEntity<Void> request = RequestEntity.get(metadataEndpoint).build();
 ParameterizedTypeReference<Map<String, Object>> typeReference = new ParameterizedTypeReference<>() {};
 Map<String, Object> configuration = rest.exchange(request, typeReference).getBody();
 // Validate configuration.get("issuer") as per in the OIDC specification
 ClientRegistration registration = ClientRegistrations.fromOidcConfiguration(configuration)
     .clientId("client-id")
     .clientSecret("client-secret")
     .build();
 
```

--------------------------------

### Add Spring Boot OAuth2 Resource Server Starter (Gradle)

Source: https://docs.spring.io/spring-security/reference/6.5/reactive/oauth2/index.html

Add the spring-boot-starter-oauth2-resource-server dependency to your Gradle build to get started with OAuth2 Resource Server.

```groovy
implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
Copied!

```

--------------------------------

### commence(HttpServletRequest, HttpServletResponse, AuthenticationException)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/web/authentication/NoOpAuthenticationEntryPoint.html

Commences an authentication scheme. This implementation does nothing, as this entry point is intended to be a no-op.

```APIDOC
## commence(HttpServletRequest, HttpServletResponse, AuthenticationException)

### Description
Commences an authentication scheme. This implementation does nothing, as this entry point is intended to be a no-op.

### Method
`public void commence(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, AuthenticationException authException) throws IOException, jakarta.servlet.ServletException`

### Parameters
- **request** (jakarta.servlet.http.HttpServletRequest) - Required - The request that resulted in an `AuthenticationException`.
- **response** (jakarta.servlet.http.HttpServletResponse) - Required - The response so that the user agent can begin authentication.
- **authException** (AuthenticationException) - Required - The exception that caused the invocation.

### Returns
`void` - This method does not return a value.

### Throws
- **IOException** - If an input or output exception occurs.
- **jakarta.servlet.ServletException** - If a servlet exception occurs.

### Example
```java
public void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException) throws IOException, ServletException {
    // No-op implementation
}
```
```

--------------------------------

### init(H http)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.html

Initializes the security builder with remember me configuration.

```APIDOC
## init(H http)

### Description
Initialize the `SecurityBuilder`.

### Method
Instance Method

### Signature
`public void init(H http)`

### Parameters
- `http` (H) - Required - The `HttpSecurityBuilder` to initialize.

### Returns
void
```

--------------------------------

### InMemoryUserDetailsManager with User.withDefaultPasswordEncoder

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/authentication/passwords/in-memory.html

Use User.withDefaultPasswordEncoder to encode plain-text passwords before storing them in memory. This approach is only for getting started and not for production because decompiling the source code can reveal the passwords.

```java
@Bean
public UserDetailsService users() {
	// The builder will ensure the passwords are encoded before saving in memory
	UserBuilder users = User.withDefaultPasswordEncoder();
	UserDetails user = users
		.username("user")
		.password("password")
		.roles("USER")
		.build();
	UserDetails admin = users
		.username("admin")
		.password("password")
		.roles("USER", "ADMIN")
		.build();
	return new InMemoryUserDetailsManager(user, admin);
}
```

```kotlin
@Bean
fun users(): UserDetailsService {
    // The builder will ensure the passwords are encoded before saving in memory
    val users = User.withDefaultPasswordEncoder()
    val user = users
        .username("user")
        .password("password")
        .roles("USER")
        .build()
    val admin = users
        .username("admin")
        .password("password")
        .roles("USER", "ADMIN")
        .build()
    return InMemoryUserDetailsManager(user, admin)
}
```

--------------------------------

### withDefaultPasswordEncoder()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/core/userdetails/User.html

Creates a user and automatically encodes the provided password using PasswordEncoderFactories.createDelegatingPasswordEncoder(). This method is deprecated and considered unsafe for production, but is acceptable for demos and getting started.

```APIDOC
## withDefaultPasswordEncoder()

### Description
Creates a user and automatically encodes the provided password using `PasswordEncoderFactories.createDelegatingPasswordEncoder()`. This method is deprecated and considered unsafe for production, but is acceptable for demos and getting started.

### Method
`@Deprecated public static User.UserBuilder withDefaultPasswordEncoder()`

### Deprecation
Using this method is not considered safe for production, but is acceptable for demos and getting started. For production purposes, ensure the password is encoded externally.

### Example
```java
UserDetails user = User.withDefaultPasswordEncoder()
    .username("user")
    .password("password")
    .roles("USER")
    .build();
// outputs {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
System.out.println(user.getPassword());
```

### Returns
- The UserBuilder.

```

--------------------------------

### init(H)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/AnonymousConfigurer.html

Initializes the SecurityBuilder.

```APIDOC
## void init(H http)

### Description
Initialize the `SecurityBuilder`.

### Method
Instance method

### Parameters
- `http` (H) - Required - The HttpSecurityBuilder to initialize.

### Returns
void
```

--------------------------------

### init(B)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurer.html

Initializes the SecurityBuilder.

```APIDOC
## init(B http)

### Description
Initialize the `SecurityBuilder`.

### Method
`public void init(B http)`

### Parameters
- `http` (B) - Required - The `SecurityBuilder` to initialize.

### Returns
void
```

--------------------------------

### Observation output for HTTP request

Source: https://docs.spring.io/spring-security/reference/6.5/reactive/integrations/observability.html

Example output from the ObservationTextPublisher showing START and STOP events for http.server.requests, spring.security.http.chains, and spring.security.authentications observations. Indentation was added for clarity in the source.

```text
START - name='http.server.requests', contextualName='null', error='null', lowCardinalityKeyValues=[], highCardinalityKeyValues=[], map=[class io.micrometer.tracing.handler.TracingObservationHandler$TracingContext='io.micrometer.tracing.handler.TracingObservationHandler$TracingContext@5dfdb78', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=0.00191856, duration(nanos)=1918560.0, startTimeNanos=101177265022745}', class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@121549e0']
	START - name='spring.security.http.chains', contextualName='spring.security.http.chains.before', error='null', lowCardinalityKeyValues=[chain.size='14', filter.section='before'], highCardinalityKeyValues=[request.line='/'], map=[class io.micrometer.tracing.handler.TracingObservationHandler$TracingContext='io.micrometer.tracing.handler.TracingObservationHandler$TracingContext@3932a48c', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=4.65777E-4, duration(nanos)=465777.0, startTimeNanos=101177276300777}', class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@562db70f']
	STOP - name='spring.security.http.chains', contextualName='spring.security.http.chains.before', error='null', lowCardinalityKeyValues=[chain.size='14', filter.section='before'], highCardinalityKeyValues=[request.line='/'], map=[class io.micrometer.tracing.handler.TracingObservationHandler$TracingContext='io.micrometer.tracing.handler.TracingObservationHandler$TracingContext@3932a48c', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=0.003733105, duration(nanos)=3733105.0, startTimeNanos=101177276300777}', class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@562db70f']
		START - name='spring.security.authentications', contextualName='null', error='null', lowCardinalityKeyValues=[authentication.failure.type='Optional', authentication.method='UserDetailsRepositoryReactiveAuthenticationManager', authentication.request.type='UsernamePasswordAuthenticationToken'], highCardinalityKeyValues=[], map=[class io.micrometer.tracing.handler.TracingObservationHandler$TracingContext='io.micrometer.tracing.handler.TracingObservationHandler$TracingContext@574ba6cd', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=3.21015E-4, duration(nanos)=321015.0, startTimeNanos=101177336038417}', class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@49202cc7']
```

--------------------------------

### Testing @PostAuthorize with @WithMockUser

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/authorization/method-security.html

Tests for the @PostAuthorize example. The first test verifies that a user with the matching username can read the account, while the second verifies that a different user gets an AccessDeniedException.

```java
@Autowired
BankService bankService;

@WithMockUser(username="owner")
@Test
void readAccountWhenOwnedThenReturns() {
    Account account = this.bankService.readAccount("12345678");
    // ... assertions
}

@WithMockUser(username="wrong")
@Test
void readAccountWhenNotOwnedThenAccessDenied() {
    assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(
        () -> this.bankService.readAccount("12345678"));
}
```

```kotlin
@WithMockUser(username="owner")
@Test
fun readAccountWhenOwnedThenReturns() {
    val account: Account = this.bankService.readAccount("12345678")
    // ... assertions
}

@WithMockUser(username="wrong")
@Test
fun readAccountWhenNotOwnedThenAccessDenied() {
    assertThatExceptionOfType(AccessDeniedException::class.java).isThrownBy {
        this.bankService.readAccount("12345678")
    }
}
```

--------------------------------

### init(H http)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/X509Configurer.html

Initializes the SecurityBuilder.

```APIDOC
## Method: init

### Description
Initializes the `SecurityBuilder`. This method is called by the `SecurityBuilder` during the initialization process.

### Signature
`public void init(H http)`

### Parameters
- **http** (H) - Required - The `SecurityBuilder` to initialize.

### Returns
void
```

--------------------------------

### init(H http)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/JeeConfigurer.html

Populates a PreAuthenticatedAuthenticationProvider into HttpSecurity.authenticationProvider and a Http403ForbiddenEntryPoint into HttpSecurityBuilder.setSharedObject.

```APIDOC
## init(H http)

### Description
Populates a PreAuthenticatedAuthenticationProvider into HttpSecurity.authenticationProvider(org.springframework.security.authentication.AuthenticationProvider) and a Http403ForbiddenEntryPoint into HttpSecurityBuilder.setSharedObject(Class, Object)

### Method
public void init(H http)

### Parameters
- http (H) - Required - the HttpSecurityBuilder to configure.

### Specified By
- init in interface SecurityConfigurer<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

### Overrides
- init in class SecurityConfigurerAdapter<DefaultSecurityFilterChain,H extends HttpSecurityBuilder<H>>

### See Also
- SecurityConfigurerAdapter.init(org.springframework.security.config.annotation.SecurityBuilder)
```

--------------------------------

### getAllowFromValue(jakarta.servlet.http.HttpServletRequest request)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/web/header/writers/frameoptions/AllowFromStrategy.html

Gets the value for ALLOW-FROM excluding the ALLOW-FROM prefix. For example, the result might be "https://example.com/". Returns null if no header should be added for this request.

```APIDOC
## getAllowFromValue(jakarta.servlet.http.HttpServletRequest request)

### Description
Gets the value for ALLOW-FROM excluding the ALLOW-FROM prefix. For example, the result might be "https://example.com/". Returns null if no header should be added for this request.

### Method
String getAllowFromValue(jakarta.servlet.http.HttpServletRequest request)

### Parameters
- **request** (jakarta.servlet.http.HttpServletRequest) - Required - The HttpServletRequest.

### Returns
- **String** - The value for ALLOW-FROM or null if no header should be added for this request.

### Deprecated
Deprecated. ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
```

--------------------------------

### build() - ClientSettings.Builder

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/index-all.html

Builds a new ClientRegistration.ClientSettings.

```APIDOC
## build() - ClientSettings.Builder

### Description
Builds a new `ClientRegistration.ClientSettings`.

### Method
build()

### Class
org.springframework.security.oauth2.client.registration.ClientRegistration.ClientSettings.Builder

### Returns
`ClientRegistration.ClientSettings`
```

--------------------------------

### Ignore CSRF for /sockjs/** patterns

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.html

Configures CSRF protection to ignore requests that start with "/sockjs/". This is in addition to the default ignored methods (GET, HEAD, TRACE, OPTIONS).

```java
 http
     .csrf()
         .ignoringRequestMatchers("/sockjs/**")
         .and()
     ...
 
```

--------------------------------

### init

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurer.html

Initializes the security builder with shared state.

```APIDOC
## init

### Description
Initializes the `SecurityBuilder`. This method is specified by the `SecurityConfigurer` interface. Here only shared state should be created and modified, but not properties on the `SecurityBuilder` used for building the object. Configurers should be applied here.

### Method
`init`

### Signature
`public void init(H http) throws Exception`

### Parameters
- `http` (H) - Required - The `HttpSecurityBuilder` to initialize.

### Returns
- `void` - No return value.

### Specified By
- `init` in interface `SecurityConfigurer<DefaultSecurityFilterChain, H extends HttpSecurityBuilder<H>>`
```

--------------------------------

### InMemoryUserDetailsManager {noop} XML Configuration

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/authentication/passwords/in-memory.html

XML configuration that uses the {noop} password prefix to indicate no encoding should be used. This is only for demos or getting started because there is no simple way to use User.withDefaultPasswordEncoder with XML-based configuration.

```xml
<user-service>
	<user name="user"
		password="{noop}password"
		authorities="ROLE_USER" />
	<user name="admin"
		password="{noop}password"
		authorities="ROLE_USER,ROLE_ADMIN" />
</user-service>
```

--------------------------------

### Inject OAuth2AuthorizedClient with @RegisteredOAuth2AuthorizedClient

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/oauth2/client/annotation/RegisteredOAuth2AuthorizedClient.html

Use this annotation on a controller method parameter to resolve an OAuth2AuthorizedClient for the specified client registration. The example shows a GET endpoint that receives the authorized client for the 'login-client' registration.

```java
@Controller
public class MyController {
    @GetMapping("/authorized-client")
    public String authorizedClient(@RegisteredOAuth2AuthorizedClient("login-client") OAuth2AuthorizedClient authorizedClient) {
        // do something with authorizedClient
    }
}

```

--------------------------------

### ClientRegistration.ClientSettings.Builder

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/oauth2/client/registration/ClientRegistration.ClientSettings.Builder.html

Documentation for the ClientRegistration.ClientSettings.Builder class, including its methods requireProofKey and build.

```APIDOC
## ClientRegistration.ClientSettings.Builder

### Description
Builder for configuring `ClientRegistration.ClientSettings`. Provides methods to set client settings such as requiring proof key for the Authorization Code Grant flow.

### Methods

#### requireProofKey(boolean requireProofKey)

Sets whether the client is required to provide a proof key challenge and verifier when performing the Authorization Code Grant flow.

**Parameters:**
- `requireProofKey` (boolean) - `true` if the client is required to provide a proof key challenge and verifier, `false` otherwise.

**Returns:**
- `ClientRegistration.ClientSettings.Builder` - the builder for further configuration.

#### build()

Builds the `ClientRegistration.ClientSettings` instance.

**Returns:**
- `ClientRegistration.ClientSettings` - the built client settings.
```

--------------------------------

### build()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.BasicAuthenticationSpec.html

Builds the AuthenticationPayloadInterceptor for basic authentication.

```APIDOC
## build()

### Description
Builds the AuthenticationPayloadInterceptor for basic authentication.

### Method
- **build** (protected)

### Returns
- **AuthenticationPayloadInterceptor** - The built interceptor.

```

--------------------------------

### Enable one-time token login with ServerHttpSecurity

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/web/server/ServerHttpSecurity.html

Example configuration for enabling one-time token login in a WebFlux security setup. It defines a SecurityWebFilterChain bean that applies oneTimeTokenLogin with defaults and a custom ServerOneTimeTokenGenerationSuccessHandler bean.

```java
 @Configuration
 @EnableWebFluxSecurity
 public class SecurityConfig {

        @Bean
        public SecurityWebFilterChain securityFilterChain(ServerHttpSecurity http) throws Exception {
                http
                        // ...
                        .oneTimeTokenLogin(Customizer.withDefaults());
                return http.build();
        }

        @Bean
        public ServerOneTimeTokenGenerationSuccessHandler oneTimeTokenGenerationSuccessHandler() {
                return new MyMagicLinkServerOneTimeTokenGenerationSuccessHandler();
        }

 }
 
```

--------------------------------

### doBuild()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.html

Executes the build using the SecurityConfigurer's that have been applied. Invokes beforeInit, SecurityConfigurer.init, beforeConfigure, and performBuild.

```APIDOC
## doBuild()

### Description
Executes the build using the SecurityConfigurer's that have been applied using the following steps: 
- Invokes beforeInit() for any subclass to hook into
- Invokes SecurityConfigurer.init(SecurityBuilder) for any SecurityConfigurer that was applied to this builder.
- Invokes beforeConfigure() for any subclass to hook into
- Invokes performBuild() which actually builds the Object

### Method
protected final O doBuild() throws Exception

### Returns
The object that should be returned by AbstractSecurityBuilder.build().

### Throws
- **Exception** - if an error occurs
```

--------------------------------

### Get user principal and custom UserDetails in Java

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/integrations/servlet-api.html

Use HttpServletRequest.getUserPrincipal() to obtain the Authentication object, then cast the principal to a custom UserDetails implementation to access additional user information. This example assumes a custom UserDetails called MyCustomUserDetails.

```java
Authentication auth = httpServletRequest.getUserPrincipal();
// assume integrated custom UserDetails called MyCustomUserDetails
// by default, typically instance of UserDetails
MyCustomUserDetails userDetails = (MyCustomUserDetails) auth.getPrincipal();
String firstName = userDetails.getFirstName();
String lastName = userDetails.getLastName();
```

--------------------------------

### build()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.SimpleAuthenticationSpec.html

Builds the AuthenticationPayloadInterceptor for simple authentication.

```APIDOC
## build()

### Description
Builds the AuthenticationPayloadInterceptor for simple authentication.

### Method
- **build** (protected)

### Returns
- **AuthenticationPayloadInterceptor** - The built interceptor.

```

--------------------------------

### Create User with withDefaultPasswordEncoder()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/core/userdetails/User.html

Creates a UserDetails with the deprecated withDefaultPasswordEncoder() method, which automatically encodes the password using PasswordEncoderFactories.createDelegatingPasswordEncoder(). This is unsafe for production and intended only for demos and getting started; the plain text password is compiled into the source and remains recoverable in memory.

```java
UserDetails user = User.withDefaultPasswordEncoder()
    .username("user")
    .password("password")
    .roles("USER")
    .build();
// outputs {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
System.out.println(user.getPassword());
```

--------------------------------

### Load multiple RelyingPartyRegistrations from metadata (Java)

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/saml2/login/overview.html

Java example using RelyingPartyRegistrations.collectionFromMetadataLocation to load all asserting parties from an identity provider metadata endpoint. Each registration gets a random registrationId and a static entityId. Note that random registration IDs make SAML endpoints unpredictable.

```Java
Collection<RelyingPartyRegistration> registrations = RelyingPartyRegistrations
        .collectionFromMetadataLocation("https://example.org/saml2/idp/metadata.xml")
        .stream().map((builder) -> builder
            .registrationId(UUID.randomUUID().toString())
            .entityId("https://example.org/saml2/sp")
            .build()
        )
        .collect(Collectors.toList());
```

--------------------------------

### build()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/saml2/provider/service/registration/OpenSamlRelyingPartyRegistration.Builder.html

Builds an OpenSamlRelyingPartyRegistration instance.

```APIDOC
## build()

### Description
Build an `OpenSamlRelyingPartyRegistration`.

### Method
build

### Returns
- an `OpenSamlRelyingPartyRegistration`
```

--------------------------------

### Load multiple RelyingPartyRegistrations from metadata (Kotlin)

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/saml2/login/overview.html

Kotlin example using RelyingPartyRegistrations.collectionFromMetadataLocation to load all asserting parties from an identity provider metadata endpoint. Each registration gets a random registrationId, a static entityId, and a static assertionConsumerServiceLocation. Random registration IDs make SAML endpoints unpredictable.

```Kotlin
var registrations: Collection<RelyingPartyRegistration> = RelyingPartyRegistrations
        .collectionFromMetadataLocation("https://example.org/saml2/idp/metadata.xml")
        .stream().map { builder : RelyingPartyRegistration.Builder -> builder
            .registrationId(UUID.randomUUID().toString())
            .entityId("https://example.org/saml2/sp")
            .assertionConsumerServiceLocation("{baseUrl}/login/saml2/sso")
            .build()
        }
        .collect(Collectors.toList())
```

--------------------------------

### Using anonymous() RequestPostProcessor in MockMvc tests

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/test/web/servlet/request/SecurityMockMvcRequestPostProcessors.html

Shows how to use the anonymous() RequestPostProcessor to override a default user for a specific test. The setup uses MockMvcBuilders.webAppContextSetup with a default request that applies user("user"), and the anonymous() test performs a GET request with the anonymous() post-processor.

```java
public class SecurityTests {
    @Before
    public void setup() {
        mockMvc = MockMvcBuilders
            .webAppContextSetup(context)
            .defaultRequest(get("/").with(user("user")))
            .build();
    }

    @Test
    public void anonymous() {
        mockMvc.perform(get("anonymous").with(anonymous()));
    }
    // ... lots of tests ran with a default user ...
}
```

--------------------------------

### fromOidcIssuerLocation example

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/oauth2/client/registration/ClientRegistrations.html

Creates a ClientRegistration by making an OpenID Provider Configuration Request to the issuer's well-known endpoint. The issuer must be reachable and return a valid configuration response.

```java
 ClientRegistration registration = ClientRegistrations.fromOidcIssuerLocation("https://example.com")
     .clientId("client-id")
     .clientSecret("client-secret")
     .build();
 
```

--------------------------------

### Configure ClientRegistration via ClientRegistrations.fromIssuerLocation (Java)

Source: https://docs.spring.io/spring-security/reference/6.5/reactive/oauth2/client/core.html

Java example showing how to build a ClientRegistration using the OpenID Connect Provider Configuration or Authorization Server Metadata endpoint. The issuer location is provided as a string URL.

```java
ClientRegistration clientRegistration =
	ClientRegistrations.fromIssuerLocation("https://idp.example.com/issuer").build();
```

--------------------------------

### commence(ServerWebExchange, AuthenticationException)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/web/server/authentication/HttpBasicServerAuthenticationEntryPoint.html

Initiates the authentication flow for HTTP Basic authentication. This method is specified by the ServerAuthenticationEntryPoint interface and returns a Mono<Void> indicating when the request for authentication is complete.

```APIDOC
## Method: commence(ServerWebExchange, AuthenticationException)

### Description
Initiates the authentication flow. This method is called when an authentication exception occurs and the server needs to prompt the user for credentials.

### Signature
`public reactor.core.publisher.Mono<Void> commence(org.springframework.web.server.ServerWebExchange exchange, AuthenticationException ex)`

### Parameters
- **exchange** (ServerWebExchange) - Required - The server web exchange.
- **ex** (AuthenticationException) - Required - The authentication exception that triggered the authentication flow.

### Returns
`Mono<Void>` - A Mono that completes when the request for authentication is complete.

### Specified By
`commence` in interface `ServerAuthenticationEntryPoint`
```

--------------------------------

### commence(HttpServletRequest, HttpServletResponse, AuthenticationException)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPoint.html

Performs the redirect (or forward) to the login form URL.

```APIDOC
## Method: commence(HttpServletRequest, HttpServletResponse, AuthenticationException)

### Description
Performs the redirect (or forward) to the login form URL.

### Method Signature
`public void commence(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, AuthenticationException authException) throws IOException, jakarta.servlet.ServletException`

### Parameters
- **request** (HttpServletRequest) - Required - that resulted in an `AuthenticationException`
- **response** (HttpServletResponse) - Required - so that the user agent can begin authentication
- **authException** (AuthenticationException) - Required - that caused the invocation

### Throws
- **IOException**
- **jakarta.servlet.ServletException**

### Specified By
- `commence` in interface `AuthenticationEntryPoint`

```

--------------------------------

### onStartup(ServletContext) - AbstractSecurityWebApplicationInitializer

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/index-all.html

Method in class org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer.

```APIDOC
## onStartup(ServletContext)

### Description
Method in class org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer.

### Method
onStartup

### Signature
`void onStartup(ServletContext servletContext)`

### Parameters
- **servletContext** (ServletContext) - Required - The servlet context.

### Return Type
void
```

--------------------------------

### ClientRegistration.Builder.build()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/oauth2/client/registration/ClientRegistration.Builder.html

Builds a new ClientRegistration.

```APIDOC
## ClientRegistration.Builder.build()

### Description
Builds a new ClientRegistration.

### Method
build

### Signature
public ClientRegistration build()

### Returns
- **ClientRegistration** - The built ClientRegistration.

```

--------------------------------

### Example Authentication Failure Response

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/authentication/passkeys.html

Example authentication failure response.

```http
HTTP/1.1 401 OK
```

--------------------------------

### requireInitialize(Consumer<XMLObjectProviderRegistry>)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/saml2/core/OpenSamlInitializationService.html

Static method that initializes OpenSAML with reasonable defaults and then applies custom configuration to the XMLObjectProviderRegistry using the provided Consumer. It throws an exception if initialization has already occurred.

```APIDOC
## requireInitialize(Consumer<XMLObjectProviderRegistry>)

### Description
Ready OpenSAML for use, configure it with reasonable defaults, and modify the `XMLObjectProviderRegistry` using the provided `Consumer`. Initialization is guaranteed to happen only once per application. This method will throw an exception if initialization already took place earlier in the application.

### Method
`public static void requireInitialize(Consumer<org.opensaml.core.xml.config.XMLObjectProviderRegistry> registryConsumer)`

### Parameters
- `registryConsumer` (Consumer<XMLObjectProviderRegistry>) - Required - the `Consumer` to further configure the `XMLObjectProviderRegistry`

### Throws
- `Saml2Exception` - if initialization already happened previously or if OpenSAML failed to initialize

### Example
```java
static {
    OpenSamlInitializationService.requireInitialize((registry) -> {
        registry.setParserPool(...);
        registry.getBuilderFactory().registerBuilder(...);
    });
}
```
```

--------------------------------

### Custom Security Header Example

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/exploits/headers.html

Example custom security header to be added to the response.

```http
X-Custom-Security-Header: header-value
```

--------------------------------

### setup()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.AuthorizePayloadsSpec.html

Returns an Access object to configure authorization rules for the setup payload exchange.

```APIDOC
## setup()

### Description
Returns an Access object to configure authorization rules for the setup payload exchange.

### Method
setup

### Signature
public RSocketSecurity.AuthorizePayloadsSpec.Access setup()

### Returns
RSocketSecurity.AuthorizePayloadsSpec.Access - the Access to set up the authorization rule.
```

--------------------------------

### Configure ClientRegistration via ClientRegistrations.fromIssuerLocation (Kotlin)

Source: https://docs.spring.io/spring-security/reference/6.5/reactive/oauth2/client/core.html

Kotlin example showing how to build a ClientRegistration using the OpenID Connect Provider Configuration or Authorization Server Metadata endpoint. The issuer location is provided as a string URL.

```kotlin
val clientRegistration = ClientRegistrations.fromIssuerLocation("https://idp.example.com/issuer").build()
```

--------------------------------

### build()

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/web/webauthn/api/PublicKeyCredentialCreationOptions.PublicKeyCredentialCreationOptionsBuilder.html

Builds a new PublicKeyCredentialCreationOptions.

```APIDOC
## build()

### Description
Builds a new `PublicKeyCredentialCreationOptions`.

### Method
build

### Returns
- the new `PublicKeyCredentialCreationOptions`
```

--------------------------------

### Allow Only GET & POST with StrictServerWebExchangeFirewall

Source: https://docs.spring.io/spring-security/reference/6.5/reactive/exploits/firewall.html

Restricts the allowed HTTP methods to GET and POST by configuring a StrictServerWebExchangeFirewall bean. The default allowed methods are DELETE, GET, HEAD, OPTIONS, PATCH, POST, and PUT.

```java
@Bean
public StrictServerWebExchangeFirewall httpFirewall() {
    StrictServerWebExchangeFirewall firewall = new StrictServerWebExchangeFirewall();
    firewall.setAllowedHttpMethods(Arrays.asList("GET", "POST"));
    return firewall;
}
```

```kotlin
@Bean
fun httpFirewall(): StrictServerWebExchangeFirewall {
    val firewall = StrictServerWebExchangeFirewall()
    firewall.setAllowedHttpMethods(listOf("GET", "POST"))
    return firewall
}
```

--------------------------------

### Allow Only GET & POST Methods

Source: https://docs.spring.io/spring-security/reference/6.5/servlet/exploits/firewall.html

Restricts allowed HTTP methods to GET and POST. The default allowed methods are DELETE, GET, HEAD, OPTIONS, PATCH, POST, and PUT. Note that MockHttpServletRequest creates an empty method by default, which is rejected; use new MockHttpServletRequest("GET", "") instead.

```java
@Bean
public StrictHttpFirewall httpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowedHttpMethods(Arrays.asList("GET", "POST"));
    return firewall;
}
```

```xml
<b:bean id="httpFirewall"
      class="org.springframework.security.web.firewall.StrictHttpFirewall"
      p:allowedHttpMethods="GET,POST"/>

<http-firewall ref="httpFirewall"/>
```

```kotlin
@Bean
fun httpFirewall(): StrictHttpFirewall {
    val firewall = StrictHttpFirewall()
    firewall.setAllowedHttpMethods(listOf("GET", "POST"))
    return firewall
}
```

--------------------------------

### init(B http)

Source: https://docs.spring.io/spring-security/reference/6.5/api/java/org/springframework/security/config/annotation/web/configurers/HttpBasicConfigurer.html

Initializes the SecurityBuilder.

```APIDOC
## void init(B http)

### Description
Initialize the `SecurityBuilder`.

### Method
- **Return Type**: `void`

### Parameters
- **http** (`B`) - Required - The `SecurityBuilder` to initialize.
```

--------------------------------

### Content Security Policy Example

Source: https://docs.spring.io/spring-security/reference/6.5/features/exploits/headers.html

Example of a Content-Security-Policy header that restricts script loading to a trusted source.

```http
Content-Security-Policy: script-src https://trustedscripts.example.com
```
Tokens:
Raw