Spring Security

https://docs.spring.io/spring-security/reference/7.0/
Admin
Spring Security is a framework that provides authentication, authorization, and protection against...
Tokens:3,223,496
Snippets:42,948
Trust Score:10
Update:20 hours ago
Show doc for...
Tokens:
Raw
### start()

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/kerberos/test/MiniKdc.html

Starts the MiniKdc.

```APIDOC
## start()

### Description
Starts the MiniKdc. After this method returns, the KDC is ready to accept requests.

### Method
void

### Throws
- **Exception** - if the MiniKdc could not be started.
```

--------------------------------

### start()

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/kerberos/test/MiniKdc.html

Starts the MiniKdc.

```APIDOC
## [METHOD] start()

### Description
Starts the MiniKdc.

### Method
Instance Method

```

--------------------------------

### setup()

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.AuthorizePayloadsSpec.html

Returns an Access object to set up an authorization rule for the setup payload exchange.

```APIDOC
## setup()

### Description
Returns an Access object to set up an authorization rule for the setup payload exchange.

### Method
setup

### Signature
public RSocketSecurity.AuthorizePayloadsSpec.Access setup()

### Returns
- **RSocketSecurity.AuthorizePayloadsSpec.Access** - the Access to set up the authorization rule.

```

--------------------------------

### setup()

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/rsocket/util/matcher/PayloadExchangeMatchers.html

Creates a PayloadExchangeMatcher that matches the RSocket setup exchange.

```APIDOC
## setup()

### Description
Creates a PayloadExchangeMatcher that matches the RSocket setup exchange.

### Method
static

### Signature
public static PayloadExchangeMatcher setup()

### Returns
- **PayloadExchangeMatcher** - A matcher for the setup exchange.
```

--------------------------------

### start()

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/ldap/server/UnboundIdContainer.html

Starts the embedded LDAP server.

```APIDOC
## start()

### Description
Starts the embedded LDAP server.

### Method
`public void start()`
```

--------------------------------

### Example with MD5 and salt

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/crypto/password/MessageDigestPasswordEncoder.html

Example using MD5, password 'password', and salt 'thisissalt', producing '{thisissalt}2a4e7104c2780098f50ed5a84bb2323d'.

```text
 String s = salt == null ? "" : "{" + salt + "}";
 s + md5(password + s)
 "{thisissalt}" + md5(password + "{thisissalt}")
 "{thisissalt}2a4e7104c2780098f50ed5a84bb2323d"
 
```

--------------------------------

### start() - UnboundIdContainer

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Starts the UnboundIdContainer.

```APIDOC
## start() - UnboundIdContainer

### Description
Starts the UnboundIdContainer.

### Method
Method in class `org.springframework.security.ldap.server.UnboundIdContainer`.
```

--------------------------------

### headers configuration example

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/config/web/server/ServerHttpSecurity.html

Configures HTTP response headers. The example customizes frame options to SAMEORIGIN and disables cache control.

```java
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http
        // ...
        .headers((headers) ->
            headers
                // customize frame options to be same origin
                .frameOptions((frameOptions) ->
                    frameOptions
                        .mode(XFrameOptionsServerHttpHeadersWriter.Mode.SAMEORIGIN)
                 )
                // disable cache control
                .cache((cache) ->
                    cache
                        .disable()
                )
        );
    return http.build();
}
```

--------------------------------

### InMemoryUserDetailsManager Java Configuration

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/authentication/passwords/in-memory.html

Defines a UserDetailsService bean with two users (user and admin) using pre-encoded bcrypt passwords. The passwords are stored in a secure format but the example is not ideal for a getting started experience.

```java
@Bean
public UserDetailsService users() {
	UserDetails user = User.builder()
		.username("user")
		.password("{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
		.roles("USER")
		.build();
	UserDetails admin = User.builder()
		.username("admin")
		.password("{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
		.roles("USER", "ADMIN")
		.build();
	return new InMemoryUserDetailsManager(user, admin);
}
```

```xml
<user-service>
	<user name="user"
		password="{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW"
		authorities="ROLE_USER" />
	<user name="admin"
		password="{bcrypt}$2a$10$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW"
		authorities="ROLE_USER,ROLE_ADMIN" />
</user-service>
```

```kotlin
@Bean
fun users(): UserDetailsService {
    val user = User.builder()
        .username("user")
        .password("{bcrypt}$2a$10\$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
        .roles("USER")
        .build()
    val admin = User.builder()
        .username("admin")
        .password("{bcrypt}$2a$10\$GRLdNijSQMUvl/au9ofL.eDwmoohzzS7.rmNSJZ.0FxO/BTk76klW")
        .roles("USER", "ADMIN")
        .build()
    return InMemoryUserDetailsManager(user, admin)
}
```

--------------------------------

### setupModule(SetupContext context)

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/jackson/CoreJacksonModule.html

Sets up the module by registering mixins and other configurations.

```APIDOC
## setupModule(SetupContext context)

### Description
Called by Jackson to set up the module. This method registers the mixins for core security classes and performs other module setup.

### Method
setupModule

### Signature
`public void setupModule(tools.jackson.databind.JacksonModule.SetupContext context)`

### Parameters
- **context** (SetupContext) - Required - The setup context provided by Jackson.

### Returns
void

### Example
```java
module.setupModule(context);
```
```

--------------------------------

### Advanced RSocketSecurity configuration with route-based authorization

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/config/annotation/rsocket/RSocketSecurity.html

Shows a more advanced RSocket security configuration that requires the SETUP role for the setup frame, the ADMIN role for routes starting with 'admin.', and authentication for any other request.

```java
@Configuration
@EnableRSocketSecurity
public class SecurityConfig {
    @Bean
    PayloadSocketAcceptorInterceptor rsocketInterceptor(RSocketSecurity rsocket) {
        rsocket
            .authorizePayload((authorize) ->
                authorize
                    // must have ROLE_SETUP to make connection
                    .setup().hasRole("SETUP")
                     // must have ROLE_ADMIN for routes starting with "admin."
                    .route("admin.*").hasRole("ADMIN")
                    // any other request must be authenticated for
                    .anyRequest().authenticated()
            );
        return rsocket.build();
    }
}
```

--------------------------------

### Allow Only GET and POST Methods (Java, XML, Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/exploits/firewall.html

Restricts allowed HTTP methods to GET and POST by configuring a StrictHttpFirewall bean. The default allowed methods are DELETE, GET, HEAD, OPTIONS, PATCH, POST, and PUT. This example shows Java, XML, and Kotlin configurations.

```java
@Bean
public StrictHttpFirewall httpFirewall() {
    StrictHttpFirewall firewall = new StrictHttpFirewall();
    firewall.setAllowedHttpMethods(Arrays.asList("GET", "POST"));
    return firewall;
}
```

```xml
<b:bean id="httpFirewall"
      class="org.springframework.security.web.firewall.StrictHttpFirewall"
      p:allowedHttpMethods="GET,POST"/>

<http-firewall ref="httpFirewall"/>
```

```kotlin
@Bean
fun httpFirewall(): StrictHttpFirewall {
    val firewall = StrictHttpFirewall()
    firewall.setAllowedHttpMethods(listOf("GET", "POST"))
    return firewall
}
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - WebServerJacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebServerJacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `WebServerJacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### Async request example (Java and Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/integrations/servlet-api.html

Example showing a thread started from an async servlet request. This thread is not known to Spring Security, so the SecurityContext is not propagated, which can cause loss of logged-in user when the response is committed.

```java
httpServletRequest.startAsync();
new Thread("AsyncThread") {
	@Override
	public void run() {
		try {
			// Do work
			TimeUnit.SECONDS.sleep(1);

			// Write to and commit the httpServletResponse
			httpServletResponse.getOutputStream().flush();
		} catch (Exception ex) {
			ex.printStackTrace();
		}
	}
}.start();
```

```kotlin
httpServletRequest.startAsync()
object : Thread("AsyncThread") {
    override fun run() {
        try {
            // Do work
            TimeUnit.SECONDS.sleep(1)

            // Write to and commit the httpServletResponse
            httpServletResponse.outputStream.flush()
        } catch (ex: java.lang.Exception) {
            ex.printStackTrace()
        }
    }
}.start()
```

--------------------------------

### Kotlin: Use httpBasic RequestPostProcessor

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/test/mockmvc/http-basic.html

Kotlin equivalent of the Java example, using the httpBasic RequestPostProcessor in a MockMvc GET request.

```kotlin
mvc.get("/") {
    with(httpBasic("user","password"))
}
```

--------------------------------

### setupModule(Module.SetupContext) - WebServerJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebServerJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `WebServerJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### InMemoryUserDetailsManager with User.withDefaultPasswordEncoder

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/authentication/passwords/in-memory.html

Uses User.withDefaultPasswordEncoder to encode passwords before storing in memory. This is only for getting started and not for production, as it does not protect against decompiling the source code.

```java
@Bean
public UserDetailsService users() {
	// The builder will ensure the passwords are encoded before saving in memory
	UserBuilder users = User.withDefaultPasswordEncoder();
	UserDetails user = users
		.username("user")
		.password("password")
		.roles("USER")
		.build();
	UserDetails admin = users
		.username("admin")
		.password("password")
		.roles("USER", "ADMIN")
		.build();
	return new InMemoryUserDetailsManager(user, admin);
}
```

```kotlin
@Bean
fun users(): UserDetailsService {
    // The builder will ensure the passwords are encoded before saving in memory
    val users = User.withDefaultPasswordEncoder()
    val user = users
        .username("user")
        .password("password")
        .roles("USER")
        .build()
    val admin = users
        .username("admin")
        .password("password")
        .roles("USER", "ADMIN")
        .build()
    return InMemoryUserDetailsManager(user, admin)
}
```

--------------------------------

### withDefaultPasswordEncoder()

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/core/userdetails/User.html

Static factory method that creates a UserBuilder with a default password encoder. Deprecated: not considered safe for production, but acceptable for demos and getting started.

```APIDOC
## withDefaultPasswordEncoder()

### Description
Static factory method that creates a UserBuilder with a default password encoder. Deprecated: not considered safe for production, but acceptable for demos and getting started.

### Method
`public static User.UserBuilder withDefaultPasswordEncoder()`

### Returns
- **User.UserBuilder** - A builder with a default password encoder.
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - WebJacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebJacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `WebJacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### setupModule(Module.SetupContext) - CoreJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the CoreJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `CoreJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### ignoringRequestMatchers with String patterns

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.html

Configures CSRF to ignore requests that start with '/sockjs/'. This is in addition to the default ignored methods (GET, HEAD, TRACE, OPTIONS).

```java
http
    .csrf((csrf) -> csrf
        .ignoringRequestMatchers("/sockjs/**"))
    ...

```

--------------------------------

### withDefaultPasswordEncoder

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/core/userdetails/User.html

Creates a user and automatically encodes the provided password using PasswordEncoderFactories.createDelegatingPasswordEncoder(). This method is deprecated and considered unsafe for production, but is acceptable for demos and getting started.

```APIDOC
## withDefaultPasswordEncoder

### Description
Creates a user and automatically encodes the provided password using PasswordEncoderFactories.createDelegatingPasswordEncoder(). This method is deprecated and considered unsafe for production, but is acceptable for demos and getting started.

### Method
@Deprecated public static User.UserBuilder withDefaultPasswordEncoder()

### Returns
- **User.UserBuilder** - the UserBuilder

### Example
```
UserDetails user = User.withDefaultPasswordEncoder()
    .username("user")
    .password("password")
    .roles("USER")
    .build();
// outputs {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
System.out.println(user.getPassword());
```
```

--------------------------------

### Configure test class with @ExtendWith and @ContextConfiguration (Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/test/method.html

Kotlin version of the test setup. Use @ExtendWith(SpringExtension::class) and @ContextConfiguration. The class is empty in this example.

```kotlin
@ExtendWith(SpringExtension::class) (1)
@ContextConfiguration (2)
class WithMockUserTests {
}
```

--------------------------------

### setupModule(Module.SetupContext context)

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/web/server/jackson2/WebServerJackson2Module.html

Sets up the module by registering the DefaultCsrfServerTokenMixin and enabling default typing if needed. This method is deprecated for removal in a future version.

```APIDOC
## setupModule(Module.SetupContext context)

### Description
Sets up the module by registering the DefaultCsrfServerTokenMixin and enabling default typing if not already enabled. This method is called by Jackson during module registration.

### Method Signature
`public void setupModule(com.fasterxml.jackson.databind.Module.SetupContext context)`

### Parameters
- **context** (Module.SetupContext) - Required - The setup context provided by Jackson.

### Overrides
`setupModule` in class `com.fasterxml.jackson.databind.module.SimpleModule`

### Deprecation
Deprecated, for removal: This API element is subject to removal in a future version. As of 7.0 in favor of `WebServerJacksonModule` based on Jackson 3.
```

--------------------------------

### Send username/password in RSocket request metadata (Java)

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/integrations/rsocket.html

Sends a UsernamePasswordMetadata credential in the metadata of a specific request route. Uses the same authenticationMimeType and credentials as the setup example.

```java
Mono<RSocketRequester> requester;
UsernamePasswordMetadata credentials = new UsernamePasswordMetadata("user", "password");

public Mono<AirportLocation> findRadar(String code) {
	return this.requester.flatMap(req ->
		req.route("find.radar.{code}", code)
			.metadata(credentials, authenticationMimeType)
			.retrieveMono(AirportLocation.class)
	);
}
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - CoreJacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the CoreJacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `CoreJacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### setupModule(Module.SetupContext context)

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/jackson2/CoreJackson2Module.html

Method to set up the module with the given SetupContext. Deprecated for removal.

```APIDOC
## setupModule(com.fasterxml.jackson.databind.Module.SetupContext context)

### Description
Called by the Jackson ObjectMapper to set up the module. This method registers the mixins and enables default typing as needed.

### Method
setupModule

### Parameters
- **context** (com.fasterxml.jackson.databind.Module.SetupContext) - Required - The setup context provided by the ObjectMapper.

### Overrides
Overrides setupModule in class com.fasterxml.jackson.databind.module.SimpleModule.

### Deprecation
Deprecated for removal as of 7.0 in favor of CoreJacksonModule based on Jackson 3.
```

--------------------------------

### Password storage format example

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/crypto/password/DelegatingPasswordEncoder.html

Shows the general format for a password: {id}encodedPassword. The id must be at the beginning, start with '{' and end with '}'. If the id cannot be found, it will be null.

```text
 {id}encodedPassword
```

--------------------------------

### main(String[] args)

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/kerberos/test/MiniKdc.html

Command-line entry point for running MiniKdc as a standalone KDC.

```APIDOC
## [STATIC METHOD] main(String[] args)

### Description
Command-line entry point for running MiniKdc as a standalone KDC.

### Method
Static Method

### Parameters
- **args** (String[]) - Required - Command-line arguments.

```

--------------------------------

### Add Spring Boot OAuth2 Resource Server starter with Maven

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/oauth2/index.html

Adds the spring-boot-starter-oauth2-resource-server dependency to a Maven pom.xml. Required to get started with OAuth2 Resource Server.

```maven
<dependency>
	<groupId>org.springframework.boot</groupId>
	<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
```

--------------------------------

### Add Spring Boot OAuth2 Resource Server starter with Gradle

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/oauth2/index.html

Adds the spring-boot-starter-oauth2-resource-server dependency to a Gradle build. Required to get started with OAuth2 Resource Server.

```gradle
implementation 'org.springframework.boot:spring-boot-starter-oauth2-resource-server'
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - Saml2JacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the Saml2JacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `Saml2JacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### setupModule(Module.SetupContext) - WebJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `WebJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### getAllowFromValue(HttpServletRequest request)

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/web/header/writers/frameoptions/AllowFromStrategy.html

Gets the value for ALLOW-FROM excluding the ALLOW-FROM prefix. For example, the result might be 'https://example.com/'. Returns null if no header should be added for this request.

```APIDOC
## getAllowFromValue(HttpServletRequest request)

### Description
Gets the value for ALLOW-FROM excluding the ALLOW-FROM. For example, the result might be "https://example.com/". Returns null if no header should be added for this request.

### Method
String getAllowFromValue(jakarta.servlet.http.HttpServletRequest request)

### Parameters
- **request** (HttpServletRequest) - Required - The HttpServletRequest

### Returns
- **String** - The value for ALLOW-FROM or null if no header should be added for this request.

### Deprecation
Deprecated. ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
```

--------------------------------

### AsyncContext.start(Runnable) in Java

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/integrations/servlet-api.html

Propagates the current SecurityContext to the new thread when starting an async task. The example outputs the current user's Authentication and completes the async response.

```java
final AsyncContext async = httpServletRequest.startAsync();
async.start(new Runnable() {
	public void run() {
		Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
		try {
			final HttpServletResponse asyncResponse = (HttpServletResponse) async.getResponse();
			asyncResponse.setStatus(HttpServletResponse.SC_OK);
			asyncResponse.getWriter().write(String.valueOf(authentication));
			async.complete();
		} catch(Exception ex) {
			throw new RuntimeException(ex);
		}
	}
});
```

--------------------------------

### setupModule(Module.SetupContext) - Saml2Jackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the Saml2Jackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `Saml2Jackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### Send username/password in RSocket request metadata (Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/integrations/rsocket.html

Kotlin version of sending a UsernamePasswordMetadata credential in the metadata of a specific request route. Uses the same authenticationMimeType and credentials as the setup example.

```kotlin
import org.springframework.messaging.rsocket.retrieveMono

// ...

var requester: Mono<RSocketRequester>? = null
var credentials = UsernamePasswordMetadata("user", "password")

open fun findRadar(code: String): Mono<AirportLocation> {
    return requester!!.flatMap { req ->
        req.route("find.radar.{code}", code)
            .metadata(credentials, authenticationMimeType)
            .retrieveMono<AirportLocation>()
    }
}
```

--------------------------------

### setup() - AuthorizePayloadsSpec

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the RSocket Security AuthorizePayloadsSpec.

```APIDOC
## setup()

### Description
Sets up the `RSocketSecurity.AuthorizePayloadsSpec`.

### Method
setup

```

--------------------------------

### Using WebClient to Call Downstream Service (Java)

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/oauth2/resource-server/bearer-tokens.html

Example of using the configured WebClient to make a GET request to a downstream service. The bearer token is automatically added to the Authorization header.

```java
this.rest.get()
        .uri("https://other-service.example.com/endpoint")
        .retrieve()
        .bodyToMono(String.class)
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - WebServletJacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebServletJacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `WebServletJacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### startMiniKdc() - KerberosSecurityTestcase

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Starts the MiniKdc.

```APIDOC
## startMiniKdc() - KerberosSecurityTestcase

### Description
Starts the MiniKdc.

### Method
Method in class `org.springframework.security.kerberos.test.KerberosSecurityTestcase`.
```

--------------------------------

### Configure securityMatcher and requestMatchers with path patterns (Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/authorization/authorize-http-requests.html

Kotlin equivalent of the Java example. Configures HttpSecurity to apply only to URLs starting with /api/, with role-based access for /api/user/** and /api/admin/**, and authentication for any other request.

```kotlin
@Configuration
@EnableWebSecurity
open class SecurityConfig {

    @Bean
    open fun web(http: HttpSecurity): SecurityFilterChain {
        http {
            securityMatcher("/api/**")                                           (1)
            authorizeHttpRequests {
                authorize("/api/user/**", hasRole("USER"))                       (2)
                authorize("/api/admin/**", hasRole("ADMIN"))                     (3)
                authorize(anyRequest, authenticated)                             (4)
            }
        }
        return http.build()
    }

}
```

--------------------------------

### XML Configuration with {noop} Password Prefix

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/authentication/passwords/in-memory.html

XML configuration for in-memory users using the {noop} prefix to indicate no password encoding. This is for demos or getting started only, as there is no simple way to use User.withDefaultPasswordEncoder with XML.

```xml
<user-service>
	<user name="user"
		password="{noop}password"
		authorities="ROLE_USER" />
	<user name="admin"
		password="{noop}password"
		authorities="ROLE_USER,ROLE_ADMIN" />
</user-service>
```

--------------------------------

### setupModule(Module.SetupContext) - CasJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the CasJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `CasJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### Register OAuth2TokenGenerator Bean

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/oauth2/authorization-server/core-model-components.html

Shows how to define an OAuth2TokenGenerator bean that combines a JwtGenerator, OAuth2AccessTokenGenerator, and OAuth2RefreshTokenGenerator. The JwtEncoder must be provided; the example uses a placeholder. This setup supports both self-contained and opaque access tokens.

```java
@Bean
public OAuth2TokenGenerator<?> tokenGenerator() {
	JwtEncoder jwtEncoder = ...
	JwtGenerator jwtGenerator = new JwtGenerator(jwtEncoder);
	OAuth2AccessTokenGenerator accessTokenGenerator = new OAuth2AccessTokenGenerator();
	OAuth2RefreshTokenGenerator refreshTokenGenerator = new OAuth2RefreshTokenGenerator();
	return new DelegatingOAuth2TokenGenerator(
			jwtGenerator, accessTokenGenerator, refreshTokenGenerator);
}
```

--------------------------------

### Get user details with HttpServletRequest.getUserPrincipal()

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/integrations/servlet-api.html

Retrieves the Authentication object from the request and casts the principal to a custom UserDetails implementation to access additional user information. This example assumes a custom UserDetails called MyCustomUserDetails is integrated.

```java
Authentication auth = httpServletRequest.getUserPrincipal();
// assume integrated custom UserDetails called MyCustomUserDetails
// by default, typically instance of UserDetails
MyCustomUserDetails userDetails = (MyCustomUserDetails) auth.getPrincipal();
String firstName = userDetails.getFirstName();
String lastName = userDetails.getLastName();
```

```kotlin
val auth: Authentication = httpServletRequest.getUserPrincipal()
// assume integrated custom UserDetails called MyCustomUserDetails
// by default, typically instance of UserDetails
val userDetails: MyCustomUserDetails = auth.principal as MyCustomUserDetails
val firstName: String = userDetails.firstName
val lastName: String = userDetails.lastName
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - CasJacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the CasJacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `CasJacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### Inject and use ReactiveClientRegistrationRepository in a controller (Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/oauth2/client/core.html

Kotlin example showing a controller that autowires ReactiveClientRegistrationRepository and calls findByRegistrationId("okta") in a GET mapping. The repository is auto-configured by Spring Boot and available for dependency injection.

```kotlin
@Controller
class OAuth2ClientController {

    @Autowired
    private lateinit var clientRegistrationRepository: ReactiveClientRegistrationRepository

    @GetMapping("/")
    fun index(): Mono<String> {
        return this.clientRegistrationRepository.findByRegistrationId("okta")
            ...
            .thenReturn("index")
    }
}
```

--------------------------------

### fromOidcConfiguration example

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/oauth2/client/registration/ClientRegistrations.html

Shows how to build a ClientRegistration from a Map representation of an OpenID Provider Configuration Response. Useful when the configuration is not at a well-known location or when custom issuer validation is needed. The example fetches the configuration via a REST exchange and then builds the registration.

```java
RequestEntity<Void> request = RequestEntity.get(metadataEndpoint).build();
ParameterizedTypeReference<Map<String, Object>> typeReference = new ParameterizedTypeReference<>() {};
Map<String, Object> configuration = rest.exchange(request, typeReference).getBody();
// Validate configuration.get("issuer") as per in the OIDC specification
ClientRegistration registration = ClientRegistrations.fromOidcConfiguration(configuration)
    .clientId("client-id")
    .clientSecret("client-secret")
    .build();
```

--------------------------------

### Inject and use ReactiveClientRegistrationRepository in a controller (Java)

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/oauth2/client/core.html

Java example showing a controller that autowires ReactiveClientRegistrationRepository and calls findByRegistrationId("okta") in a GET mapping. The repository is auto-configured by Spring Boot and available for dependency injection.

```java
@Controller
public class OAuth2ClientController {

	@Autowired
	private ReactiveClientRegistrationRepository clientRegistrationRepository;

	@GetMapping("/")
	public Mono<String> index() {
		return this.clientRegistrationRepository.findByRegistrationId("okta")
				...
				.thenReturn("index");
	}
}
```

--------------------------------

### EnableWebSecurity Configuration Example

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/config/annotation/web/configuration/EnableWebSecurity.html

Shows a typical @Configuration class annotated with @EnableWebSecurity. It defines a WebSecurityCustomizer to ignore URLs starting with /resources/, a SecurityFilterChain that permits /public/** and requires the USER role for any other request, and an InMemoryUserDetailsManager with user and admin accounts.

```java
@Configuration
@EnableWebSecurity
public class MyWebSecurityConfiguration {

        @Bean
        public WebSecurityCustomizer webSecurityCustomizer() {
                return (web) -> web.ignoring()
                // Spring Security should completely ignore URLs starting with /resources/
                                .requestMatchers("/resources/**");
        }

        @Bean
        public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
                http.authorizeHttpRequests((authorize) -> authorize
                        .requestMatchers("/public/**").permitAll()
                        .anyRequest().hasRole("USER"))
                                // Possibly more configuration ...
                                .formLogin() // enable form based log in
                                // set permitAll for all URLs associated with Form Login
                                .permitAll();
                return http.build();
        }

        @Bean
        public UserDetailsService userDetailsService() {
                UserDetails user = User.withDefaultPasswordEncoder()
                        .username("user")
                        .password("password")
                        .roles("USER")
                        .build();
                UserDetails admin = User.withDefaultPasswordEncoder()
                        .username("admin")
                        .password("password")
                        .roles("ADMIN", "USER")
                        .build();
                return new InMemoryUserDetailsManager(user, admin);
        }

        // Possibly more bean methods ...
}
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - WebauthnJacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebauthnJacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `WebauthnJacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### DelegatingFilterProxy doFilter Pseudo Code (Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/architecture.html

Kotlin pseudo code for DelegatingFilterProxy's doFilter method. It lazily gets the Filter bean from the ApplicationContext and delegates the work to it. This allows delaying the lookup of Filter bean instances until after the container starts.

```kotlin
fun doFilter(request: ServletRequest, response: ServletResponse, chain: FilterChain) {
	val delegate: Filter = getFilterBean(someBeanName) (1)
	delegate.doFilter(request, response) (2)
}
```

--------------------------------

### setupModule(Module.SetupContext) - WebServletJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebServletJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `WebServletJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### DelegatingFilterProxy doFilter Pseudo Code (Java)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/architecture.html

Java pseudo code for DelegatingFilterProxy's doFilter method. It lazily gets the Filter bean from the ApplicationContext and delegates the work to it. This allows delaying the lookup of Filter bean instances until after the container starts.

```java
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) {
	Filter delegate = getFilterBean(someBeanName); (1)
	delegate.doFilter(request, response); (2)
}
```

--------------------------------

### setupModule(Module.SetupContext) - WebauthnJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the WebauthnJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `WebauthnJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### setupModule(Module.SetupContext) - OAuth2AuthorizationServerJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the OAuth2AuthorizationServerJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `OAuth2AuthorizationServerJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### Trace Output for Spring Security Observations

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/integrations/observability.html

Example trace output (indentation added for clarity) showing START and STOP events for observations named 'http.server.requests', 'spring.security.http.chains', 'spring.security.authentications', and 'spring.security.authorizations'. Includes lowCardinalityKeyValues such as chain.position, chain.size, filter.section, authentication.method, and object.type.

```bash
START - name='http.server.requests', contextualName='null', error='null', lowCardinalityKeyValues=[], highCardinalityKeyValues=[], map=[class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@687e16d1', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=0.001779024, duration(nanos)=1779024.0, startTimeNanos=91695917264958}']
	START - name='spring.security.http.chains', contextualName='spring.security.http.chains.before', error='null', lowCardinalityKeyValues=[chain.position='0', chain.size='17', filter.section='before'], highCardinalityKeyValues=[request.line='GET /'], map=[class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@79f554a5', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=7.42147E-4, duration(nanos)=742147.0, startTimeNanos=91695947182029}']
	... skipped for brevity ...
	STOP - name='spring.security.http.chains', contextualName='spring.security.http.chains.before', error='null', lowCardinalityKeyValues=[chain.position='0', chain.size='17', filter.section='before'], highCardinalityKeyValues=[request.line='GET /'], map=[class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@79f554a5', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=0.014771848, duration(nanos)=1.4771848E7, startTimeNanos=91695947182029}']
		START - name='spring.security.authentications', contextualName='null', error='null', lowCardinalityKeyValues=[authentication.failure.type='Optional', authentication.method='ProviderManager', authentication.request.type='UsernamePasswordAuthenticationToken'], highCardinalityKeyValues=[], map=[class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@4d4b2b56', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=7.09759E-4, duration(nanos)=709759.0, startTimeNanos=91696094477504}']
		... skipped for brevity ...
		STOP - name='spring.security.authentications', contextualName='null', error='null', lowCardinalityKeyValues=[authentication.failure.type='Optional', authentication.method='ProviderManager', authentication.request.type='UsernamePasswordAuthenticationToken', authentication.result.type='UsernamePasswordAuthenticationToken'], highCardinalityKeyValues=[], map=[class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@4d4b2b56', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=0.895141386, duration(nanos)=8.95141386E8, startTimeNanos=91696094477504}']
		START - name='spring.security.authorizations', contextualName='null', error='null', lowCardinalityKeyValues=[object.type='Servlet3SecurityContextHolderAwareRequestWrapper'], highCardinalityKeyValues=[], map=[class io.micrometer.core.instrument.Timer$Sample='io.micrometer.core.instrument.Timer$Sample@6d834cc7', class io.micrometer.core.instrument.LongTaskTimer$Sample='SampleImpl{duration(seconds)=3.0965E-4, duration(nanos)=309650.0, startTimeNanos=91697034893983}']
```

--------------------------------

### Configure Logout to Accept Any HTTP Method (Kotlin)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/exploits/csrf.html

Kotlin equivalent of configuring logout to accept any HTTP method using PathPatternRequestMatcher for '/logout'. This is generally not recommended because it allows logout via GET, which can be forged. The example uses Kotlin configuration with @EnableWebSecurity.

```kotlin
import org.springframework.security.config.annotation.web.invoke

@Configuration
@EnableWebSecurity
class SecurityConfig {

    @Bean
    open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
        http {
            // ...
            logout {
                logoutRequestMatcher = PathPatternRequestMatcher.withDefaults().matcher("/logout")
            }
        }
        return http.build()
    }
}
```

--------------------------------

### setupModule(JacksonModule.SetupContext) - OAuth2AuthorizationServerJacksonModule

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the OAuth2AuthorizationServerJacksonModule.

```APIDOC
## setupModule(JacksonModule.SetupContext)

### Description
Sets up the `OAuth2AuthorizationServerJacksonModule`.

### Method
setupModule

### Parameters
- **JacksonModule.SetupContext** - Required - The setup context.

```

--------------------------------

### X509Configurer.init(H http)

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/config/annotation/web/configurers/X509Configurer.html

Initializes the SecurityBuilder.

```APIDOC
## X509Configurer.init(H http)

### Description
Initializes the `SecurityBuilder`.

### Method
`init`

### Parameters
- `http` (H) - Required - The `SecurityBuilder` to initialize.

### Returns
`void`
```

--------------------------------

### Kotlin RSocket Authorization DSL Configuration

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/integrations/rsocket.html

Configures RSocket authorization rules in Kotlin. Rules are evaluated in order; the first match is invoked. The example sets up rules for setup, specific routes, custom matchers, custom access, any request, and any exchange.

```kotlin
rsocket
    .authorizePayload { authz ->
        authz
            .setup().hasRole("SETUP") (1)
            .route("fetch.profile.me").authenticated() (2)
            .matcher { payloadExchange -> isMatch(payloadExchange) } (3)
            .hasRole("CUSTOM")
            .route("fetch.profile.{username}") (4)
            .access { authentication, context -> checkFriends(authentication, context) }
            .anyRequest().authenticated() (5)
            .anyExchange().permitAll()
    } (6)
```

--------------------------------

### Java RSocket Authorization DSL Configuration

Source: https://docs.spring.io/spring-security/reference/7.0/reactive/integrations/rsocket.html

Configures RSocket authorization rules in Java. Rules are evaluated in order; the first match is invoked. The example sets up rules for setup, specific routes, custom matchers, custom access, any request, and any exchange.

```java
rsocket
	.authorizePayload(authz ->
		authz
			.setup().hasRole("SETUP") (1)
			.route("fetch.profile.me").authenticated() (2)
			.matcher((payloadExchange) -> payloadExchange(payloadExchange)) (3)
				.hasRole("CUSTOM")
			.route("fetch.profile.{username}") (4)
				.access((authentication, context) -> checkFriends(authentication, context))
			.anyRequest().authenticated() (5)
			.anyExchange().permitAll() (6)
	);
```

--------------------------------

### setupModule(Module.SetupContext) - OAuth2ClientJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the OAuth2ClientJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `OAuth2ClientJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### Construct JwtIssuerAuthenticationManagerResolver with a Map of Trusted Issuers

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/oauth2/server/resource/authentication/JwtIssuerAuthenticationManagerResolver.html

This example shows how to create a JwtIssuerAuthenticationManagerResolver using a Map where keys are known issuers and values are corresponding AuthenticationManager instances. The map's get method is passed as the AuthenticationManagerResolver, and the keys serve as the allowed issuers.

```java
Map<String, AuthenticationManager> authenticationManagers = new HashMap<>();
authenticationManagers.put("https://issuerOne.example.org", managerOne);
authenticationManagers.put("https://issuerTwo.example.org", managerTwo);
JwtIssuerAuthenticationManagerResolver resolver = new JwtIssuerAuthenticationManagerResolver(authenticationManagers::get);
```

--------------------------------

### setupModule(JacksonModule.SetupContext context)

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/cas/jackson/CasJacksonModule.html

Sets up the module with the given context. This method is called by Jackson to register mixins and enable default typing.

```APIDOC
## setupModule(JacksonModule.SetupContext context)

### Description
Sets up the module with the given context. This method is called by Jackson to register mixins and enable default typing.

### Method
Instance Method

### Signature
`public void setupModule(tools.jackson.databind.JacksonModule.SetupContext context)`

### Parameters
- **context** (JacksonModule.SetupContext) - Required - The setup context provided by Jackson.

### Overrides
- `setupModule` in class `tools.jackson.databind.module.SimpleModule`

### Notes
- Registers the mixins for CAS classes.
- Enables default typing if not already enabled.

```

--------------------------------

### Create User with Default Password Encoder

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/org/springframework/security/core/userdetails/User.html

Creates a UserDetails with a username, password, and roles, automatically encoding the password using PasswordEncoderFactories.createDelegatingPasswordEncoder(). The output shows the encoded password in {bcrypt} format. This method is deprecated and unsafe for production; it is intended for demos and getting started.

```java
UserDetails user = User.withDefaultPasswordEncoder()
    .username("user")
    .password("password")
    .roles("USER")
    .build();
// outputs {bcrypt}$2a$10$dXJ3SW6G7P50lGmMkkmwe.20cQQubK3.HZWzG3YB1tlRy.fqvM/BG
System.out.println(user.getPassword());
```

--------------------------------

### Run the Security Server Windows Auth Sample

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/authentication/kerberos/samples.html

Command to run the sample server JAR. On Linux, you may need to provide a custom Kerberos configuration using -Djava.security.krb5.conf or a GlobalSunJaasKerberosConfig bean.

```text
$ java -jar sec-server-win-auth-7.0.7.jar
```

--------------------------------

### setupModule(Module.SetupContext) - LdapJackson2Module

Source: https://docs.spring.io/spring-security/reference/7.0/api/java/index-all.html

Sets up the LdapJackson2Module (deprecated).

```APIDOC
## setupModule(Module.SetupContext)

### Description
Sets up the `LdapJackson2Module` (deprecated).

### Method
setupModule

### Parameters
- **Module.SetupContext** - Required - The setup context.

```

--------------------------------

### Configure Logout to Accept Any HTTP Method (Java)

Source: https://docs.spring.io/spring-security/reference/7.0/servlet/exploits/csrf.html

Configures Spring Security's logout to accept any HTTP method by setting a PathPatternRequestMatcher for '/logout'. This is generally not recommended because it allows logout via GET, which can be forged. The example uses Java configuration with @EnableWebSecurity.

```java
@Configuration
@EnableWebSecurity
public class SecurityConfig {

	@Bean
	public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
		http
			// ...
			.logout((logout) -> logout
				.logoutRequestMatcher(PathPatternRequestMatcher.withDefaults().matcher("/logout"))
			);
		return http.build();
	}
}
```
Tokens:
Raw