Spring Security Tutorial

Spring Security, is a flexible and powerful authentication and access control framework to secure Spring-based Java web application.

Spring version to use in this tutorials :

1. Spring 3.2.8.RELEASE
2. Spring Security 3.2.3.RELEASE

1. Spring Security Examples

Examples to show you how to secure your web application with Spring Security.

• Spring Security Hello World XML Example
  Spring MVC + Spring Security XML-based project, using the default login form.
• Spring Security Hello World Annotation Example
  Spring MVC + Spring Security annotations-based project, using the default login form.
• Spring Security Custom Login Form XML Example
  Spring MVC + Spring Security XML-based project, custom login form, logout function, CSRF protection and in-memory authentication.
• Spring Security Custom Login Form Annotation Example
  Spring MVC + Spring Security annotations-based project, custom login form, logout function, CSRF protection and in-memory authentication.
• Spring Security Form Login Using Database – XML and Annotation Example
  Database authentication, Spring Security, JSP taglibs, JDBC, customizes 403 access denied page and etc, both in XML and annotations.
• Spring Security : Limit Login Attempts – XML and Annotation Example
  Lock user accounts if a user tried 3 invalid login attempts.
• Spring Security Remember Me Example
  Remember me “Persistent Token Approach” example. Extra : user login from remember me cookie is unable to perform the update operation.
• Spring Security password hashing example
  Password encoder with BCrypt algorithm.
• Spring Security + Hibernate XML Example
  Using Hibernate to load users for database authentication.
• Spring Security + Hibernate Annotation Example
  Using Hibernate to load users for database authentication.

2. FAQs

Some commonly asked questions in Spring Security.

• Customize 403 access denied page
  Like topic, shows you how to customize a 403 access denied page, using the error-page attribute and custom handler.
• Check if user is from remember me cookie
  If authentication == RememberMeAuthenticationToken
• Encoded password does not look like BCrypt
  Length of “password” is not enough to store the bcrypt hashing value.
• How to get current login username in Spring Security
  3 ways to get current login username in Spring Security.
• ClassNotFoundException : org.springframework.security.web.savedrequest.DefaultSavedRequest

Some outdated or obsoleted articles…may update in future.

• Spring Security HTTP basic authentication example
  The browser displays a login dialog for authentication.
• Spring Security access control example
  Example to implement access control or authorization on web application.
• Display custom error message in Spring Security
  How to override default Spring Security error messages easily.
• Spring Security logout example
  Simple example to show you how to implement the logout function.

References

1. Spring Security Official Page
2. Spring Security 3.2.x Reference
3. Custom Authentication with Spring Security