Spring Security without the WebSecurityConfigurerAdapter

แชร์
ฝัง
  • เผยแพร่เมื่อ 23 ธ.ค. 2024

ความคิดเห็น • 131

  • @areggrigorian7963
    @areggrigorian7963 2 ปีที่แล้ว +4

    Jesus, the person who actually worked on the framework explaining things, I smell professionalism! Thank you and much love!

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Thank you so much! I can't take any credit for writing any of that code, we have an amazing team of really smart people working on that. I'm glad I can help highlight what they do by explaining it though 🤩

  • @kedar-joshi
    @kedar-joshi 2 ปีที่แล้ว +28

    Dan, you are amazing. This video landed just in time when I was searching for the correct way of replacing the deprecated configuration. Thank you so much.

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Thank you! Glad I could help out.

  • @venkatke3948
    @venkatke3948 ปีที่แล้ว

    Super quick introduction to the new feature. Thank you very much

  • @bookswiper
    @bookswiper 2 ปีที่แล้ว

    I am also glad to get that replacement on video. Thank you very much

  • @prasunprabhakar7082
    @prasunprabhakar7082 2 ปีที่แล้ว +3

    Dan, your tutorials are well structured and explains the concept very clearly. Thank you and appreciate your effort.
    With Spring 3.0.x Spring security has changed with many methods getting deprecated. I request you to kindly explain the correct way to do LDAP authentication and return JWT using spring security 3.0
    Thank you.

  • @ChrisB_Crisps
    @ChrisB_Crisps 2 ปีที่แล้ว +1

    This video is great, I find easy to understand how to move from the WebSecurityConfigurerAdapter to the lambda DSL with the example given. And that for Spring Boot to pick the changes up it has to find it in a @Bean

  • @glaze4629
    @glaze4629 2 ปีที่แล้ว

    I didn't like this approach at first but being honest is way better than the previous one, I can't count how many times someone could not create a authentication manager bean because they overrode authenticationManager method and not authenticationManagerBean method

  • @chenioq
    @chenioq 2 ปีที่แล้ว

    Thank you Dan. I just finished this tutorial and now I am sure to said "this is an amazing tutorial for beginners, it is clear, easy to understand and useful"
    Thank you Dan. I just finished this tutorial and now I am sure to said "this is an amazing tutorial for beginners, it is clear, easy to understand and useful"

  • @ericidrogo
    @ericidrogo ปีที่แล้ว

    Excellent Dan thank you so much for sharing knowledge. Could you make a video about jakarta ?

  • @nitiKT
    @nitiKT ปีที่แล้ว +1

    Sir, Why annotate with @Configuration when @EnableWebSecurity has @Configuration annotation in it??

    • @SpringSourceDev
      @SpringSourceDev ปีที่แล้ว +1

      If you are on that version you are correct but it no longer includes it so going forward you will need both.

    • @nitiKT
      @nitiKT ปีที่แล้ว

      @@SpringSourceDev Oh i see, thats for the clarification...

  • @SergerFu
    @SergerFu ปีที่แล้ว +1

    Den! Hi what about very intensivly corrupted outdated docs about kervberos 1release in spring in aspects of new 6 security they cannot be together at all

  • @faycalguennoun5145
    @faycalguennoun5145 2 ปีที่แล้ว +1

    simple a good tutorial, it helps me understand the confusion of spring security > 2.7, thanks

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Glad you enjoyed it!

  • @vishalbalani1068
    @vishalbalani1068 ปีที่แล้ว

    Thanks for the video! After spending hours as I am new to JAVA and especially security side of things, your video helped me bypass the CORS issue. Being new to JAVA how to keep track or update myself in the best practices in JAVA? any recommendations is appreciated!

  • @konzip221
    @konzip221 ปีที่แล้ว

    Awesome video man!

  • @java-hero
    @java-hero ปีที่แล้ว

    Perfect timing
    That's what I am looking for.

  • @nurgazynurmamatov2942
    @nurgazynurmamatov2942 2 ปีที่แล้ว +1

    Thanks so much bro, you have all the new ones that we need

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      No problem at all, glad I could help out.

    • @nurgazynurmamatov2942
      @nurgazynurmamatov2942 2 ปีที่แล้ว

      @@DanVega I can't wait for the new video

  • @muathejamil4760
    @muathejamil4760 2 ปีที่แล้ว +1

    Dan, thank you very much but why we didn't do the production practice from the beginning.
    Again thank you.

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Good question! Mainly to keep the tutorial concise on and on topic.

  • @isaacafrifa1832
    @isaacafrifa1832 2 ปีที่แล้ว +2

    Thanks Dan for this video. Could you make another security video, this time involving API Keys?

    • @DanVega
      @DanVega  2 ปีที่แล้ว +2

      That is on the list. Are you just looking for JWT?

    • @isaacafrifa1832
      @isaacafrifa1832 2 ปีที่แล้ว

      @@DanVega Nope, just general API keys for application level security.

    • @maxjustmax521
      @maxjustmax521 2 ปีที่แล้ว +1

      @@DanVega a video about authentication and authorization using JWT is what many many many people are waiting for! så please yes!

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      @@maxjustmax521 that is coming next!

  • @cherriepie
    @cherriepie ปีที่แล้ว

    Great tutorial man! Thank you!

  • @clive2813
    @clive2813 2 ปีที่แล้ว +1

    Thank you so much for this tutorial it helped out a lot.

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      Glad it helped!

  • @VDMpeniel
    @VDMpeniel 2 ปีที่แล้ว

    Great video. Thank you so much!
    Is there a way to refresh the token or log it out ?

  • @csabavadasz2239
    @csabavadasz2239 ปีที่แล้ว

    Dan, thank you so so much! It was very useful!

  • @manes151
    @manes151 2 ปีที่แล้ว +1

    Thanks Dan, very concise video.
    What I don't like about the new configuration is that there is no easy way to get the underlying AuthenticationManager as a bean. We need custom login flows, so we need to call Authenticationmanager manually. In WebSecurityConfigurerAdapter, we can easily get the AuthenticationManager, but now, there is no way to do it AFAIK.

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      Thanks for the feedback.Can you give me an example of what you're trying to do and I will see if I can get you an answer.

    • @MichaBrzezinskiOrg
      @MichaBrzezinskiOrg 2 ปีที่แล้ว

      I was working quite long to hack old framework to be able change role to endpoint mapping without restarting app. Wanted to have features that can be assigned to user or role in dynamic way. Is new solution more flexible or I will have to hack it again 😂 that’s great to use it instead of feature toggle or grouping users to many groups. Just assign permission for user or for group on fly and keep it in database instead of code

  • @DeGoya
    @DeGoya ปีที่แล้ว

    Thank you, exactly what I needed

  • @jolskey
    @jolskey 2 ปีที่แล้ว +1

    Hi, Dan. Do we need to still leave EnableWebSecurity annotation? Looks to me it works without it. Btw, great video.

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      You should still use it. The reason it works without it is because Spring Boot will actually add the annotation for you if you forget.

    • @kenkrueger65
      @kenkrueger65 2 ปีที่แล้ว

      @@DanVega Add the annotation? My understanding is that Spring Boot's autoconfiguration classes will configure your default security beans. @EnableWebSecurity will cause Spring Security to configure your default security beans. These defaults are generally close but you would only use @EnableWebSecurity if you specifically wanted Spring Boot to back off. - great video though.

  • @jamesshen32
    @jamesshen32 2 ปีที่แล้ว

    This is exactly what I am looking for. Thank you so much!!!

  • @prabhjotsingh9597
    @prabhjotsingh9597 2 ปีที่แล้ว +1

    Great video Dan. Concise and to the point.
    I have a quick question about the deprecation - the blog post says WebSecurityConfigurerAdapter has been deprecated, as we encourage users to move towards a component-based security configuration.
    My question is why? What advantage would that give us as a developer which we couldn't have with WebSecurityConfigurerAdapter?
    Hope to hear from you soon and once again - thank you very much for taking the time to make this video

    • @DanVega
      @DanVega  2 ปีที่แล้ว +3

      Good question! I'm not sure what the motivation was behind the change but I will see if I can find out.

  • @maxjustmax521
    @maxjustmax521 2 ปีที่แล้ว +4

    Dan I can't express how good your tutorials are, love the structure, goal-setting and the on-point explaining without any gibber-gabber, One question is: will you update your course on Udemy to reflect the deprecations in the newer versions of Spring?
    so far Spring security is a very important subject, many do touch on it but there is no good structured course out there for this specific topic.
    Thanks again.

    • @DanVega
      @DanVega  2 ปีที่แล้ว +2

      I really appreciate the kind words Max! I have been thinking a lot about Udemy lately. I'm not sure what my plan is yet but when I figure that I will let you know.

  • @szalaytamas3184
    @szalaytamas3184 2 ปีที่แล้ว

    Your video is great. you teach like a pro. btw this is the first time i see you. you just got my subscribe and ill check more videos of yours.

  • @henriquedelben
    @henriquedelben ปีที่แล้ว

    Hello, my friend!
    Could you explain what is the difference between @EnableMethodSecurity and @EnableMethodSecurity? Also, why are they needed? Thanks in advance

  • @polycoder
    @polycoder 2 ปีที่แล้ว +1

    I cannot use antMatchers here why? it gives :Cannot resolve method 'antMatchers' in 'AuthorizationManagerRequestMatcherRegistry'

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      If you're using Spring Boot 3 -> Spring Security 6 has removed antMatches which was deprecated. Please use requestMatchers
      docs.spring.io/spring-security/reference/whats-new.html

  • @webeltech8755
    @webeltech8755 2 ปีที่แล้ว

    How do i define the AuthenticationManager bean following the deprecation of WebSecurityConfigurerAdapter?

  • @donwc6
    @donwc6 2 ปีที่แล้ว +1

    Thank you so much Dan, I really like the way you try to explain how to use it. I think it’s really important to use it in a Spring suggested way tooo.
    I have one question regarding on the SecurityFilterChains, does it mean that if I create two different SecurityFilterChains, is Spring be able to create two different sets of filter behavior?

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Great question. I answered it here for you
      github.com/danvega/office-hours/discussions/25

    • @donwc6
      @donwc6 2 ปีที่แล้ว

      @@DanVega thanks Dan

  • @nalinthushara3293
    @nalinthushara3293 2 ปีที่แล้ว +1

    Hi what happen to AuthenticationManagerBuilder object ?

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      You can create a bean that returns an AuthenticationManager. What are you trying to do?

  • @mukhammadnajimov8440
    @mukhammadnajimov8440 2 ปีที่แล้ว

    Dan thank you so much

  • @Mr.YeastMK
    @Mr.YeastMK ปีที่แล้ว

    Good and helpful tutorial 👍

  • @mrjiggawatt
    @mrjiggawatt 2 ปีที่แล้ว

    How do you create integration tests for these controllers that use the InMemoryUserDetails?

  • @schoolbook1
    @schoolbook1 2 ปีที่แล้ว

    Thank you Dan

  • @rahulvij4322
    @rahulvij4322 2 ปีที่แล้ว +1

    Can you make a video on how to enable csrf on spring security and use it with Angular app.

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      I don't do a lot with Angular but I will add it to my backlog.

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      github.com/danvega/office-hours/discussions/46

  • @aleksandraaleksandrova2446
    @aleksandraaleksandrova2446 ปีที่แล้ว

    I get a very strange error: authorizeRequests() is depricated. How do I solve this?

  • @clarencewhite5086
    @clarencewhite5086 2 ปีที่แล้ว

    Very helpful video, thanks!

  • @mayilarun
    @mayilarun 2 ปีที่แล้ว +1

    The GitHub link seems to be not having the code demonstrated here. Could you please update that?

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Sorry for that, fixed and pushed.

  • @milesliu4498
    @milesliu4498 2 ปีที่แล้ว +2

    What is this http terminal tool

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      It just makes calling services from the command-line a little bit easier, readable and less verbose.
      httpie.io/

  • @oarous
    @oarous 2 ปีที่แล้ว

    Thank you for this amazing Tutorial! Can you also explain how to do the same thing if we have multiple Configurations with different @Order?

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      I answered a similar question here github.com/danvega/office-hours/discussions/25

  • @vpezzano
    @vpezzano 2 ปีที่แล้ว

    Hi Dan. always great content, thanks a lot!

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      My pleasure!

  • @NguyenKimLuongLuongNKGVFPL-HN
    @NguyenKimLuongLuongNKGVFPL-HN ปีที่แล้ว

    I see that in @EnableWebSecurity has also @Configuration, so do we need to add @Configuration again at line 11? When I remove @Configuration at line 11, application still working.

    • @DanVega
      @DanVega  ปีที่แล้ว +1

      Just leave it there because In later versions it doesn’t include @Configuration

  • @TheGuroguro12
    @TheGuroguro12 ปีที่แล้ว +1

    thanks!!!

  • @vishalkadu7688
    @vishalkadu7688 2 ปีที่แล้ว

    Great content as always ❤️.. waiting for the next one.. keep it up good work 👍

  • @JitterTed
    @JitterTed 2 ปีที่แล้ว +1

    Thanks for this, Dan! btw, I thought mvcMatchers() were preferred over antMatchers()? Also, keeping config in a separate class, outside of the Application class, makes it easier to replace inside tests.

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      I generally use mvc matchers but I would have to do some research if its preferred or not. I was just converting a basic example I found that was using ant matchers and that's why i used it here.

    • @kenkrueger65
      @kenkrueger65 2 ปีที่แล้ว +4

      mvcMatchers("/admin") would match /admin, /admin/, /admin.html, etc. since it uses the same MVC matching logic as Spring MVC itself. antMatchers("/admin") would strictly match "/admin", not the other variants. In this case, an attacker could get into the "authenticated()" block by simply adding an extra "/" (yikes!). Since this subtlety is so easy to miss, I would recommend mvcMatchers.

  • @KenLee0915
    @KenLee0915 2 ปีที่แล้ว

    Thanks for sharing, would you mind to share some opinion or suggestion for my recent use case.
    I'm developing a microservice architecture and spring security is in the core library project that included in each of the services.
    I have different set of api to mark as permitAll() for each of them.
    Basically I want to avoid create almost identical filter chain bean that consist of csrf.disable(), cors and etc. Can filter chain bean be extended?

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      I would have to see how much duplication is going on. Generally in microservices you are going to have some level of duplication and each service needs to be independently deployable so I'm ok with it here.

  • @ElmshornBoy
    @ElmshornBoy ปีที่แล้ว

    Does this configuration also work for Spring Web MVC?

  • @upn2772
    @upn2772 2 ปีที่แล้ว +1

    How come you're using antMatchers instead of requestMatchers?

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      Because this video was made before the changes in Spring Boot 3 😉 Going forward please use request matchers.

  • @manikanta-in7vp
    @manikanta-in7vp 2 ปีที่แล้ว +1

    amazing ...! sir can you please do spring security with using mysql database data

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      Sounds like a great suggestion. Can you add this to my content idea discussions and provide as much detail as possible.
      github.com/danvega/office-hours/discussions/categories/content-ideas

    • @manikanta-in7vp
      @manikanta-in7vp 2 ปีที่แล้ว

      @@DanVega added sir

  • @ainigma100
    @ainigma100 2 ปีที่แล้ว

    Thank you for the great video Dan! I tried adding 'springdoc-openapi-ui' to document the api while using basic auth security but for some reason it did not work. I was able to send a request even if I logout. Can you please make a tutorial in which you demonstrate how to use 'springdoc-openapi-ui' in our project while having basic auth and also JWT auth (I know that we can have one at a time but it would be great to see both implementations). Thank you in advance!

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Thank you for the suggestion. I added it to my backlog github.com/danvega/office-hours/discussions/35

  • @SpontaneousCube
    @SpontaneousCube 2 ปีที่แล้ว

    Amazing video thank you so much! I was stuck with this just the other day 😊

    • @DanVega
      @DanVega  2 ปีที่แล้ว +1

      Glad it helped!

  • @tomhouse673
    @tomhouse673 2 ปีที่แล้ว

    The video is great but I was following along and can't call either of the secured API's user / admin. I've tried with curl and Chrome passing in basic auth (Chrome prompts you for credentials). I have the security config annotated as a @Configuration and both methods annotated as @Bean. I'm sure it's user error :(

    • @tomhouse673
      @tomhouse673 2 ปีที่แล้ว

      problem solved. User error. The video is really great, thanks.

  • @kenkrueger65
    @kenkrueger65 2 ปีที่แล้ว

    great video

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      Thank you, Ken!

  • @muhohojeremy4861
    @muhohojeremy4861 2 ปีที่แล้ว

    Thanks for a very good tutorial. However I am stuck at the login loop. I am using Kotlin. How can you assist me?

  • @Dhan-pro
    @Dhan-pro 8 หลายเดือนก่อน +1

    07:00

  • @Az1zdev
    @Az1zdev 2 ปีที่แล้ว +1

    thank you

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      You're welcome

  • @kapilkumarsharma4401
    @kapilkumarsharma4401 ปีที่แล้ว

    Thanks you

  • @AleksandarT10
    @AleksandarT10 2 ปีที่แล้ว +1

    Great video as always! Keep up the good work and it will be awesome to see more videos on this topic.
    Since nowadays most apps are REST API's with SPA framework and JWT flows are used - it will be great if Spring Team implements this flow (REST API, Role based Authentication/Authorization against the Database - with bcrypted password, etc) out of the box.
    Do the new Spring Security changes simplify this flow in any way? Because right now to implement such flow there is a lot of boilerplate code which would be better if it is implemented and can be used from Spring Security!

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      These changes don't really change that but I have enough requests for a similar tutorial that I will work on that soon. Thanks for the feedback.

  • @udemytiengviet956
    @udemytiengviet956 2 ปีที่แล้ว

    Thanks for this video, it's really helpful
    But I can't .antMatcher() after authorizeRequests() . Please help me solve this error. Thankssss

    • @khawan5534
      @khawan5534 2 ปีที่แล้ว +1

      They deprecated it too. Now:
      authorizeRequests() -> authorizeHttpRequests()
      antMatcher() -> requestMatchers()

    • @ОлесьУкраїнський
      @ОлесьУкраїнський ปีที่แล้ว

      @@khawan5534
      authorizeRequests() has already depricated.(

  • @nurgazynurmamatov2942
    @nurgazynurmamatov2942 2 ปีที่แล้ว +1

    I would like a new video all about relationship(hibernate)

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      Thanks for the suggestion github.com/danvega/office-hours/discussions/36

  • @menabebawy390
    @menabebawy390 ปีที่แล้ว

    thx dear

  • @lucalillo3512
    @lucalillo3512 2 ปีที่แล้ว +1

    I love you

  • @ddmddd1111
    @ddmddd1111 2 ปีที่แล้ว

    I love the way you present the ideas to work with. Simple and well designed!! Could you please add the zip file of your demo project on the description so that anyone can download and practice more. Thank you

  • @manideepkumar959
    @manideepkumar959 9 หลายเดือนก่อน

    Dan, u are going very fast, u are no telling the internals and how it is happening, u just fired a request http -a user:password :8080/admin and logged in as user , i understood whats happenin, but want to know how it works will it go as header or better u should have used postman to avoid confusions

  • @dimalutsuyk518
    @dimalutsuyk518 ปีที่แล้ว

    👍

  • @rjgupta2849
    @rjgupta2849 2 ปีที่แล้ว

    Sir, Can you Please Tell How to Write Authentication Manager Builder in New Spring boot Version

  • @jeevanthalluri2200
    @jeevanthalluri2200 2 ปีที่แล้ว +1

    Upload spring security jdbc

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      What are you trying to learn? How to lookup users in a database via JDBC?

    • @jeevanthalluri2200
      @jeevanthalluri2200 2 ปีที่แล้ว

      I am trying to develop one e-commerce project with spring boot security jdbc and react js

    • @jeevanthalluri2200
      @jeevanthalluri2200 2 ปีที่แล้ว

      Thank you for your response Dan sir

  • @GROOVETECHSETS
    @GROOVETECHSETS ปีที่แล้ว

    Omg. Just 6 months ago and this is outdated. WTF is happening with Spring Security :(

    • @DanVega
      @DanVega  ปีที่แล้ว

      What do you mean? It was deprecated, then removed. Not sure what the issue is?

  • @_Cap0_
    @_Cap0_ ปีที่แล้ว

    stu mllunar

  • @pierreclaverie3884
    @pierreclaverie3884 4 หลายเดือนก่อน

    Most of the things in this video are now deprecated...whata shitty framework

  • @ayael119
    @ayael119 ปีที่แล้ว

    I have an error even after doing this changes I got this err while runing the app : org.springframework.beans.factory.BeanDefinitionStoreException: Failed to process import candidates for configuration class [org.springframework.boot.autoconfigure.security.servlet.SpringBootWebSecurityConfiguration$WebSecurityEnablerConfiguration]: class path resource [org/springframework/web/servlet/config/annotation/WebMvcConfigurerAdapter.class] cannot be opened because it does not exist

  • @SD-gw5vm
    @SD-gw5vm 2 ปีที่แล้ว

    Hi There,
    I am using Spring Boot 2.75 and I used your tutorial up to a point. I managed to dig around Google and founs some useful pointers but using your tutorial I wrote this and it worked. Thanks for your help
    @Bean
    public InMemoryUserDetailsManager userDetailsManager(){

    //In Spring 5 we need to encode our password as standard. This is different from how we use to do it in Spring 4

    PasswordEncoder encoder=PasswordEncoderFactories.createDelegatingPasswordEncoder();
    UserDetails user=User.withUsername("user")
    .password(encoder.encode("password"))
    .roles("USER")
    .build();
    UserDetails admin=User.withUsername("admin")
    .password(encoder.encode("password"))
    .roles("ADMIN")
    .build();
    return new InMemoryUserDetailsManager(user,admin);
    }

  • @sajeevvasudevan6301
    @sajeevvasudevan6301 2 ปีที่แล้ว +1

    thanks sir , im appreciating your open mind for helping peoples , im from india , can you give me your facebook im a java developer from kerala

    • @DanVega
      @DanVega  2 ปีที่แล้ว

      Thank you for the kind words. Facebook isn't a great place to reach me. If you want you can find me on Twitter
      twitter.com/therealdanvega