Spring Security Patterns

What architectural patterns does Spring Security follow? This talk starts with an insecure application and secures it from the ground up. It’ll examine patterns that are repeated throughout Spring Security and explain why they are there. Among others, you’ll learn about Spring Security’s filter chain, its authentication manager, and its preference for final classes and private methods.
Josh Cummings, Software Engineer at VMware; Eleftheria Stein, Software Engineer at VMware
Slides: www.slideshare.net/Pivotal/sp...

[@IScorpionI]

Great talk with many valuable background information on underlying patterns and decisions. Also great idea to paste those code blocks using code templates during the talk.

[@chrizzking]

great talk and very easy to follow along the code provided. Thanks guys!

[@laubrino]

Great video. And right from the source!

[@mirageman2]

Great work, please more of this :)

[@vishnumurali522]

Great work...👏👏👏👏

[@guruprasadrao7]

Gold level talk

[@alexandroskourtis5268]

Great talk :))

[@PradeepKumar-bp4lp]

Thanks bro

[@allisonmachado]

bom demais!

[@sacch6579]

I am wondering if one can have one version of git code with security and one without? If yes, is it easy to be maintained in parallel?

[@deryamilas2593]

do you guys have any video for authorization based on roles in spring security

[@IvanRandomDude]

28:44 If Only Java had expressions (Expression in this case) like C# so we could use it to specify what field of auth object we want instead of using magic string.

[@adambickford8720]

Java does have that (Function) but the problem is that annotations have to be known at compile time (short of stupid reflection hacks)

[@saurabhsuman4960]

[@songbaiyin7830]

I wish spring security does not include a default filter chain, they are useless. Every time I had to disable csrf here and disable stateful session there. I would be thinking: why don't we have a RestApiFilterChain. becoz rest api is the main stream now. Also could spring security be more opinionated and less flexible? Just have one way to do things and do things right. The spring security will be much much easier then.

[@michaelholopainen2822]

The DSL... the HTTP Security DSL is the biggest failures of Spring Framework. It is absolutely horrible. It is unreadable spaghetti code. It absolutely needs block level elements which the fluent inferface does not have. Fluent works and is readable when it ALWAYS returns the same type.
NO one knows how to get the HttpSecurity to work. Every time is is just random stabs in the dark until it suddenly kind-of works and then they to make your app support what ever you got to work that is close enough of what you wanted.