Spring Security Schulung

1 Security Introduction

• Why security
• Basic security concepts
• Common security vulnerabilities

2 Spring Security Basics

• Introduction to Spring Security
• Spring Security architecture overview
• Understanding security filters and the filter chain
• Explaining the SecurityContext
• Configuring Spring Security and Spring Boot auto-configuration

3 Securing Web Applications

• Configuring HTTP security
• Access control with AccessDecisionsManager
• Access control with AuthorizationManager
• Bypassing security

4 Method Security

• Explaining method security architecture
• Implementing declarative method security with annotations

5 Customizing Authentication

• Using and customizing authentication building blocks (AuthenticationManager, AuthenticationProvider, UserDetailsService)
• Username and password-based authentication mechanisms
• Other authentication mechanisms
• Authentication events

6 Handling Passwords

• Password hashing
• PasswordEncoder abstraction
• Upgrading passwords

7 Security Testing

• Using MockMvc to test security
• Using Security mock annotations and meta-annotations
• Testing method security

8 Protecting Against Common Vulnerabilities

• Protecting against CSRF attacks
• Using security headers
• Configuring transport layer security

9 OAuth2 Concepts

• What is OAuth2
• Defining Spring Security OAuth2 support
• Explaining authorization grant types
• Using Access and ID tokens (Opaque vs JWT)
• Understanding Scopes

10 The Spring Authorization Server

• Describing the role of the Authorization Server
• Configuring the Authorization Server

11 Protecting and accessing resources with OAuth2

• Configuring OAuth2 login
• Configuring the Resource Server
• Implementing a client using the WebClient