Spring Security – Basic Login Form

Welcome!

In this series, I hope to show you some techniques for using spring security and the larger spring ecosystem to build and develop secure application web servers.

Today, we’ll be looking at building a basic login form page using:

  • Spring Boot
  • Spring Security, and
  • Thymeleaf

Sample Code

The code for this lesson is available on GitHub

First off lets briefly cover some of the project files that are of less interest:

  • Application.java – contains our main method and the @SpringBootApplication annotation.
  • A CSS stylesheet is located under src/main/resources/static/css/ to make the demo pretty
  • Some Thymeleaf HTML templates are located under src/main/resources/ for demo purposes also
  • An application.properties file is located under src/main/resources where we can pass configuration parameters to our spring boot application. A full list of options can be found here

Dependencies

As with all Spring boot application’s, there are a number of ‘Starter’ libraries that make it easy to add jars to your classpath. In addition, these can auto-configure various spring beans and behaviours that we can make use of:

  • spring-boot-starter-parent – brings in all the required spring dependencies and manages there versions
  • spring-boot-starter-thymeleaf – adds thymeleaf-spring5 and thymeleaf-extras-java8time dependencies (more on thymeleaf)
  • spring-boot-starter-security – adds spring-security-config, spring-security-web and spring-aop dependencies
  • spring-boot-starter-test – adds spring-boot-test, junit, hamcrest and mockito
  • spring-security-test – adds the ability to mock user and user roles

MvcConfig

MvcConfig.java

This class implements spring’s WebMvcConfigurer interface. This allows you to override the method addViewControllers (as well as others) which is a way to configure simple automated controllers.

In this example, we have mapped them to our Thymeleaf views (under src/main/resources).

WebSecurityConfig

WebSecurityConfig.java

There’s a lot going on in this class as it contains the main security configuration to enable and configure our basic login form.

@EnableWebSecurity

A Marker which allows spring to find custom web application security configuration

WebSecurityConfigurerAdapter

Another abstract base class that allows you to override certain aspects of spring security’s default configuration. In our case, we are going to override the methods configure and configureGlobal.

configure(HttpSecurity http) method

Note the parameter passed to this method. There a several different configure methods. We will be overriding and configuring HttpSecurity specifically.

  • authorizeRequests() – Allows us to configure which resources on our web server to secure. You can see from our example code we have allowed un-secured access to our CSS directory and requested that all other resources are secured and can only be accessed by an authenticated user.
  • formLogin() – Tells spring security that we wish to use a login form. We provide the login URL, the URL we want to redirect to if the authentication is successful and finally permit access to the login and logout endpoints.
  • csrf() – For now we are disabling cross-site request forgery protection which by default is enabled. We will cover this later in the series.
configureGlobal method

Allows us to autowire an AuthenticationManager which will be used globally throughout our application. For this example, we are using a basic in-memory approach with one user and one user role.

Thymeleaf namespace

A few things to note in our login.html

The thymeleaf spring security namespace:

This action instructs the form to do a POST request to the URL provided (/login)

The if condition can check for a URL parameters, error and logout in this case and display content if they return true

Full list of whats available on the thymeleaf website

Demo

To run the demo open the Application.java class and right click run. In order to start the example, the port 8080 will need to be available on your machine. If it is not you can change this default in the application.properties file using:

Set this to whatever value you wish.

Unit Testing

ApplicationTests.java

@RunWith(SpringRunner.class)

Tells JUnit to run unit tests with Spring’s testing support

@SpringBootTest

Run as spring boot app. i.e. load application.properties and spring beans

@AutoConfigureMockMvc

Creates a Test helper class called MockMvc. From this, we can imitate a front-end client making requests to the server.

@WithMockUser

Provides the ability to mock certain users. An authenticated user in our case.

FormLoginRequestBuilder

A utility class that allows us to create a form based login request.

Next

Next up, we will be covering spring security’s user roles and the ability to hide and show content on our site based on the user’s permissions.

Menu