Spring Security – Basic Login Form

Introduction

Welcome! In this series, I hope to show you some techniques for using spring security and the larger spring ecosystem to build and develop secure application web servers.

Today, we’ll be looking at building a basic login form page using:

  • Spring Boot
  • Spring Security, and
  • Thymleaf

Github

Checkout out our starter or complete source code!

Initial Setup

Whether you’ve decided to check out the initial or complete source code you will notice the following code layout:

Some files are already set up:

  • Application.java – contains our main method and the @SpringBootApplication annotation.
  • A stylesheet under src/main/resources/static/css/
  • Some Thymeleaf HTML templates under src/main/resources/
  • An application.properties file where we can pass configuration parameters to our spring boot application.
    • We’ve added one property spring.thymeleaf.mode=LEGACYHTML5 which allow’s back-end developers like me to write poor HTML and not have Thymeleaf complain about it! 🙂

Dependencies

As with all Spring boot application’s, there are a number of ‘Starter’ libraries that make it easy to add jars to your classpath. In addition, these can auto-configure various spring beans and behaviours that we can make use of:

  • spring-boot-starter-parent – brings in all the required spring dependencies and manages there versions
  • spring-boot-starter-thymeleaf – adds thymeleaf-spring5 and thymeleaf-extras-java8time dependencies (more on thymeleaf)
  • nekohtml – helps thymeleaf scan and parse html files
  • spring-boot-starter-security – adds spring-security-config, spring-security-web and spring-aop dependencies
  • spring-boot-starter-test – adds spring-boot-test, junit, hamcrest and mockito
  • spring-security-test – adds the ability to mock user and user roles

MvcConfig

MvcConfig.java

This class extends springs abstract class WebMvcConfigurerAdapter. This allows you to override the method addViewControllers (as well as others) which is a way to configure simple automated controllers. In this example, we have mapped them to our Thymeleaf views.

WebSecurityConfig

WebSecurityConfig.java

There’s a lot going on in this class as it contains the main security configuration to enable and configure our basic login form.

  • @EnableWebSecurity – A Marker which allows spring to find custom web application security configuration
  • WebSecurityConfigurerAdapter – Another abstract base class that allows you to override certain aspects of spring security’s default configuration. In our case, we are going to override the methods configure and configureGlobal.
  • configure(HttpSecurity http) – Note the parameter passed to this method as there a several different configure methods. We will be overriding and configuring HttpSecurity specifically.
    • authorizeRequests() – Allows us to configure which resources on our web server to secure. You can see from our example code we have allowed un-secured access to our CSS directory and requested that all other resources are secured and can only be accessed by an authenticated user.
    • formLogin() – Tells spring security that we wish to use a login form. We provide the login URL, the URL we want to redirect to if the authentication is successful and finally permit access to the login and logout endpoints.
    • csrf() – For now we are disabling cross-site request forgery protection which by default is enabled. We will cover this later in the series.
  • configureGlobal – Allows us to autowire an AuthenticationManager which will be used globally throughout our application. In this example, we are using a basic in-memory approach with one user and one user role.

Thymeleaf namespace

login.html

The thymeleaf spring security namespace:

This action instructs the form to do a POST request to the URL provided (/login)

The if condition can check for a URL parameters, error and logout in this case and display content if they return true

Full list of whats available on the thymeleaf website

Demo

To run the demo open the Application class and right click run. In order to start the example, the port 8080 will need to be available on your machine. If it is not you can change this default in the application.properties file using:

Set this to whatever value you wish.

Unit Testing

ApplicationTests.java

 

  • @RunWith(SpringRunner.class) – tells JUnit to run unit tests with Spring’s testing support
  • @SpringBootTest – run as spring boot app. i.e. load application.properties and spring beans
  • @AutoConfigureMockMvc – Creates a Test helper class called MockMvc. From this, we can imitate a front-end client making requests to the server.
  • @WithMockUser – Provides the ability to mock certain users. An authenticated user in our case.
  • FormLoginRequestBuilder – A utility class that allows us to create a form based login request.

Next

Next up, we will be covering spring security’s user roles and the ability to hide and show content on our site based on the user’s permissions.

Menu