📺 Develpreneur YouTube Episode

Video + transcript

Spring Boot Security - Excluding Pages

2023-12-12 •Youtube

Detailed Notes

We are continuing a series of tutorials focused on Spring Boot. The crux of the project is to convert/migrate an old JSP/Tomcat application to a modern Spring Boot application and Java 7/8 to a current version. Spring provides an excellent security framework that can lock down your site. In this episode, we look at how to leave pages and resources externally accessible without a login.

You can learn more through our online classes at https://school.develpreneur.com and register for free. Registration will add you to our email list, and you will periodically receive coupons for courses and notifications of the latest releases.

Transcript Text
[Music]
well hello and welcome back We are
continuing our spring boot tutorial as
we're converting an older application
into a newer spring boot trying to get
get to use some of these modern tools
and last time around we customized our
login screen one of the things we did
though is we had stuff not showing
up so we
had uh let's see if I get rid of
this we had a
homepage that did not look good because
because we weren't getting things like
CSS and those kinds of good things so
oops let's go here so if I go to my
homepage two things that we had that
were an issue one is that it takes me
here to my login page as opposed to an
actual homepage and as you can see here
there's like a whole lot of missing CSS
JavaScript all that kind of good stuff
so this episode we're going to focus on
unsecured things now the security comes
right here with the authorized HTTP
requests and any request needs to be
authenticated and so what we need to do
with that is we're going to actually
build a bunch of matchers and for those
things that match those we're going to
do a permit all we're going to say
anything that matches that we're going
to let it go through and not force a
login and this is something that if
you're if you're doing some searches out
there there are a couple different ways
to do this stuff there's there's an
older way and a modern way and depending
on how you've got your application set
up it's going to look for ant an matches
or request matchers um and sort of like
the it's a different setup that's not
what we need that's usually what you're
going to see the nice thing is it's
pretty easy to just replace ant with
request and usually what you're going to
see is a series of strings instead
you're going to want an MVC request
matcher just to make sure that because
this is an MVC application we're
building we're doing a web app and so
we're going to want to make sure we
build those out now I've I've built all
of these out but I want to sort of walk
through these first so the first thing I
wanted to do is let me do this I'll pull
a couple of these out what the first
thing I wanted to look at is say hey
this thing's always going to the login
it does not take me to my homepage
so what I'm going to do is I'm going to
allow slash and slome and do I have a
slome I think I have a slome oh I don't
it's uh that was a leftover used to be
slome but there you go so I have a slome
even though I'm not it's not there I'm
going to allow both of those so actually
for this let's just go ahead and pull
that uh yeah I'm going to leave it there
let me see how I want to do this let me
do it this way sorry I'm going to pull
that
and whoops I want yeah I want everything
except MBC so I'm just going to add this
this time around all I'm doing is saying
hey slash is unsecured and so if I do
that now notice this is my login page
and we're going to see something a
little different hopefully it's EAS yeah
so now you can see this a little
different and this is now slash now I
can still log in because I have a login
form here so if I log
in now it takes me to my dashboard just
like it normally did and now I could
also go to if I want to go back to slash
I can do that and now here's the magic
notice because I'm logged in this thing
actually looks decent because it's
pulling all of that key stuff
in and what is that key stuff it's
things like JavaScript and cascading
Styles sheet CSS and images and
bootstrap and all kinds of goodness so
we want this to look this way even if
like here I log out now log out notice
it took me back to
login so if I go to my home I can do
that but again that's not the homeage
looks horrible because it's not letting
those things in so let's start working
on that piece let me do this I don't
need the home at
all now the first thing uh one of the
first thing I want to do is I'm going to
allow let's do this if we look at what
we had here um we do have a couple of
basic pieces so we are getting the
header if we look cuz that was where our
menu items were so header's coming in so
I didn't really need
that but what we do need is we want to
bring
in anything that is an IMG we want to
bring in our bootstrap stuff we want to
bring in our CSS and our JS the way we
do this is we're going to do a permit
all and so what we want to do
here uh with each of these is we're
going to create a request matcher and
all we do is we're just going to say hey
give it a
string um it's also looking for a u
another control that we don't really
have to worry about because we can just
leave it null so the easy way is let's
just leave it
null and note the um the pattern here
what we want to do is a star star so
that's just going to be like anything
whether it's um an actual just a file
name or a file name with an extension or
whatever it is so you just want to catch
in this case like give me everything
including subdirectories whatever I want
everything that matches this name so
anything that's going to have this is
going to get picked
up and if I add
those what I end up with
here
is now when I come to my homepage now
I'm seeing most of what I've got but now
look if you look we're still missing
something
because um if I log
in if I go ahead and log into this and
then come back to that page I'm going to
see something a little bit different and
it's because right there so this thing
that this Banner that is picking stuff
up from core.
CSS probably is where we're going to see
it so what we want to
do and if you know well uh shoot let me
go back to that where was that Banner
it's hard to see here probably but it's
uh cot CSS although it is loading it
we're not getting like an error or
anything like that we're not reading it
when it's not here so here that's one of
the pieces we
missed is right here on our Banner it's
coming from core so most likely that's
where we're going to oh let me see where
did the
[Music]
banner and you should be able to see
here where did it
go uh I can't can't find my color but
normally what you're going to see is
you're going to see where the color oh
cuz it's not picking up because it's not
in core. CSS it's not being shown so we
can see here that's like oh okay well
let's go ahead and
pick uh let's make
this
three and let's just call it let's see
if we get core.
CSS and we're going to add three here
and this is how we can do it we can just
stack wh we can just stack darn it there
we can just stack these things up all
day and permit
stuff and so we could also come in and
we could also start securing specific
things which may be the easier rout it
depends on what you how you look at
stuff let's see I've got an error here
somewhere it
said
um I'm not sure why I think it just
doesn't like it in general
okay oh yeah because it's just that's
some of the formatting issues so we'll
allow that to go and we're come over
here and we're going to run it and now
let's see if we can get our core.
CSS and now we've got it so we are here
we're not logged
in actually let's go here because I was
on the login page here we go so
now here's my homepage if we take a look
at
it and let's do this let's take this
page so we do a little side by side
compare is if we take
that and then we do um let's just do
this let's just create one real
quick and if we look at this one uh
let's just go
here so if we look at it like this and
then we look at it after we've logged
in
and then we come back to that
page what we should see is basically
identical so if we move this to there
move this to
there granted it's a little bit
different in our width let me match the
width for
us and if I do a match
width then we'll see that look things
are starting to fall out they look
exactly the same we do still have our
footer which is always like one of those
key things we want to have so now we
have managed to uh unsecure some of our
key uh key pieces of our application
note that
again if I try to go to
dashboard well I can go here notice here
I'm at home but if I try to go to my
dashboard and I'm not logged in then it
kicks me back to the login page not the
home page page to login page so these
are slightly different as we've noted um
here you can see this is login page and
it looks a little bit the same but I
changed it just enough so now we can say
hey this is my
homepage and notice I still have my
Carousel working but we'll work on that
later so if I go to dashboard wh or
anything that's wrong basically it's
going to say whatever I sent so I can go
to blah blah blah it's going to say I
don't know what that is so first thing
you need to do is you need to log in so
if I log
in then it's going to say all right I've
taken you
there so now I'm logged into my
dashboard now I can look at dashboard or
I could go to that Ops that was actually
set up and I can see that hey I've got
things set up and then I can log back
out and it kicks me back to my login and
I have my nice little message now I do
want to swing back around the login page
itself um there's not not a whole lot to
it uh let's see where we go here so
there's not a whole lot we need to do
with our login form but we do need to
make sure that we've got some things
there that actually are properly you
know named so we do need our username
and password need to be entered that way
and other than that we're going to form
to uh we've got a form it's going to use
this we're going to use that time leavea
the action is at/ log in uh if you
wanted to do a log out you will see uh
wherever I put the menu is that here I
think that's on the other it's in the
header think I switched that to at
logout uh yeah is it's going to be a log
out and um now it's it CU I just
switched it over to a submit button
there so it's going to go in and SL so
this
is how you connect these pieces out uh
fairly easy easily is you can just go
straight in and it's just going to say
hey I'm going to post to and it's like
very like I said it's sort
of U you know 101 type stuff but just
want to let know that these are again
we're using our time Leaf we're using
our a couple our key things which is
basically our action for our password
for our
login it's going to log in it does go to
web security config and this is where
we're going to try to make sure that we
get our username comes in so we want you
know username is going to be username
password is going to be password and
it's going to send those things in uh
accordingly and once we've got those
it's going to validate us and give us a
you some sort of a a security role now
there is or security access now there
are things that are out there that we we
aren't haven't talked about yet we'll
probably get to at some point where you
have like different roles so you can
have an admin role and they're only
going to see things and this again goes
back to our security so you can do it
where instead of permit all it's only
going to permit certain users like maybe
only admin gets to see it so we would
maybe say that hey everybody gets to see
which we need for these
but for uh some of the other stuff there
may be like certain pages that we only
want admin to see and otherwise in those
kind of cases we're probably going to
have some sort of like you know login or
some sort of an error page you're going
to redirect
to I think that's good enough for now to
get us like our our Basics so what we
have now is we can build a page that's a
login we can have a homepage which is
our slash and we can free
up key stuff that we need to free up
basically so that we can get all of our
here uh like our resources and such get
those things included in and let's see I
think I've got everything
there I have a home Banner well I'm
going to take a look at those I'll go
flip back through those I think I've got
everything now that is needs to be
unsecure unsecure so that we can plow on
with some of our other uh pages and
start building out the application and
just start cranking through this thing
if you have any questions shoot an email
to info@ developand door.com uh we're
going to keep chugging along here add
some new things a little bit conversions
here and there uh some's going to be
very straightforward and simple because
it's the nice stuff about building a
good Java application and doing an MVC
model and how you can very quickly make
some changes like this where're in a
sense re-platforming the whole thing but
it's not taking us a whole lot of work
that being said go out there and have
yourself a great day a great week and we
will talk to you next time hello this is
Rob with develop or also known as
building better developers wanted to
announce that we have school.
developer.com feel free to check it out
if you like any of this information any
of the cont content that we've sent and
you would like to see more you can come
out you can enroll for free we have free
courses we've got places for you to get
better at just learning a technology or
how toos you can work on your business
skills we can help you with becoming a
better developer as in coding and things
like that a lot of the stuff you've seen
on YouTube we also have out at school.
develop andur we have it a little more
of a uh educational format and a way for
you to track your progress as you move
forward becoming a better
[Music]
developer
Transcript Segments
1.35

[Music]

27.359

well hello and welcome back We are

30.279

continuing our spring boot tutorial as

32.64

we're converting an older application

34.36

into a newer spring boot trying to get

37

get to use some of these modern tools

39.36

and last time around we customized our

41.48

login screen one of the things we did

44.16

though is we had stuff not showing

47.719

up so we

50.52

had uh let's see if I get rid of

54

this we had a

57.079

homepage that did not look good because

59.92

because we weren't getting things like

61.76

CSS and those kinds of good things so

64.36

oops let's go here so if I go to my

66.52

homepage two things that we had that

68.56

were an issue one is that it takes me

71.119

here to my login page as opposed to an

73.92

actual homepage and as you can see here

76.64

there's like a whole lot of missing CSS

78.759

JavaScript all that kind of good stuff

81.6

so this episode we're going to focus on

84.36

unsecured things now the security comes

89.4

right here with the authorized HTTP

91.6

requests and any request needs to be

94.479

authenticated and so what we need to do

97.159

with that is we're going to actually

98.439

build a bunch of matchers and for those

102.399

things that match those we're going to

103.799

do a permit all we're going to say

105.719

anything that matches that we're going

107

to let it go through and not force a

111.799

login and this is something that if

114.64

you're if you're doing some searches out

117.2

there there are a couple different ways

119.039

to do this stuff there's there's an

120.759

older way and a modern way and depending

123.479

on how you've got your application set

125.28

up it's going to look for ant an matches

128.039

or request matchers um and sort of like

131.2

the it's a different setup that's not

133.64

what we need that's usually what you're

134.84

going to see the nice thing is it's

136.76

pretty easy to just replace ant with

138.64

request and usually what you're going to

140.599

see is a series of strings instead

142.319

you're going to want an MVC request

143.959

matcher just to make sure that because

145.72

this is an MVC application we're

147.36

building we're doing a web app and so

150.72

we're going to want to make sure we

151.72

build those out now I've I've built all

154.519

of these out but I want to sort of walk

156.319

through these first so the first thing I

158.44

wanted to do is let me do this I'll pull

162.599

a couple of these out what the first

164.8

thing I wanted to look at is say hey

166.4

this thing's always going to the login

168.319

it does not take me to my homepage

171.319

so what I'm going to do is I'm going to

173.48

allow slash and slome and do I have a

177.12

slome I think I have a slome oh I don't

179.8

it's uh that was a leftover used to be

182.12

slome but there you go so I have a slome

185.159

even though I'm not it's not there I'm

186.599

going to allow both of those so actually

188.2

for this let's just go ahead and pull

191.76

that uh yeah I'm going to leave it there

195.72

let me see how I want to do this let me

196.84

do it this way sorry I'm going to pull

201.28

that

203.4

and whoops I want yeah I want everything

207.64

except MBC so I'm just going to add this

210.56

this time around all I'm doing is saying

212.84

hey slash is unsecured and so if I do

218.68

that now notice this is my login page

222.319

and we're going to see something a

223.239

little different hopefully it's EAS yeah

225.799

so now you can see this a little

226.879

different and this is now slash now I

229.64

can still log in because I have a login

231.64

form here so if I log

236.64

in now it takes me to my dashboard just

239.84

like it normally did and now I could

241.799

also go to if I want to go back to slash

245.519

I can do that and now here's the magic

249.159

notice because I'm logged in this thing

251.76

actually looks decent because it's

253.879

pulling all of that key stuff

257.519

in and what is that key stuff it's

259.959

things like JavaScript and cascading

262.4

Styles sheet CSS and images and

265.6

bootstrap and all kinds of goodness so

267.68

we want this to look this way even if

272.08

like here I log out now log out notice

274.36

it took me back to

276

login so if I go to my home I can do

279.24

that but again that's not the homeage

283.28

looks horrible because it's not letting

285.12

those things in so let's start working

287.4

on that piece let me do this I don't

290.68

need the home at

292.32

all now the first thing uh one of the

295.6

first thing I want to do is I'm going to

297.039

allow let's do this if we look at what

300

we had here um we do have a couple of

303.28

basic pieces so we are getting the

306.52

header if we look cuz that was where our

309.28

menu items were so header's coming in so

312.6

I didn't really need

314.72

that but what we do need is we want to

317.6

bring

319.16

in anything that is an IMG we want to

323.8

bring in our bootstrap stuff we want to

326.6

bring in our CSS and our JS the way we

329.28

do this is we're going to do a permit

331.479

all and so what we want to do

335.56

here uh with each of these is we're

337.96

going to create a request matcher and

339.4

all we do is we're just going to say hey

341

give it a

341.919

string um it's also looking for a u

345.96

another control that we don't really

348

have to worry about because we can just

349.68

leave it null so the easy way is let's

352.16

just leave it

353.52

null and note the um the pattern here

358.639

what we want to do is a star star so

360.52

that's just going to be like anything

362.039

whether it's um an actual just a file

365.36

name or a file name with an extension or

367.44

whatever it is so you just want to catch

369.56

in this case like give me everything

372

including subdirectories whatever I want

373.919

everything that matches this name so

377.12

anything that's going to have this is

378.72

going to get picked

379.96

up and if I add

382.84

those what I end up with

388.4

here

392.96

is now when I come to my homepage now

396.639

I'm seeing most of what I've got but now

399.56

look if you look we're still missing

401.36

something

402.8

because um if I log

409.4

in if I go ahead and log into this and

412.599

then come back to that page I'm going to

414

see something a little bit different and

416.36

it's because right there so this thing

422.759

that this Banner that is picking stuff

427.199

up from core.

429.68

CSS probably is where we're going to see

432.08

it so what we want to

433.8

do and if you know well uh shoot let me

438

go back to that where was that Banner

439.72

it's hard to see here probably but it's

441.96

uh cot CSS although it is loading it

444.56

we're not getting like an error or

445.8

anything like that we're not reading it

447.639

when it's not here so here that's one of

452.319

the pieces we

455.039

missed is right here on our Banner it's

458.44

coming from core so most likely that's

461.72

where we're going to oh let me see where

463.08

did the

463.54

[Music]

470.08

banner and you should be able to see

473

here where did it

477.8

go uh I can't can't find my color but

480.639

normally what you're going to see is

481.479

you're going to see where the color oh

482.52

cuz it's not picking up because it's not

484.319

in core. CSS it's not being shown so we

487.159

can see here that's like oh okay well

489.12

let's go ahead and

490.56

pick uh let's make

494.52

this

497.44

three and let's just call it let's see

500.84

if we get core.

504.159

CSS and we're going to add three here

507.759

and this is how we can do it we can just

508.879

stack wh we can just stack darn it there

512.479

we can just stack these things up all

514.2

day and permit

516.399

stuff and so we could also come in and

518.68

we could also start securing specific

520.56

things which may be the easier rout it

522.32

depends on what you how you look at

524

stuff let's see I've got an error here

525.44

somewhere it

526.44

said

528.399

um I'm not sure why I think it just

531.959

doesn't like it in general

537.8

okay oh yeah because it's just that's

540.399

some of the formatting issues so we'll

541.72

allow that to go and we're come over

544.24

here and we're going to run it and now

546.2

let's see if we can get our core.

551.68

CSS and now we've got it so we are here

554.44

we're not logged

555.8

in actually let's go here because I was

558.24

on the login page here we go so

561.279

now here's my homepage if we take a look

564.68

at

566.2

it and let's do this let's take this

569.44

page so we do a little side by side

573.36

compare is if we take

576.88

that and then we do um let's just do

581.079

this let's just create one real

586.48

quick and if we look at this one uh

590.48

let's just go

592.72

here so if we look at it like this and

595.279

then we look at it after we've logged

598.12

in

603.16

and then we come back to that

606.56

page what we should see is basically

610.48

identical so if we move this to there

613.04

move this to

614.56

there granted it's a little bit

616.64

different in our width let me match the

619.48

width for

622.68

us and if I do a match

625.36

width then we'll see that look things

627.76

are starting to fall out they look

629.2

exactly the same we do still have our

630.6

footer which is always like one of those

632.72

key things we want to have so now we

635.12

have managed to uh unsecure some of our

639.279

key uh key pieces of our application

642.88

note that

644.839

again if I try to go to

648.16

dashboard well I can go here notice here

651.279

I'm at home but if I try to go to my

653.32

dashboard and I'm not logged in then it

656.8

kicks me back to the login page not the

658.72

home page page to login page so these

660.16

are slightly different as we've noted um

663.36

here you can see this is login page and

666.279

it looks a little bit the same but I

668.56

changed it just enough so now we can say

670.079

hey this is my

671.72

homepage and notice I still have my

673.68

Carousel working but we'll work on that

675.04

later so if I go to dashboard wh or

679.279

anything that's wrong basically it's

680.6

going to say whatever I sent so I can go

682.639

to blah blah blah it's going to say I

685.519

don't know what that is so first thing

686.76

you need to do is you need to log in so

688.44

if I log

691.399

in then it's going to say all right I've

694.639

taken you

696

there so now I'm logged into my

697.92

dashboard now I can look at dashboard or

700.079

I could go to that Ops that was actually

702.36

set up and I can see that hey I've got

705.12

things set up and then I can log back

707.079

out and it kicks me back to my login and

709.399

I have my nice little message now I do

712.44

want to swing back around the login page

716.279

itself um there's not not a whole lot to

720.72

it uh let's see where we go here so

725.399

there's not a whole lot we need to do

726.92

with our login form but we do need to

729.8

make sure that we've got some things

731.24

there that actually are properly you

733.639

know named so we do need our username

736.519

and password need to be entered that way

740.519

and other than that we're going to form

742.92

to uh we've got a form it's going to use

745.6

this we're going to use that time leavea

747.44

the action is at/ log in uh if you

750.24

wanted to do a log out you will see uh

754.6

wherever I put the menu is that here I

756.92

think that's on the other it's in the

758.36

header think I switched that to at

762.399

logout uh yeah is it's going to be a log

767.56

out and um now it's it CU I just

770.48

switched it over to a submit button

772.6

there so it's going to go in and SL so

774.44

this

775.16

is how you connect these pieces out uh

778.36

fairly easy easily is you can just go

779.8

straight in and it's just going to say

780.959

hey I'm going to post to and it's like

783.24

very like I said it's sort

785.04

of U you know 101 type stuff but just

789.32

want to let know that these are again

790.76

we're using our time Leaf we're using

793.12

our a couple our key things which is

795.32

basically our action for our password

798.24

for our

799.32

login it's going to log in it does go to

803.48

web security config and this is where

805.44

we're going to try to make sure that we

807.72

get our username comes in so we want you

810.079

know username is going to be username

812.68

password is going to be password and

814.6

it's going to send those things in uh

818.88

accordingly and once we've got those

821.44

it's going to validate us and give us a

823.639

you some sort of a a security role now

826.399

there is or security access now there

829.12

are things that are out there that we we

831.04

aren't haven't talked about yet we'll

832.6

probably get to at some point where you

833.8

have like different roles so you can

835.839

have an admin role and they're only

837.199

going to see things and this again goes

839.24

back to our security so you can do it

842.279

where instead of permit all it's only

844.56

going to permit certain users like maybe

847.56

only admin gets to see it so we would

849.199

maybe say that hey everybody gets to see

851.32

which we need for these

854.12

but for uh some of the other stuff there

856.519

may be like certain pages that we only

858.199

want admin to see and otherwise in those

860.959

kind of cases we're probably going to

862.16

have some sort of like you know login or

864.079

some sort of an error page you're going

865.399

to redirect

867.04

to I think that's good enough for now to

869.68

get us like our our Basics so what we

872.04

have now is we can build a page that's a

875.759

login we can have a homepage which is

878.48

our slash and we can free

881.6

up key stuff that we need to free up

885.48

basically so that we can get all of our

888

here uh like our resources and such get

891.639

those things included in and let's see I

895.48

think I've got everything

897.68

there I have a home Banner well I'm

900.6

going to take a look at those I'll go

901.759

flip back through those I think I've got

903.24

everything now that is needs to be

905

unsecure unsecure so that we can plow on

907.72

with some of our other uh pages and

909.959

start building out the application and

911.36

just start cranking through this thing

913.24

if you have any questions shoot an email

914.48

to info@ developand door.com uh we're

917.079

going to keep chugging along here add

918.36

some new things a little bit conversions

920

here and there uh some's going to be

921.72

very straightforward and simple because

923.399

it's the nice stuff about building a

925.88

good Java application and doing an MVC

929.319

model and how you can very quickly make

931.079

some changes like this where're in a

933.8

sense re-platforming the whole thing but

936.88

it's not taking us a whole lot of work

939.6

that being said go out there and have

941

yourself a great day a great week and we

943.24

will talk to you next time hello this is

946.759

Rob with develop or also known as

948.72

building better developers wanted to

951.12

announce that we have school.

952.6

developer.com feel free to check it out

955.519

if you like any of this information any

958.16

of the cont content that we've sent and

959.48

you would like to see more you can come

961.199

out you can enroll for free we have free

963.399

courses we've got places for you to get

966.24

better at just learning a technology or

968.6

how toos you can work on your business

970.6

skills we can help you with becoming a

973.16

better developer as in coding and things

975.6

like that a lot of the stuff you've seen

977.24

on YouTube we also have out at school.

980.12

develop andur we have it a little more

982.16

of a uh educational format and a way for

984.72

you to track your progress as you move

987.24

forward becoming a better

991.6

[Music]

1005.36

developer