[Part 1] First Step

▣ Chapter 1: Today's Security
1.1 Spring Security: Concepts and Benefits
1.2 What is software security?
1.3 Why is security important?
1.4 Common Security Vulnerabilities in Web Applications
__1.4.1 Vulnerabilities in Authentication and Authorization
__1.4.2 What is session stickiness?
__1.4.3 What is XSS (Cross-Site Scripting)?
__1.4.4 What is CSRF (Cross-Site Request Forgery)?
__1.4.5 Understanding Injection Vulnerabilities in Web Applications
__1.4.6 Handling the Exposure of Sensitive Data
__1.4.7 What is lack of method access control?
__1.4.8 Exploiting a dependency with a known vulnerability
1.5 Security applied to various architectures
__1.5.1 Designing an All-in-One Web Application
__1.5.2 Security Design for Backend/Frontend Separation
__1.5.3 Understanding the OAuth 2 Flow
__1.5.4 Securing requests using API keys, cryptographic signatures, and IP verification
1.6 What you will learn in this book
summation

▣ Chapter 2: Hello! Spring Security
2.1 Starting your first project
2.2 What is the basic configuration?
2.3 Redefining the basic configuration
__2.3.1 Overriding the UserDetailsService component
__2.3.2 Overriding Endpoint Authorization Configuration
__2.3.3 Configuring in other ways
__2.3.4 Overriding AuthenticationProvider Implementation
__2.3.5 Using multiple configuration classes in a project
summation

[Part 2] Implementation

▣ Chapter 3: User Management
3.1 Implementing Authentication in Spring Security
3.2 User Description
__3.2.1 Understanding the UserDetails Contract Definition
__3.2.2 Examining the GrantedAuthority Contract
__3.2.3 Writing a minimal UserDetails implementation
__3.2.4 Creating an instance of the UserDetails type using a builder
__3.2.5 Combining Multiple User-Related Responsibilities
3.3 Specifying how Spring Security manages users
__3.3.1 Understanding the UserDetailsService Contract
__3.3.2 Implementing the UserDetailsService Contract
__3.3.3 Implementing the UserDetailsManager Contract
summation

▣ Chapter 4: Password Processing
4.1 Understanding the PasswordEncoder Contract
__4.1.1 Definition of the PasswordEncoder Contract
__4.1.2 Implementing the PasswordEncoder Contract
__4.1.3 Selecting a Provided Implementation of PasswordEncoder
__4.1.4 Multiple Encoding Strategies Using DelegatingPasswordEncoder
4.2 Additional Information About the Spring Security Encryption Module
__4.2.1 Using the key generator
__4.2.2 Using a cryptographic machine for encryption and decryption
summation

▣ Chapter 5: Authentication Implementation
5.1 Understanding AuthenticationProvider
__5.1.1 Displaying requests during the authentication process
__5.1.2 Implementing Custom Authentication Logic
__5.1.3 Applying custom authentication logic
5.2 Using SecurityContext
__5.2.1 Using a retention strategy for security context
__5.2.2 Using a retention strategy for asynchronous calls
__5.2.3 Using a Retention Strategy for Standalone Applications
__5.2.4 Passing security context with DelegatingSecurityContextRunnable
__5.2.5 DelegatingSecurityContextExecutorServi
Passing security context
5.3 Understanding HTTP Basic Authentication and Form-Based Login Authentication
__5.3.1 HTTP Basic Usage and Configuration
__5.3.2 Implementing authentication using form-based login
summation

▣ Chapter 6: Practice - Small and Secure Web Applications
6.1 Project Requirements and Settings
6.2 Implementing User Management
6.3 Implementing Custom Authentication Logic
6.4 Implementing the main page
6.5 Running and Testing the Application
summation

▣ Chapter 7: Configuring Authorization - Access Restrictions
7.1 Restricting access based on permissions and roles
__7.1.1 Restrict access to all endpoints based on user permissions
__7.1.2 Restrict access to all endpoints based on user roles
__7.1.3 Restrict access to all endpoints
summation

▣ Chapter 8: Configuring Authorization - Applying Restrictions
8.1 Selecting endpoints with selector methods
8.2 Selecting Requests to Authorize with MVC Selectors
8.3 Selecting requests to authorize with the Ant selector
8.4 Selecting requests to authorize with regular expression selectors
summation

▣ Chapter 9: Filter Implementation
9.1 Implementing Filters in the Spring Security Architecture
9.2 Adding a filter before an existing filter in the chain
9.3 Adding a filter after an existing filter in a chain
9.4 Adding filters to other filter positions in the filter chain
9.5 Implementing Filters Provided by Spring Security
summation

▣ Chapter 10: CSRF Protection and CORS Implementation
10.1 Applying Cross-Site Request Forgery (CSRF) Protection to Your Application
__10.1.1 How Spring Security's CSRF Protection Works
__10.1.2 Using CSRF Protection in Real-World Scenarios
__10.1.3 Customizing CSRF Protection
10.2 Using CORS (Cross-Origin Resource Sharing)
__10.2.1 How CORS Works
__10.2.2 Applying CORS policy with the @CrossOrigin annotation
__10.2.3 Applying CORS with CorsConfigurer
summation

▣ Chapter 11: Practice - Separation of Responsibilities
11.1 Example Scenario and Requirements
11.2 Implementation and Use of Tokens
__11.2.1 What is a token?
__11.2.2 What is a JSON Web Token?
11.3 Implementing an Authentication Server
11.4 Implementing a Business Logic Server
__11.4.1 Implementing the Authentication Object
__11.4.2 Proxy implementation for authentication server
__11.4.3 Implementing the AuthenticationProvider interface
__11.4.4 Filter Implementation
__11.4.5 Creating a Security Configuration
__11.4.6 Full System Test
summation

▣ Chapter 12: How OAuth 2 Works
12.1 OAuth 2 Framework
12.2 Components of the OAuth 2 Authentication Architecture
12.3 Choosing How to Implement OAuth 2
__12.3.1 Implementation of the Authorization Code Grant Type
__12.3.2 Implementing the Password Grant Type
__12.3.3 Implementing the Client Credentials Grant Type
__12.3.4 Obtaining a new access token with a refresh token
12.4 Vulnerabilities in OAuth 2
12.5 Implementing a Simple Single Sign-On Application
__12.5.1 Authorization Server Management
__12.5.2 Implementation Start
__12.5.3 Implementing ClientRegistration
__12.5.4 Implementing ClientRegistrationRepository
__12.5.5 The Pure Magic of Spring Boot Configuration
__12.5.6 Getting details of an authenticated user
__12.5.7 Application Testing
summation

▣ Chapter 13: OAuth 2 - Implementing an Authorization Server
13.1 Writing a Custom Authorization Server Implementation
13.2 Defining User Management
13.3 Registering a Client with the Authorization Server
13.4 Using the Password Grant Type
13.5 Using the Approval Code Grant Type
13.6 Using the Client Credentials Grant Type
13.7 Using the Renewal Token Grant Type
summation

▣ Chapter 14: OAuth 2 - Implementing a Resource Server
14.1 Implementing a Resource Server
14.2 Remotely verifying tokens
14.3 Implementing Database References with JdbcTokenStore
A simple comparison of the 14.4 methods
summation

▣ Chapter 15 OAuth 2 - Using JWT and Cryptographic Signatures
15.1 Using tokens signed with a symmetric key in JWT
15.1.1 Using JWT
__15.1.2 Implementing an authorization server that issues JWTs
__15.1.3 Implementing a resource server using JWT
15.2 Using tokens signed with asymmetric keys using JWT
__15.2.1 Generating a Key Pair
__15.2.2 Configuring an Authorization Server Using a Secret Key
__15.2.3 Implementing a Resource Server Using Public Keys
__15.2.4 Using an endpoint that exposes a public key
15.3 Adding Custom Details to a JWT
__15.3.1 Configuring the Authorization Server to Add Custom Details to the Token
__15.3.2 Configuring the resource server to read custom details from a JWT
summation

▣ Chapter 16: Global Method Security - Pre- and Post-Authorization
16.1 Enabling Global Method Security
__16.1.1 Understanding Call Authorization
__16.1.2 Enabling global method security in a project
16.2 Applying Pre-Authorization to Permissions and Roles
16.3 Post-Authorization Application
Implementing Permissions for Method 16.4
summation

▣ Chapter 17: Global Method Security - Pre- and Post-Filtering
17.1 Applying Pre-Filtering for Method Authorization
17.2 Applying Post-Filtering for Method Authorization
17.3 Using Filtering in Spring Data Repositories
summation

▣ Chapter 18: Practice - OAuth 2 Application
18.1 Application Scenarios
18.2 Configuring Keycloak as an Authorization Server
__18.2.1 Registering a client in the system
__18.2.2 Client Scoping
__18.2.3 Adding a User and Obtaining an Access Token
__18.2.4 Defining User Roles
18.3 Implementing a Resource Server
18.4 Application Testing
__18.4.1 Proving that users can only add their own records
__18.4.2 Proving that users can only retrieve their own records
__18.4.3 Verify that only administrators can delete records
summation

▣ Chapter 19: Spring Security for Reactive Apps
19.1 What is a reactive app?
19.2 User Management in Reactive Apps
19.3 Configuring Authorization Rules in Reactive Apps
__19.3.1 Applying Authorization to the Endpoint Layer of a Reactive App
__19.3.2 Applying Method Security to Reactive Apps
19.4 Reactive Apps and OAuth 2
summation

▣ Chapter 20: Spring Security Testing
20.1 Testing with mock users
20.2 Testing as a UserDetailsService User
20.3 Testing with Custom Authentication Objects
20.4 Method Security Testing
20.5 Certification Test
20.6 Testing CSRF Configuration
20.7 Testing CORS Configuration
20.8 Testing a Reactive Spring Security Implementation
summation

▣ Appendix A: Creating a Spring Boot Project
A.1 Creating a Project with start.spring.io
A.2 Creating a Project with STS (Spring Tool Suite)

★ What this book covers ★

◎ Password encoding and user authentication
◎ Endpoint Protection
◎ Security Test Automation
◎ Setting up a standalone authorization server