Giới thiệu và kiến trúc Spring Security

01-kien-truc-mac-dinh/
  pom.xml                       parent Boot 4.1.1, starter webmvc, security, test
  src/main/java/dev/canhdominich/boot/security/
    SecurityApplication.java    @SpringBootApplication, không có cấu hình bảo mật nào
    HelloController.java        GET /hello trả tên người dùng, POST /orders
    DefaultSecurityDemo.java    khởi động ứng dụng, gửi yêu cầu thật và in kết quả

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>4.1.1</version>
        <relativePath/>
    </parent>

    <groupId>dev.canhdominich.javabackend</groupId>
    <artifactId>security-default</artifactId>
    <version>1.0.0</version>
    <name>Spring Security - Kien truc va cau hinh mac dinh</name>

    <properties>
        <java.version>17</java.version>
        <main.class>dev.canhdominich.boot.security.DefaultSecurityDemo</main.class>
    </properties>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-webmvc</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>exec-maven-plugin</artifactId>
                <configuration>
                    <executable>java</executable>
                    <arguments>
                        <argument>-classpath</argument>
                        <classpath/>
                        <argument>${main.class}</argument>
                    </arguments>
                </configuration>
            </plugin>
        </plugins>
    </build>

</project>

package dev.canhdominich.boot.security;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class SecurityApplication {

    public static void main(String[] args) {
        SpringApplication.run(SecurityApplication.class, args);
    }
}

package dev.canhdominich.boot.security;

import java.security.Principal;
import java.util.Map;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class HelloController {

    @GetMapping("/hello")
    public Map<String, String> hello(Principal principal) {
        return Map.of("message", "hello " + principal.getName());
    }

    @PostMapping("/orders")
    public Map<String, String> create() {
        return Map.of("created", "yes");
    }
}

package dev.canhdominich.boot.security;

import java.io.ByteArrayOutputStream;
import java.io.PrintStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.util.ArrayList;
import java.util.Base64;
import java.util.List;
import java.util.Map;
import java.util.TreeSet;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.web.server.context.WebServerApplicationContext;
import org.springframework.context.ConfigurableApplicationContext;
import org.springframework.security.web.FilterChainProxy;

public class DefaultSecurityDemo {

    public static void main(String[] args) throws Exception {
        run();
    }

    public static List<String> run() throws Exception {
        List<String> lines = new ArrayList<>();
        PrintStream original = System.out;
        ByteArrayOutputStream captured = new ByteArrayOutputStream();
        SpringApplication application = new SpringApplication(SecurityApplication.class);
        application.setDefaultProperties(Map.of("server.port", "0", "spring.main.banner-mode", "off", "logging.level.root", "INFO"));
        ConfigurableApplicationContext context;
        System.setOut(new PrintStream(captured, true));
        try {
            context = application.run();
        } finally {
            System.setOut(original);
        }
        try (context) {
            Matcher matcher = Pattern.compile("Using generated security password: (\\S+)").matcher(captured.toString());
            String password = matcher.find() ? matcher.group(1) : "";
            lines.add("generated password logged at startup: " + (!password.isEmpty()) + " (a random UUID, " + password.length() + " characters)");
            lines.add("filters in the default chain: " + filterNames(context));
            int port = ((WebServerApplicationContext) context).getWebServer().getPort();
            String base = "http://127.0.0.1:" + port;
            HttpClient http = HttpClient.newBuilder().followRedirects(HttpClient.Redirect.NEVER).build();
            String basic = "Basic " + Base64.getEncoder().encodeToString(("user:" + password).getBytes());
            String wrong = "Basic " + Base64.getEncoder().encodeToString("user:wrong".getBytes());
            lines.add("-- who gets in");
            lines.add(send(http, "GET", base + "/hello", null, null));
            lines.add(send(http, "GET", base + "/hello", null, "text/html"));
            lines.add(send(http, "GET", base + "/hello", wrong, null));
            lines.add(send(http, "GET", base + "/hello", basic, null));
            lines.add(send(http, "GET", base + "/no-such-page", null, null));
            lines.add(send(http, "GET", base + "/no-such-page", basic, null));
            lines.add("-- headers added to an authenticated answer");
            HttpResponse<String> ok = http.send(HttpRequest.newBuilder(URI.create(base + "/hello")).header("Authorization", basic).GET().build(), HttpResponse.BodyHandlers.ofString());
            lines.add("response headers: " + new TreeSet<>(ok.headers().map().keySet().stream().filter(name -> !name.equalsIgnoreCase("date") && !name.equalsIgnoreCase("content-length") && !name.equalsIgnoreCase("keep-alive") && !name.equalsIgnoreCase("connection")).toList()));
            lines.add("-- CSRF protection on POST");
            lines.add(send(http, "POST", base + "/orders", basic, null));
            lines.add("-- the default login page and form login");
            HttpResponse<String> loginPage = http.send(HttpRequest.newBuilder(URI.create(base + "/login")).header("Accept", "text/html").GET().build(), HttpResponse.BodyHandlers.ofString());
            String cookie = loginPage.headers().firstValue("Set-Cookie").orElse("");
            Matcher token = Pattern.compile("name=\"_csrf\" type=\"hidden\" value=\"([^\"]+)\"").matcher(loginPage.body());
            String csrf = token.find() ? token.group(1) : "";
            lines.add("GET /login -> " + loginPage.statusCode() + ", form has username, password and _csrf fields: "
                    + (loginPage.body().contains("name=\"username\"") && loginPage.body().contains("name=\"password\"") && !csrf.isEmpty())
                    + ", session cookie attributes: " + cookieAttributes(cookie));
            String sessionCookie = cookie.split(";")[0];
            HttpResponse<String> badLogin = http.send(HttpRequest.newBuilder(URI.create(base + "/login"))
                    .header("Content-Type", "application/x-www-form-urlencoded").header("Cookie", sessionCookie)
                    .POST(HttpRequest.BodyPublishers.ofString("username=user&password=wrong&_csrf=" + csrf)).build(), HttpResponse.BodyHandlers.ofString());
            lines.add("POST /login with a wrong password -> " + badLogin.statusCode() + ", Location " + path(badLogin.headers().firstValue("Location").orElse("")));
            HttpResponse<String> login = http.send(HttpRequest.newBuilder(URI.create(base + "/login"))
                    .header("Content-Type", "application/x-www-form-urlencoded").header("Cookie", sessionCookie)
                    .POST(HttpRequest.BodyPublishers.ofString("username=user&password=" + password + "&_csrf=" + csrf)).build(), HttpResponse.BodyHandlers.ofString());
            String newCookie = login.headers().firstValue("Set-Cookie").map(c -> c.split(";")[0]).orElse(sessionCookie);
            lines.add("POST /login with the right password and the token -> " + login.statusCode() + ", Location " + path(login.headers().firstValue("Location").orElse("")) + ", session id changed: " + !newCookie.equals(sessionCookie));
            HttpResponse<String> afterLogin = http.send(HttpRequest.newBuilder(URI.create(base + "/hello")).header("Cookie", newCookie).GET().build(), HttpResponse.BodyHandlers.ofString());
            lines.add("GET /hello with only the session cookie -> " + afterLogin.statusCode() + " " + afterLogin.body());
            HttpResponse<String> postWithSession = http.send(HttpRequest.newBuilder(URI.create(base + "/orders")).header("Cookie", newCookie).POST(HttpRequest.BodyPublishers.noBody()).build(), HttpResponse.BodyHandlers.ofString());
            lines.add("POST /orders with the session cookie and no CSRF token -> " + postWithSession.statusCode());
        }
        lines.forEach(System.out::println);
        return lines;
    }

    private static String filterNames(ConfigurableApplicationContext context) {
        FilterChainProxy proxy = context.getBean(FilterChainProxy.class);
        List<String> names = new ArrayList<>();
        proxy.getFilterChains().get(0).getFilters().forEach(filter -> names.add(filter.getClass().getSimpleName()));
        return names.toString();
    }

    private static String cookieAttributes(String cookie) {
        List<String> attributes = new ArrayList<>();
        for (String part : cookie.split(";")) {
            String trimmed = part.trim();
            if (!trimmed.startsWith("JSESSIONID")) {
                attributes.add(trimmed);
            }
        }
        return attributes.toString();
    }

    private static String path(String location) {
        return location.isEmpty() ? "(none)" : URI.create(location).getPath() + (URI.create(location).getQuery() == null ? "" : "?" + URI.create(location).getQuery());
    }

    private static String send(HttpClient http, String method, String url, String authorization, String accept) throws Exception {
        HttpRequest.Builder builder = HttpRequest.newBuilder(URI.create(url)).method(method, HttpRequest.BodyPublishers.noBody());
        if (authorization != null) {
            builder.header("Authorization", authorization);
        }
        if (accept != null) {
            builder.header("Accept", accept);
        }
        HttpResponse<String> response = http.send(builder.build(), HttpResponse.BodyHandlers.ofString());
        StringBuilder out = new StringBuilder(method + " " + url.substring(url.indexOf("/", 8)) + (authorization == null ? " (no credentials)" : authorization.equals("") ? "" : (authorization.contains("dXNlcjp3cm9uZw==") ? " (wrong password)" : " (right password)")) + (accept == null ? "" : " Accept " + accept) + " -> " + response.statusCode());
        response.headers().firstValue("WWW-Authenticate").ifPresent(v -> out.append(", WWW-Authenticate: ").append(v));
        response.headers().firstValue("Location").ifPresent(v -> out.append(", Location: ").append(path(v)));
        if (response.statusCode() == 200) {
            out.append(", body ").append(response.body());
        }
        return out.toString();
    }
}

generated password logged at startup: true (a random UUID, 36 characters)
filters in the default chain: [DisableEncodeUrlFilter, WebAsyncManagerIntegrationFilter, SecurityContextHolderFilter, HeaderWriterFilter, CsrfFilter, LogoutFilter, UsernamePasswordAuthenticationFilter, DefaultResourcesFilter, DefaultLoginPageGeneratingFilter, DefaultLogoutPageGeneratingFilter, BasicAuthenticationFilter, RequestCacheAwareFilter, SecurityContextHolderAwareRequestFilter, AnonymousAuthenticationFilter, ExceptionTranslationFilter, AuthorizationFilter]
-- who gets in
GET /hello (no credentials) -> 401, WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
GET /hello (no credentials) Accept text/html -> 302, Location: /login
GET /hello (wrong password) -> 401, WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
GET /hello (right password) -> 200, body {"message":"hello user"}
GET /no-such-page (no credentials) -> 401, WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
GET /no-such-page (right password) -> 404
-- headers added to an authenticated answer
response headers: [cache-control, content-type, expires, pragma, x-content-type-options, x-frame-options, x-xss-protection]
-- CSRF protection on POST
POST /orders (right password) -> 401, WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
-- the default login page and form login
GET /login -> 200, form has username, password and _csrf fields: true, session cookie attributes: [Path=/, HttpOnly]
POST /login with a wrong password -> 302, Location /login?error
POST /login with the right password and the token -> 302, Location /, session id changed: true
GET /hello with only the session cookie -> 200 {"message":"hello user"}
POST /orders with the session cookie and no CSRF token -> 403