Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
64 changes: 43 additions & 21 deletions README.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -24,20 +24,20 @@ include::https://raw.githubusercontent.com/spring-guides/getting-started-macros/
[[scratch]]
== Starting with Spring Initializr

You can use this https://start.spring.io/#!type=maven-project&language=java&packaging=jar&jvmVersion=11&groupId=com.example&artifactId=securing-web&name=securing-web&description=Demo%20project%20for%20Spring%20Boot&packageName=com.example.securing-web&dependencies=web,thymeleaf[pre-initialized project] and click Generate to download a ZIP file. This project is configured to fit the examples in this tutorial.
You can use this https://start.spring.io/#!type=maven-project&packaging=jar&jvmVersion=17&groupId=com.example&artifactId=securing-web&name=securing-web&description=Demo%20project%20for%20Spring%20Boot&packageName=com.example.securingweb&dependencies=web,thymeleaf[pre-initialized project] and click Generate to download a ZIP file. This project is configured to fit the examples in this tutorial.

To manually initialize the project:

. Navigate to https://start.spring.io.
This service pulls in all the dependencies you need for an application and does most of the setup for you.
. Choose either Gradle or Maven and the language you want to use. This guide assumes that you chose Java.
. Choose either Gradle or Maven and the language you want to use: Kotlin or Java.
. Click *Dependencies* and select *Spring Web* and *Thymeleaf*.
. Click *Generate*.
. Download the resulting ZIP file, which is an archive of a web application that is configured with your choices.

NOTE: If your IDE has the Spring Initializr integration, you can complete this process from your IDE.

NOTE: You can also fork the project from Github and open it in your IDE or other editor.
NOTE: You can also fork the project from GitHub and open it in your IDE or other editor.

[[initial]]
== Create an Unsecured Web Application
Expand Down Expand Up @@ -68,15 +68,20 @@ include::initial/src/main/resources/templates/hello.html[]
====

The web application is based on Spring MVC. As a result, you need to configure Spring MVC
and set up view controllers to expose these templates. The following listing (from
`src/main/java/com/example/securingweb/MvcConfig.java`) shows a class that configures
and set up view controllers to expose these templates. The following listing shows a class that configures
Spring MVC in the application:

====
[source,java]
[source,java,indent=0,subs="verbatim,quotes",role="primary"]
.Java
----
include::initial/src/main/java/com/example/securingweb/MvcConfig.java[]
----
[source,kotlin,indent=0,subs="verbatim,quotes",role="secondary"]
.Kotlin
----
include::initial-kotlin/src/main/kotlin/com/example/securingweb/MvcConfig.kt[]
----
====

The `addViewControllers()` method (which overrides the method of the same name in
Expand Down Expand Up @@ -104,22 +109,34 @@ with "`basic`" authentication. However, you can further customize the security s
The first thing you need to do is add Spring Security to the classpath.

With Gradle, you need to add three lines (one for the application, one for Thymeleaf & Spring Security integration, and one for testing) in
the `dependencies` closure in `build.gradle`, as the following listing shows:
the `dependencies` section of your `build.gradle(.kts)` file, as the following listing shows:

====
[source,java]
[source,groovy,indent=0,subs="verbatim,quotes",role="primary"]
.Groovy (build.gradle)
----
include::complete/build.gradle[tags=security-dependencies,indent=0]
----
[source,kotlin,indent=0,subs="verbatim,quotes",role="secondary"]
.Kotlin (build.gradle.kts)
----
include::complete-kotlin/build.gradle.kts[tags=security-dependencies,indent=0]
----
====

The following listing shows the finished `build.gradle` file:
The following listing shows the finished `build.gradle(.kts)` file:

====
[source,text]
[source,groovy,indent=0,subs="verbatim,quotes",role="primary"]
.Groovy (build.gradle)
----
include::complete/build.gradle[tags=**]
----
[source,kotlin,indent=0,subs="verbatim,quotes",role="secondary"]
.Kotlin (build.gradle.kts)
----
include::complete-kotlin/build.gradle.kts[tags=**]
----
====

With Maven, you need to add two extra entries (one for the application and one for
Expand All @@ -141,15 +158,19 @@ include::complete/pom.xml[tags=**]
----
====

The following security configuration (from
`src/main/java/com/example/securingweb/WebSecurityConfig.java`)
ensures that only authenticated users can see the secret greeting:
The following security configuration ensures that only authenticated users can see the secret greeting:

====
[source,java]
[source,java,indent=0,subs="verbatim,quotes",role="primary"]
.Java
----
include::complete/src/main/java/com/example/securingweb/WebSecurityConfig.java[]
----
[source,kotlin,indent=0,subs="verbatim,quotes",role="secondary"]
.Kotlin
----
include::complete-kotlin/src/main/kotlin/com/example/securingweb/WebSecurityConfig.kt[]
----
====

The `WebSecurityConfig` class is annotated with `@EnableWebSecurity` to enable Spring
Expand Down Expand Up @@ -201,22 +222,23 @@ include::complete/src/main/resources/templates/hello.html[]
We display the username by using Thymeleaf's integration with Spring Security. The "`Sign Out`" form submits a POST to `/logout`.
Upon successfully logging out, it redirects the user to `/login?logout`.

NOTE: Thymeleaf 3.1 no longer provides access to `HttpServletRequest` so `HttpServletRequest#getRemoteUser()` cannot be used to access the currently authenticated user.


[[run_the_app]]
== Run the Application

The Spring Initializr creates an application class for you. In this case, you need not
modify the class. The following listing (from
`src/main/java/com/example/securingweb/SecuringWebApplication.java`) shows the application
class:
modify the class. The following listing shows the application class:

====
[source,java]
[source,java,indent=0,subs="verbatim,quotes",role="primary"]
.Java
----
include::complete/src/main/java/com/example/securingweb/SecuringWebApplication.java[]
----
[source,kotlin,indent=0,subs="verbatim,quotes",role="secondary"]
.Kotlin
----
include::complete-kotlin/src/main/kotlin/com/example/securingweb/SecuringWebApplication.kt[]
----
====

include::https://raw.githubusercontent.com/spring-guides/getting-started-macros/main/build_an_executable_jar_subhead.adoc[]
Expand Down
8 changes: 8 additions & 0 deletions complete-kotlin/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
.classpath
.gradle/
.project
.settings/
bin/
build/
target/
work/
37 changes: 37 additions & 0 deletions complete-kotlin/build.gradle.kts
Original file line number Diff line number Diff line change
@@ -0,0 +1,37 @@
plugins {
kotlin("jvm") version "1.9.25"
kotlin("plugin.spring") version "1.9.25"
id("org.springframework.boot") version "3.5.7"
id("io.spring.dependency-management") version "1.1.7"
}

group = "com.example"
version = "0.0.1-SNAPSHOT"
java.sourceCompatibility = JavaVersion.VERSION_17

repositories {
mavenCentral()
}

dependencies {
implementation("org.springframework.boot:spring-boot-starter-web")
implementation("org.springframework.boot:spring-boot-starter-thymeleaf")
implementation("org.jetbrains.kotlin:kotlin-reflect")
// tag::security-dependencies[]
implementation("org.springframework.boot:spring-boot-starter-security")
implementation("org.thymeleaf.extras:thymeleaf-extras-springsecurity6")
testImplementation("org.springframework.security:spring-security-test")
// end::security-dependencies[]
testImplementation("org.springframework.boot:spring-boot-starter-test")
}

kotlin {
jvmToolchain(17)
compilerOptions {
freeCompilerArgs.addAll("-Xjsr305=strict")
}
}

tasks.withType<Test> {
useJUnitPlatform()
}
Binary file added complete-kotlin/gradle/wrapper/gradle-wrapper.jar
Binary file not shown.
7 changes: 7 additions & 0 deletions complete-kotlin/gradle/wrapper/gradle-wrapper.properties
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
distributionBase=GRADLE_USER_HOME
distributionPath=wrapper/dists
distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
networkTimeout=10000
validateDistributionUrl=true
zipStoreBase=GRADLE_USER_HOME
zipStorePath=wrapper/dists
Loading