We use Spring Boot for OAUTH2 implementation which is very good in supporting all kinds of grants and follow the standards.
We would to like Refresh token rotation as below to use in Single Page Application
https://auth0.com/docs/secure/tokens/refresh-tokens/refresh-token-rotation
I know the default spring boot doesn't support it. Is there any way to support this feature with existing Spring security.
Related
I am developing a client application for client_credentials grant type flow in OAUTH2.
I am not able to decide on which dependency to use in my project for this purpose among the following.
spring-boot-starter-oauth2-client
spring-cloud-starter-oauth2
spring-security-oauth2
I referred this documentation from spring-projects in which under client-support section it had a table describing the available options. But I am not able to understand which column is referring to which of the above dependencies.
I want to configure a WebClient or RestTemplate which retrieves the OAUTH2 token from the auth-server automatically before accessing a resource-server.
Please guide me in choosing the right artifact for my project.
If you are using Spring Boot you should choose org.springframework.boot:spring-boot-starter-oauth2-client.
This includes Spring Security's OAuth 2.0 Client support and provides Spring Boot auto-configuration to set up OAuth2/Open ID Connect clients.
You can read about how to configure client in the Spring Boot reference documentation.
You can also find additional details in the Spring Security reference documentation.
If you are not using Spring Boot then you should choose org.springframework.security:spring-security-oauth2-client. This also provides Spring Security's latest OAuth 2.0 Client support, but does not include the Spring Boot auto-configuration.
The corresponding documentation is also the Spring Security reference documentation.
The third dependency you mentioned org.springframework.security.oauth:spring-security-oauth2 should not be used because it is part of the legacy Spring Security OAuth project, which is now deprecated.
The functionality that this library provided has now been moved into Spring Security.
That is what the Migration Guide describes, the migration from the legacy project to the latest Spring Security support.
You should not use the org.springframework.cloud:spring-cloud-starter-oauth2 at this time, because it relies on the legacy OAuth support.
This is likely to change in the future, as the Spring Cloud team updates to the latest Spring Security support.
We have a REST API using Spring MVC that doesn't use Spring Security or Spring Boot. The rest API url is {domain}/product/rest/v1/{controller}. We also have a regular web GUI using Struts2 that is just at {domain}/product/{action}.
We're currently researching autogenerating API documentation using Springfox-swagger and springfox-swagger-ui. It was fairly easy to get Swagger to work using minimal configuration, but the problem is that Springfox by default tries to do a CRSF token request, which we don't use in the rest API. I've googled how to disable this, but every article I can find talks about how to disable it using the Spring Security WebSecurityConfigurationManager. We don't use Spring Security and would rather not have to add it.
Is there a way to disable the Springfox Swaggger UI CSRF token check without using Spring Security or Spring Boot?
For disable the csrf () you need to add spring security in your project follows these link how to disable csrf() in spring.
https://docs.spring.io/spring-security/site/docs/5.0.x/reference/html/csrf.html
I was wondering if Spring Boot SSO implementation is based on JWT or keeps the session open in the server memory?
Thanks in advance.
The answer would depend on which Spring implementation you are referring to
Spring Security SAML
Spring Security OAuth
I would discuss more on the latter i.e. OAuth and in that you have multiple options. You can use the in-memory token store to debug and test it out, but for production implementations, you can use different token stores. JWT and JDBC are pretty popular in my experience.
currently am Creating Rest Apis in Spring Boot I want to secure Those Apis Using Okta Wit Oauth.
Can Any one Help On this....
You can use Okta's Spring Boot Starter for this. https://github.com/okta/okta-spring-boot
Warning: there is an issue where you can't use devtools with this starter.
I am using Spring Boot with Spring Session for storing session data. Users log in to the application with Spring Social. As a result, the saved security context has a SocialAuthenticationToken. This means that other web apps sharing the session data need to use Spring Social and also have access to the social tokens.
What I'd like to do is save the sessionAttr:SPRING_SECURITY_CONTEXT with a token that is available through Spring Security only. Furthermore, I'd like to add a second Redis key for the social information.
Where are the extension points for adding this kind of customization to Spring Session? I would like it to be as unobtrusive as possible.