How can i secure web sockets using spring security? - spring-boot

I'm trying to implement a notification service for my final project. therefore I want to know how to send data to specific users through a socket.

Related

Spring boot server client request with timeout

I've been developing online ordering application that a customer order using his/her mobile application and the service provider got the order in realtime but the challenge is that I want the order to be cancelled if the service provider didn't accept the order within a specified time span. How to make it happen using spring boot technologies?
this is the architecture of the system I'm trying to achieve plus the request is synchronous

Do I need to do authentication during the message transfer

I need to use activemq to communicate between micro-service and the system has access control to limit the user action. I already check the user from restful endpoint by spring security. After authentication, I send message to queue. Do I need to verify the user again? If yes, how can I pass the user credential by activemq.
If it is microservices architecture already. And as what you said you have an authentication/Authorization micro-service then there is no point duplicating the checks all over again.
The best approach is to let the Gateway-Service do the authentication/authorization thing.
Usually it is bound to the Zuul implementing service. So that all calls to specific service URL got intercepted by that gateway and apply whatever security policies you have

Mutiple controllers mapped to one Spring websocket

I have a question related to Spring websockets with the STOMP protocol over it.
I'm using websockets for different application but not with the combination of Spring.
I have a client server application that holds multiple websockets connections to the server. Now can I create a client application that connects to the Websocket of Spring (with STOMP). Also can I map one websocket to multiple controllers in Spring? The data for every controller is different. So for example my client sends data to the server and set something a value to say, the data need to be send to controller X. Can Spring automaticly transfer the data to the correct controller?
The image below show a POC for my question. The client does send different messages to the Spring server using a websocket connection. Now for every message the controller need to be changed. So for example for message X the controller X need to handle the request and for message Y the controller Y need to handle the request.
How can I achieve this using Spring websockets using STOMP?
You need use microservices and Spring Cloud. https://spring.io/blog/2015/07/14/microservices-with-spring
The main WebServer need connect to other servers with different functionalities. It is a transactional services.

what's the best way to secure rest web services using spring?

What is the Best way to secure REST Services (develop by Spring Framework) for use in Android app? Please consider the limitation of httpclient in android. using http authentication header is enough?
My need is to be able to control which application is calling my web service and is this application authorized to call it.

Spring Security for RESTful webservice

I am developing a RESTful web service as a back-end layer for mobile application. This service receives combination of device id (as user id) an a pin (as password), and passes to another back-end service, that validates and returns the status of successful login along the user information, in case, the user is authorized. My service is not validating the user. And mobile sends sub sequent requests to my RESTful service.
So, please suggest, how can I make all this system(especially the RESTful) secured, using Spring security.
I am using a Tomcat server, Spring and Jersey
I recently implemented a method to secure my existing RESTful APIs in Spring. I have used a token based authentication model using OAuth2. In my project, I wanted to secure my API's in a way that every request is individually authenticated and authorised based on the token present in the header. If this is something you are looking for, then I would highly recommend you to take a look at the documentation here. If there is anything you are stuck at while implementing it. Please do let me know.
Also, you can find multiple projects for Spring and OAuth here

Resources