Spring Security

Try it in 3 steps

1. 1

   Create a minimal Spring Boot 4.1.1 application

   Requires Java 17 or later, Maven 3.6.3 or later, Python 3, and curl. It creates public and protected routes in a temporary directory. demo/demo is a localhost-only demonstration credential.

   spring_demo_dir=$(mktemp -d "${TMPDIR:-/tmp}/spring-security-demo.XXXXXX") && cd "$spring_demo_dir" && printf '%s ' '<project xmlns="http://maven.apache.org/POM/4.0.0">' '<modelVersion>4.0.0</modelVersion>' '<parent><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-parent</artifactId><version>4.1.1</version><relativePath/></parent>' '<groupId>demo</groupId><artifactId>security-demo</artifactId><version>0.0.1</version>' '<properties><java.version>17</java.version></properties>' '<dependencies><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-web</artifactId></dependency><dependency><groupId>org.springframework.boot</groupId><artifactId>spring-boot-starter-security</artifactId></dependency></dependencies>' '<build><plugins><plugin><groupId>org.springframework.boot</groupId><artifactId>spring-boot-maven-plugin</artifactId></plugin></plugins></build>' '</project>' > pom.xmlCopy
2. 2

   Create the Java source and build

   In the same directory, create both routes and let the Spring Boot Maven Plugin repackage the build as an executable JAR. demo/demo is a localhost-only demonstration credential.

   mkdir -p src/main/java/demo && printf '%s ' 'package demo;' 'import org.springframework.boot.*;import org.springframework.boot.autoconfigure.*;import org.springframework.context.annotation.*;import org.springframework.security.config.annotation.web.builders.*;import org.springframework.security.core.userdetails.*;import org.springframework.security.provisioning.*;import org.springframework.security.web.*;import org.springframework.web.bind.annotation.*;' '@SpringBootApplication @RestController public class DemoApplication{' '@GetMapping("/public") String a(){return "public";} @GetMapping("/private") String b(){return "private";}' '@Bean SecurityFilterChain s(HttpSecurity h)throws Exception{return h.authorizeHttpRequests(a->a.requestMatchers("/public").permitAll().anyRequest().authenticated()).httpBasic(b->{}).build();}' '@Bean UserDetailsService u(){return new InMemoryUserDetailsManager(User.withUsername("demo").password("{noop}demo").roles("USER").build());}' 'public static void main(String[]a){SpringApplication.run(DemoApplication.class,a);}}' > src/main/java/demo/DemoApplication.java && mvn -q -DskipTests packageCopy
3. 3

   Verify the authentication flow on localhost

   Launch the executable JAR directly on an available loopback port and own that PID. After public 200, unauthenticated 401, and authenticated 200 checks, kill and wait for it and verify the port is closed. The isolated subshell preserves the caller trap.

   ( set -eu; port=$(python3 -c 'import socket; s=socket.socket(); s.bind(("127.0.0.1",0)); print(s.getsockname()[1]); s.close()'); app_pid=''; cleanup(){ if [ -n "$app_pid" ]; then kill "$app_pid" 2>/dev/null || true; wait "$app_pid" 2>/dev/null || true; fi; }; trap cleanup EXIT HUP INT TERM; java -jar target/security-demo-0.0.1.jar --server.address=127.0.0.1 --server.port="$port" > app.log 2>&1 & app_pid=$!; ready=0; i=0; while [ "$i" -lt 40 ]; do if curl --silent --max-time 1 "http://127.0.0.1:$port/public" > public.txt 2>/dev/null; then ready=1; break; fi; i=$((i+1)); sleep 0.25; done; [ "$ready" -eq 1 ]; [ "$(cat public.txt)" = public ]; code=$(curl --silent --output private-unauth.txt --write-out '%{http_code}' --max-time 2 "http://127.0.0.1:$port/private"); [ "$code" = 401 ]; [ "$(curl --silent --max-time 2 --user demo:demo "http://127.0.0.1:$port/private")" = private ]; cleanup; app_pid=''; python3 -c 'import errno,socket,sys; s=socket.socket(); s.settimeout(1); r=s.connect_ex(("127.0.0.1",int(sys.argv[1]))); raise SystemExit(0 if r==errno.ECONNREFUSED else 1)' "$port"; trap - EXIT HUP INT TERM; printf 'public=200 private_unauth=%s private_auth=200 stopped=true ' "$code" )Copy

Built with

• Java
• Spring Framework

Categories and tags

GitHub data

Share a guide or use case for this OSS in Markdown. Articles are published after administrator approval.

Explore next

• SuperTokens Core15,333 Stars

  2 shared tag(s) · 1 shared category(s) · Same language

  Self-host the authentication, session, and user-data core that frontend and backend SDKs call over HTTP

  Java
• Auth.js28,368 Stars

  2 shared tag(s) · 1 shared category(s)

  Compose OAuth/OIDC, passwordless, WebAuthn, and stateless or database-backed sessions from packages built around standard Web APIs

  TypeScript
• Devise24,355 Stars

  2 shared tag(s) · 1 shared category(s)

  compose Rails authentication workflows from modular features on top of Warden

  Ruby
• Cosmos Server6,174 Stars

  2 shared tag(s) · 1 shared category(s)

  manage home-server apps, access, protection, and backups together

  Go
• Passbolt6,147 Stars

  2 shared tag(s) · 1 shared category(s)

  share and audit team credentials with user-owned keys and end-to-end encryption

  PHP
• SPIRE2,569 Stars

  2 shared tag(s) · 1 shared category(s)

  attest running workloads and issue short-lived SVID credentials bound to SPIFFE identities

  Go