[callout title=Update]

This blog post is no longer maintained. Refer to the CSRF documentation for up to date information about Spring Security and CSRF protection.

On Monday I announced the release of Spring Security 3.2.0.RC1. This is the first of a two part blog series going over the new features found in Spring Security 3.2.0.RC1.

In this first entry, I will go over Spring Security's CSRF support. In the next post, I will go over the various security headers that have been added.

CSRF Attacks

Spring Security has added protection against Cross Site Request Forgery (CSRF) attacks. Great, but what is a CSRF attack and how can Spring Security protect me against it? Let's take a look at a concrete example to get a better…

Spring Security 3.2.0.RC1 is now available from the SpringSource repository at http://repo.springsource.org. See here for a quick tutorial on resolving these artifacts via Maven.

This release includes tons of updates and fixes. The highlights include:

Refer to Spring Security 3.2.0.RC1 preview for more details about this release.

SpringOne2GX

To learn about all the new features within Spring Security 3.2 attend my Getting Started with Spring Security 3.2 presentation at SpringOne2GX September 9-12, 2013. If you haven't already gotten your tickets, do so now before its too late!

Changelog | Download | Reference Manual | Guides | FAQ

In this post, I will discuss how to make your Spring Security Java configuration more readable. The post is intended to elaborate on a point from Spring Security Java Config Preview: Web Security where I stated:

By formatting our Java configuration code it is much easier to read. It can be read similar to the XML namespace equivalent where "and()" represents optionally closing an XML element.

Indentation

The indentation of Spring Security's Java configuration really impacts its readability. In general, indentation like a bullet list should be preferred.

For a more concrete example, take a…

This is the fourth post in my five part blog series that introduces Spring Security Java configuration. In this post, we will discuss how Spring Security Java configuration can be extended by walking through Spring Security OAuth Java configuration support.

Proof of Concept

While the Spring Security Java configuration works well for very basic configuration, it is just a proof of concept. We have not ensured that all the functionality available in the XML namespace is present within its Java configuration support. It was important to ensure that Spring Security's Java configuration would work…

Update

Users should refer to the Spring Security Reference which contains more up to date information.

Original Blog Post

This is the third installment of a four part blog series. In my first post, I introduced Spring Security Java configuration and discussed some of the logistics of the project. In my previous post, we walked through a few examples of configuring web based security.

In this post, I will discuss how to configure method based security using Spring Security Java configuration. Like our previous post, we will start off with a very basic example and follow it up with an example…

Update

Users should refer to the Spring Security Reference which contains more up to date information.

Original Blog Post

In my previous post, I introduced Spring Security Java configuration and discussed some of the logistics of the project. In this post, we will start off by walking through a very simple web security configuration. We will then spice things up a bit with configuration that has been customized some.

Hello Web Security

In this section we go through the most basic configuration for web based security. It can be broken into four steps:

• Updating your dependencies - we demonstrated this using Maven in our previous blog post
• Provide the Spring Security configuration - in our example this is done with a WebSecurityConfigurerAdapter
• Ensure the Spring Security configuration is loaded - in our example this is done with AbstractAnnotationConfigDispatcherServletInitializer
• Configure the springSecurityFilterChain - in our example this is done with AbstractSecurityWebApplicationInitializer
…

Yesterday I announced the release of Spring Security Java Configuration support and the release of Spring Security 3.2.0.M2 which contains Java Configuration support.

Spring Security's Java Configuration support is intended to provide a complete replacement of the XML namespace configuration. It is also designed to be extensible, so that Spring Security's extension projects can work nicely with the Java Configuration support.

In this first post of a five part Spring Security Java Configuration blog series, I discuss the logistics of the Spring Security Java Configuration project.

[callout title="Required Versions"]Regardless of how you decide to integrate with Spring Security, it is important to ensure you are using Spring 3.2.3.RELEASE+ to ensure that you avoid SPR-10546.[/callout]

Availability

Before we get started, I'd like to talk about the two modules that Spring Security's Java Configuration can be found.

Availability in Spring Security 3.2.0.M2+

Spring Security Java Configuration has been copied into the Spring Security 3.2.0.M2+ code base. This means if you are using Spring Security 3.2.0.M2+ you should ensure to have the spring-security-config jar on your classpath. For example, you might have the following…

I'm pleased to announce the release of Spring Security Java Configuration as a stand alone module. The milestone is compatible with Spring 3.2.3.RELEASE+ and Spring Security 3.1.4.RELEASE.

This code has been merged into Spring Security 3.2.0.M2 release and will be maintained within the Spring Security code base going forward. We hope that by making the release available for stable versions of Spring and Spring Security it will encourage you to try it sooner and provide us feedback before the final release.

Stay tuned to the SpringSource blog for an article that walks you through how to use Spring Security Java Configuration. In the mean time, you can find out how to obtain spring-security-javaconfig, documentation, and samples at http://github.com/SpringSource/spring-security-javaconfig…

I'd like to congratulate Vladimír Schäfer on the release of Spring Security SAML 1.0.0.RC2. Please use the links below for additional details.

Site | Download | Reference | Javadoc