In this short article we look at Cross Site Request Forgery in the context of OAuth2, looking at possible attacks and how they can be countered when OAuth2 is being used to protect web resources.

OAuth2 is a protocol enabling a Client application, often a web application, to act on behalf of a User, but with the User’s permission. The actions a Client is allowed to perform are carried out on a Resource Server (another web application or web service), and the User approves the actions by telling an Authorization Server that he trusts the Client to do what it is asking. Common examples of Authorization Servers on the internet are Facebook and Google, both of which also provide Resource Servers (the Graph API in the case…

The Spring Roo team is delighted to announce the availability of 1.2.0 Release Candidate 1. The Roo 1.2.0.RC1 release follows on from M1 and includes two exciting new features:

• Multi-module Maven project support. This is the Roo community's most popular and most voted for feature (ROO-120). You can now create projects with a parent POM and as many project modules as you wish. For example, you can put your domain model in one module and separate out your UI code such as MVC or GWT, into their own modules.  Full documentation on this feature will be available in the general availability release of Roo 1.2.0 later this year.
• JSF 2.0/PrimeFaces 3. The second most popular community feature and most asked for feature in the recent Roo survey - JSF 2.0/PrimeFaces support (ROO-516). You can now scaffold high-quality JSF applications utilizing the stunning components from the PrimeFaces 3.0 component library. Full round-tripping of code, switching between JSF 2.0 implementations (Oracle Mojarra or Apache MyFaces), and PrimeFaces theme selection via a Roo command are supported.

We have also enhanced our Roo annotations to give you more flexibility over the way you configure your persistence layer:

• No need to have the "Active Record"-pattern persistence code in your domain objects any longer. The new @RooJpaEntity annotation ensures only the @Entity, @Id, and @Version fields and methods are created and maintained by Roo, with no CRUD methods. Classes annotated with @RooJpaEntity are intended to be used with Roo's JPA repository and service layering features.
• The old @RooEntity annotation has been renamed to @RooJpaActiveRecord and is still the default when creating entities and will introduce the same CRUD methods as before.
• Use RC1 in existing Roo projects? - easy, simply rename your @RooEntity annotations to @RooJpaActiveRecord and use the organize imports feature in STS or Eclipse to resolve the imports.

We hope you enjoy this new release. Please share your experiences via the community forum, follow @SpringRoo for the latest news, or use #springroo in your tweets

Alan Stewart, Project Lead - Spring Roo

Welcome back to another installment of This Week in Spring. For those of us in the US, the Thanksgiving holiday is upon us.

Generally, the idea behind Thanksgiving (which has analogs in many other countries, as well) is to have a day to reflect on the things we are thankful for.

In that spirit, let me offer one of the things that I am thankful for: thank you, dear readers, for being part of the most awesome community out there. Between all the cool stuff you guys are doing and all the cool stuff happening at SpringSource, it is an absolute pleasure to put together this roundup every week. We…

Spring 3.1 adds significant new support for environments. This new Environment API makes it easy to expose properties to an application or conditionally load a fragment of configuration.

In an earlier post in this series, Ramnivas showed how Cloud Foundry can automatically connect to a database without manual configuration. When you need more control over this process, e.g. connecting to multiple databases, the cloud namespace condenses the configuration of a DataSource into just a single line of XML. The cloud namespace is powerful, but it is only supported for applications running in Cloud…

Another fantastic week in the Spring community. Can you guys believe it's already the 8th of November? Where does the time go?

If you blink, we'll be in 2012 already! 
No time to waste - the year might change out from underneath us! - let's dive right into this week's roundup!

1. Ramnivas Laddad, senior engineer on the Cloud Foundry project and a hero world wide to those who - like me - enjoy the use of AspectJ in their Spring applications, has put together a fantastic post shining a light on the specific support for services (like MySQL, PostgreSQL, and RabbitMQ) in Cloud Foundry. This is the second post in a series. Read the first one to learn about the basics of services on Cloud Foundry. Awesome posts with great details.
2. This next post is among the posts that made me smile this week. Roy Clarkson and I did a talk at SpringOne 2GX a few weeks ago on native Android development practices with Spring. We sat down the night before our talk and ran through our deck and demonstrations, only to realize that - in the interim weeks since everything was originally prepared, the delicate spider's web of configuration required to get Eclipse (SpringSource Tool Suite), Maven, and Android all speaking to each other and working correctly had been... disturbed. We did the talk with a non-Maven build with great success, but it still irked us that we had to switch to a regular Eclipse build so that the talk could proceed. Roy, always intrepid and fearless, has since figured out the right permutations of configurations required to get this all working again and - generous guy that he is - he has documented everything in this blog. Check it out! (I know I did!)
3. Tomcat Expert has another practical column on administering and developing with Apache Tomcat 7. The post explains how to take the default security configuration Apache Tomcat 7 to the next level with a bit of background on the configuration options available.

   </LI> 
   
   
   
   <LI> Roger Hughes <a href="http://java.dzone.com/articles/using-jsr-250s-postconstruct">introduces how to use JSR 250's <CODE>@PostConstruct</CODE> and <CODE>@PreDestroy</CODE> annotations</A> to replace the use of the corresponding Spring  callback interfaces, <CODE>InitializingBean</CODE> and <CODE>DisposableBean</CODE>.   </LI> 
   
   <LI>Michal Huniewicz explains <a href= "http://blog.m1key.me/2011/10/wizard-form-with-spring-mvc…

We saw in the previous blog post Using Cloud Foundry Services with Spring: Part 2 - Auto-reconfiguration that when you deploy a Spring application, your use of data services will be detected, and your application will automatically be re-configured to use the cloud services available to your application. This works great for simple applications and demos, but if you have a serious production application you probably want to have more control. You also need more control if you have multiple services of the same type. Ramnivas hinted at this saying that you can opt out of auto-reconfiguration by…

It has been a while since my initial posts on using Maven with Spring Android, and the state of the tools has changed somewhat. With the recent release of the SDK for Android 4.0 and revision 14 of the Android Development Tools (ADT), Google made several changes that impacted the third party Maven plugin support for building Android projects. Fortunately, the teams behind the Android Maven Plugin, and the Android Configurator for M2E have been hard at work to support these latest changes in the Android tools. If you have tried to run the Spring Android Samples recently, then you probably noticed the projects would not build. In this post, I will illustrate the configuration changes necessary to utilize the latest Maven plugins and Eclipse support in the Spring Android Showcase project.

Android Maven Plugin

As of version 3.0.0-alpha-11, The Maven Android Plugin now has a new name, and is now called the Android Maven Plugin. The latest version, 3.0.0-alpha-13 fixes the build issue with Android SDK r14.

Update the Plugin

To update your plugin version, make the following changes to the artifactId and version.

<plugin>
    <groupId>com.jayway.maven.plugins.android.generation2</groupId>
    <artifactId>android-maven-plugin</artifactId>
    <version>3.0.0-alpha-13</version>
    <configuration>
        <sdk>
            <platform>${android-platform}</platform>
        </sdk>
        <deleteConflictingFiles>true</deleteConflictingFiles>
        <undeployBeforeDeploy>true</undeployBeforeDeploy>
    </configuration>
    <extensions>true</extensions>
</plugin>

Once modified, you can now run maven from the command line to build your project.

mvn clean install

Potential Build Errors

It is possible that your project will receive a few build errors when you try to build with the new plugin.

java.lang.OutOfMemoryError

When I updated the Spring Android Showcase client, the build failed with the following:

[INFO] UNEXPECTED TOP-LEVEL ERROR:
[INFO] java.lang.OutOfMemoryError: Java heap space
[INFO] 	at com.android.dx.ssa…

If you watched the video for the Cloud Foundry launch event, you saw that we deployed the Spring Travel application downloaded from Spring Web Flow samples, bound a MySQL service to it, and dragged and dropped the application to the Cloud Foundry server in STS, without making a single line of change in the application itself. How’s that possible since the application is configured to use a local database? That’s when auto-reconfiguration comes into play.

Cloud Foundry strives to keep your initial investment low. Beyond dollars and cents, a real investment comes from the time that a developer…

Wow! Last week's SpringOne 2GX event was sensational. It was an amazing time, and it was - as usual - great to see the Spring community going so strong. I can't wait until the videos from the event start to appear on InfoQ.com.

We've got a lot to cover this week, though, so let's get into it!
 </P> 

<Li> 

Don't tell anyone, but even if you missed SpringOne 2GX, the decks for all the talks should be on SpringOne2GX.com, and the videos for all the talks will be on InfoQ.com soon.

To tide you over in the short term, the deck from SpringSource CTO Adrian Colyer's keynote - "Spring yesterday, today, and tomorrow" - is available online. Thanks Adrian!

 <LI>
 One of the many big announcements that came from the SpringOne2GX event was	 that of <a href= "http://neo4j.org/spring/">Neo4j 2.0</a>. 
        If you're…