Cross Site Request Forgery and OAuth2

Engineering | Dave Syer | November 30, 2011 | ...

In this short article we look at Cross Site Request Forgery in the context of OAuth2, looking at possible attacks and how they can be countered when OAuth2 is being used to protect web resources.

OAuth2 is a protocol enabling a Client application, often a web application, to act on behalf of a User, but with the User’s permission. The actions a Client is allowed to perform are carried out on a Resource Server (another web application or web service), and the User approves the actions by telling an Authorization Server that he trusts the Client to do what it is asking. Common examples of Authorization Servers on the internet are Facebook and Google, both of which also provide Resource Servers (the Graph API in the case…

Video: SpringOne 2GX Keynote - Spring, Yesterday, Today and Tomorrow

News | Adam Fitzgerald | November 30, 2011 | ...

SpringOne 2GX 2011 Opening Keynote: Adrian Colyer

SpringOne 2GX 2011 was a phenomenal event and thanks to InfoQ, if you were not able to attend in person you can still see much of the content. The first video is from the Opening Night Keynote with Adrian Colyer. Adrian recaps the core principles underlying Spring and then surveys the development progress in the Data, Mobile, Social and Platform-as-a-Service spaces. Adrian also invites Graeme Rocher up to the stage to provide an update on Grails development. Derek Collison also makes a guest appearance to demonstrate some of the great features available in Cloud Foundry.

A shareable version of Adrian's slides are also available on our SpringOne 2GX 2011 Keynote Presentations page.

Many thanks to InfoQ for coming to Chicago to record so many of the fantastic SpringOne 2GX presentations.

Spring Roo 1.2.0.RC1 released

Engineering | Alan Stewart | November 24, 2011 | ...

The Spring Roo team is delighted to announce the availability of 1.2.0 Release Candidate 1. The Roo 1.2.0.RC1 release follows on from M1 and includes two exciting new features:

  • Multi-module Maven project support. This is the Roo community's most popular and most voted for feature (ROO-120). You can now create projects with a parent POM and as many project modules as you wish. For example, you can put your domain model in one module and separate out your UI code such as MVC or GWT, into their own modules.  Full documentation on this feature will be available in the general availability release of Roo 1.2.0 later this year.
  • JSF 2.0/PrimeFaces 3. The second most popular community feature and most asked for feature in the recent Roo survey - JSF 2.0/PrimeFaces support (ROO-516). You can now scaffold high-quality JSF applications utilizing the stunning components from the PrimeFaces 3.0 component library. Full round-tripping of code, switching between JSF 2.0 implementations (Oracle Mojarra or Apache MyFaces), and PrimeFaces theme selection via a Roo command are supported.

We have also enhanced our Roo annotations to give you more flexibility over the way you configure your persistence layer:

  • No need to have the "Active Record"-pattern persistence code in your domain objects any longer. The new @RooJpaEntity annotation ensures only the @Entity, @Id, and @Version fields and methods are created and maintained by Roo, with no CRUD methods. Classes annotated with @RooJpaEntity are intended to be used with Roo's JPA repository and service layering features.
  • The old @RooEntity annotation has been renamed to @RooJpaActiveRecord and is still the default when creating entities and will introduce the same CRUD methods as before.
  • Use RC1 in existing Roo projects? - easy, simply rename your @RooEntity annotations to @RooJpaActiveRecord and use the organize imports feature in STS or Eclipse to resolve the imports.
Please remember this is a release candidate release, so you should keep using Roo 1.1.5 for production projects. However, we encourage you to test this new release as we want to get 1.2.0.RELEASE to you as soon as possible.

We hope you enjoy this new release. Please share your experiences via the community forum, follow @SpringRoo for the latest news, or use #springroo in your tweets

Alan Stewart, Project Lead - Spring Roo

SpringSource Tool Suite 2.8.1 released

Releases | Martin Lippert | November 24, 2011 | ...

The SpringSource Tool Suite team is pleased to announce the new release 2.8.1 of the SpringSource Tool Suite (STS).

STS 2.8.1 is now compatible with the new Maven Integration as well as the old one. So updating your existing STS 2.7 or 2.8 version to STS 2.8.1 doesn't force you to also update the Maven Integration. Instead you can switch to the new Maven integration whenever you want - and even switch back to the old integration, if the new one doesn't work out for you. We automate this up- and downgrading of the Maven Integration as much as possible with two new items on the Dashboard. Please find more details in the New & Noteworthy and the updated m2e FAQ forum post.

The ready-to-use packages contain the new m2e 1.0 version, but you can easily switch them back to m2eclipse 0.12 using the Dashboard items, if you like.

Detailed installation instructions are also available. As always downloads are available from the STS download page.

 

This Week in Spring, November 22nd, 2011

Engineering | Josh Long | November 23, 2011 | ...

Welcome back to another installment of This Week in Spring. For those of us in the US, the Thanksgiving holiday is upon us.

Generally, the idea behind Thanksgiving (which has analogs in many other countries, as well) is to have a day to reflect on the things we are thankful for.

In that spirit, let me offer one of the things that I am thankful for: thank you, dear readers, for being part of the most awesome community out there. Between all the cool stuff you guys are doing and all the cool stuff happening at SpringSource, it is an absolute pleasure to put together this roundup every week. We…

Spring Integration 2.1 Release Candidate 1 is now available

Releases | Mark Fisher | November 23, 2011 | ...

We are pleased to announce that Spring Integration 2.1 Release Candidate 1 is now available. Release Notes | Documentation | Download

If you would like to grab the artifacts via Maven, please use the following repository and dependency configuration (and replace 'core' with any other modules you want to use, e.g. 'amqp', 'gemfire', 'http'):

<repository>     <id>repository.springframework.maven.milestone</id>     <name>Spring Framework Maven Milestone Repository</name>     <url>http://maven.springframework.org/milestone&lt;/url> </repository>

<dependency>     <groupId>org.springframework…

Video: Interview with Costin Leau from JavaOne 2011

News | Adam Fitzgerald | November 21, 2011 | ...

Video Interview with Costin Leau at JavaOne 2011

In this new video interview from InfoQ, Spring expert, Costin Leau talks about Spring Data, caching, data grid architectures and work on a new Spring Hadoop project. This interview, filmed last month at JavaOne 2011, provides some great background to how the Spring team has been thinking about data and how the emerging new models of data access can be incorporated seamlessly into your Spring applications.

Costin talks about :

  • Spring Data as an umbrella project
  • Transaction capabilities in the world of noSQL
  • Flexible caching integration in Spring
  • The current development work on Spring Hadoop

Many thanks to InfoQ for taking the time to talk to the Spring experts and providing this outstanding interview to the community.

Spring GemFire 1.1.0.RC1 Released for Java

Releases | Costin Leau | November 13, 2011 | ...

Dear Spring Community, We are pleased to announce the first release candidate of the Spring GemFire 1.1 project is now available! The Spring GemFire project aims to make it easier to build Spring-powered highly scalable applications using GemFire as distributed data management platform.

The updates in this release include:

  • Aligned Maven naming to Spring Data conventions (new ids are org.springframework.data/spring-data-gemfire)
  • Introduced PDX attributes on cache and client-cache namespace
  • Upgrade to GemFire 6.6.1
To learn more about the project, visit the Spring GemFire homepage.

Download it now: Spring GemFire for Java | Spring GemFire for .NET

We look forward to your feedback!

Spring Data Neo4j 2.0.0.RC1 released

Releases | Michael Hunger | November 12, 2011 | ...

Dear Spring Community,

The Spring Data Team and Neo Technology have just released the Release Candidate 1 of Spring Data Neo4j, the integration library for Neo4j the Enterprise NOSQL database.

Integrating the feedback from the very successful SpringOne 2011 and our community we exended the previous Milestone release with new functionality and took care of reported issues.

If you'd like to get an Introduction to Spring Data Neo4j, watch out for our presentations/webinars.

Changes

  • Updated Neo4j to 1.5 AspectJ to 1.6.12
  • Added repository support for the new Cypher-DSL (1.5.M1) (with QueryDSL support)
  • Updated cypher syntax changes for 1.5
  • Extended result-handling-dsl to allow changes of container classes
  • Added examples for hello-worlds and cypher for both mapping options
  • @RelationshipEntity has an fallback relationship-type attribute
  • Support for (mutable) @RelatedToVia collections (like Set)
  • Relationship-Entities can now be directly instantiated and persisted
  • Introduced the concept of a MappingPolicy for the POJO mapping mode (currently @Fetch)
  • Simplified cineasts using annotated and derived queries on repositories
  • Added repository for access of relationship-related methods
  • Improved support for collection properties
  • List, Set, Collection, Page as return types on derived and annotated query methods

This is the last step before the final release of the new major version, so we're looking for even more feedback to provide an excellent GA release of Spring Data Neo4j. Please provide it in the forum or the issue tracker.

Project resources: Downloads | Reference Card | JavaDocs | Spring Data Graph Guide Book | Changelog | GitHub Repository

Using Cloud Foundry Services with Spring: Part 4 – Spring Profiles

Engineering | Scott Andrews | November 10, 2011 | ...

Spring 3.1 adds significant new support for environments. This new Environment API makes it easy to expose properties to an application or conditionally load a fragment of configuration.

In an earlier post in this series, Ramnivas showed how Cloud Foundry can automatically connect to a database without manual configuration. When you need more control over this process, e.g. connecting to multiple databases, the cloud namespace condenses the configuration of a DataSource into just a single line of XML. The cloud namespace is powerful, but it is only supported for applications running in Cloud…

Get the Spring newsletter

Stay connected with the Spring newsletter

Subscribe

Get ahead

VMware offers training and certification to turbo-charge your progress.

Learn more

Get support

Tanzu Spring offers support and binaries for OpenJDK™, Spring, and Apache Tomcat® in one simple subscription.

Learn more

Upcoming events

Check out all the upcoming events in the Spring community.

View all