CtrlK
BlogDocsLog inGet started
Tessl Logo

tessl/maven-org-springframework-security--spring-security-web

Spring Security Web module provides comprehensive web security features for Spring-based applications, including servlet-based authentication, authorization, CSRF protection, session management, and security filter chain implementation

—

Pending
Quality

Pending

Does it follow best practices?

Impact

Pending

No eval scenarios have been run

SecuritybySnyk

Pending

The risk profile of this skill

Overview
Eval results
Files

Spring Security Web

Spring Security Web module provides comprehensive web security features for Spring-based applications, including servlet-based authentication, authorization, CSRF protection, session management, and security filter chain implementation. It serves as the core web security infrastructure for both traditional servlet-based and reactive Spring applications.

Package Information

  • Package Name: org.springframework.security:spring-security-web

  • Package Type: Maven

  • Language: Java

  • Installation:

    Maven:

    <dependency>
  <groupId>org.springframework.security</groupId>
  <artifactId>spring-security-web</artifactId>
  <version>6.5.1</version>
</dependency>

    Gradle:

    implementation 'org.springframework.security:spring-security-web:6.5.1'

Core Imports

import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.security.web.csrf.CsrfFilter;
import org.springframework.security.web.context.SecurityContextRepository;

Basic Usage

import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint;
import org.springframework.security.web.csrf.CsrfFilter;
import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;

// Basic filter chain configuration
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/login", "/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
            )
            .csrf(csrf -> csrf
                .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
            )
            .build();
    }
}

// Manual filter chain setup
List<Filter> filters = Arrays.asList(
    new SecurityContextHolderFilter(new HttpSessionSecurityContextRepository()),
    new CsrfFilter(new HttpSessionCsrfTokenRepository()),
    new UsernamePasswordAuthenticationFilter()
);

SecurityFilterChain chain = new DefaultSecurityFilterChain(
    new AntPathRequestMatcher("/**"), 
    filters
);

FilterChainProxy proxy = new FilterChainProxy(chain);

Architecture

Spring Security Web is built around a filter chain architecture that processes HTTP requests through a series of security filters. Key architectural components:

  • Filter Chain Proxy: Central dispatcher that manages multiple security filter chains
  • Security Filter Chains: Collections of filters that handle specific security concerns
  • Authentication Framework: Pluggable authentication mechanisms and handlers
  • Authorization Framework: Access control and privilege evaluation
  • Security Context Management: Thread-safe security context storage and retrieval
  • CSRF Protection: Cross-site request forgery prevention
  • Session Management: HTTP session security controls
  • Reactive Support: WebFlux integration for reactive applications

Capabilities

Core Filter Chain Infrastructure

The foundation of Spring Security's web security, providing filter chain management and request processing orchestration.

public interface SecurityFilterChain {
    boolean matches(HttpServletRequest request);
    List<Filter> getFilters();
}

public class FilterChainProxy extends GenericFilterBean {
    public FilterChainProxy(List<SecurityFilterChain> filterChains);
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain);
    public List<SecurityFilterChain> getFilterChains();
    public void setFirewall(HttpFirewall firewall);
}

public class DefaultSecurityFilterChain implements SecurityFilterChain {
    public DefaultSecurityFilterChain(RequestMatcher requestMatcher, Filter... filters);
    public DefaultSecurityFilterChain(RequestMatcher requestMatcher, List<Filter> filters);
}

Filter Chain and Security Infrastructure

Authentication Framework

Comprehensive authentication mechanisms including form-based, HTTP Basic, and pluggable authentication converters.

public interface AuthenticationSuccessHandler {
    void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response, 
                                Authentication authentication) throws IOException, ServletException;
}

public interface AuthenticationFailureHandler {
    void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response, 
                                AuthenticationException exception) throws IOException, ServletException;
}

public class UsernamePasswordAuthenticationFilter extends AbstractAuthenticationProcessingFilter {
    public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "username";
    public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "password";
    
    public void setUsernameParameter(String usernameParameter);
    public void setPasswordParameter(String passwordParameter);
}

Authentication Framework

Access Control and Authorization

Access control mechanisms, exception handling, and privilege evaluation for web resources.

public interface AccessDeniedHandler {
    void handle(HttpServletRequest request, HttpServletResponse response, 
                AccessDeniedException accessDeniedException) throws IOException, ServletException;
}

public class ExceptionTranslationFilter extends GenericFilterBean {
    public void setAuthenticationEntryPoint(AuthenticationEntryPoint authenticationEntryPoint);
    public void setAccessDeniedHandler(AccessDeniedHandler accessDeniedHandler);
    public void setRequestCache(RequestCache requestCache);
}

public interface WebInvocationPrivilegeEvaluator {
    boolean isAllowed(String uri, Authentication authentication);
    boolean isAllowed(HttpServletRequest request, Authentication authentication);
}

Access Control and Authorization

CSRF Protection

Cross-Site Request Forgery protection with token-based validation and multiple storage strategies.

public interface CsrfToken {
    String getToken();
    String getParameterName();
    String getHeaderName();
}

public interface CsrfTokenRepository {
    CsrfToken generateToken(HttpServletRequest request);
    void saveToken(CsrfToken token, HttpServletRequest request, HttpServletResponse response);
    CsrfToken loadToken(HttpServletRequest request);
}

public class CsrfFilter extends OncePerRequestFilter {
    public void setCsrfTokenRepository(CsrfTokenRepository csrfTokenRepository);
    public void setRequireCsrfProtectionMatcher(RequestMatcher requireCsrfProtectionMatcher);
}

CSRF Protection

Security Context Management

Thread-safe security context storage, persistence, and lifecycle management across HTTP requests.

public interface SecurityContextRepository {
    SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder);
    void saveContext(SecurityContext context, HttpServletRequest request, HttpServletResponse response);
    boolean containsContext(HttpServletRequest request);
}

public class SecurityContextHolderFilter extends GenericFilterBean {
    public SecurityContextHolderFilter(SecurityContextRepository securityContextRepository);
    public void setSecurityContextHolderStrategy(SecurityContextHolderStrategy securityContextHolderStrategy);
}

public class HttpSessionSecurityContextRepository implements SecurityContextRepository {
    public void setAllowSessionCreation(boolean allowSessionCreation);
    public void setDisableUrlRewriting(boolean disableUrlRewriting);
    public void setSpringSecurityContextKey(String springSecurityContextKey);
}

Security Context Management

Session Management

HTTP session security controls including concurrent session management, session fixation protection, and invalid session handling.

public class SessionManagementFilter extends GenericFilterBean {
    public void setInvalidSessionStrategy(InvalidSessionStrategy invalidSessionStrategy);
    public void setSessionInformationExpiredStrategy(SessionInformationExpiredStrategy sessionInformationExpiredStrategy);
}

public interface InvalidSessionStrategy {
    void onInvalidSessionDetected(HttpServletRequest request, HttpServletResponse response) 
        throws IOException, ServletException;
}

public interface SessionInformationExpiredStrategy {
    void onExpiredSessionDetected(SessionInformationExpiredEvent event) 
        throws IOException, ServletException;
}

Session Management

Request Validation and Firewall

HTTP request validation, sanitization, and attack prevention through configurable firewall rules.

public interface HttpFirewall {
    FirewalledRequest getFirewalledRequest(HttpServletRequest request) throws RequestRejectedException;
    HttpServletResponse getFirewalledResponse(HttpServletResponse response);
}

public class StrictHttpFirewall implements HttpFirewall {
    public void setAllowUrlEncodedSlash(boolean allowUrlEncodedSlash);
    public void setAllowUrlEncodedPercent(boolean allowUrlEncodedPercent);
    public void setAllowSemicolon(boolean allowSemicolon);
    public void setUnsafeAllowAnyHttpMethod(boolean unsafeAllowAnyHttpMethod);
}

public interface RequestRejectedHandler {
    void handle(HttpServletRequest request, HttpServletResponse response, 
                RequestRejectedException requestRejectedException) throws IOException, ServletException;
}

Request Validation and Firewall

Request Matching and Utilities

Flexible request matching capabilities and utility classes for URL manipulation, text escaping, and security operations.

public interface RequestMatcher {
    boolean matches(HttpServletRequest request);
    default MatchResult matcher(HttpServletRequest request);
}

public class AntPathRequestMatcher implements RequestMatcher {
    public AntPathRequestMatcher(String pattern);
    public AntPathRequestMatcher(String pattern, String httpMethod);
    public AntPathRequestMatcher(String pattern, String httpMethod, boolean caseSensitive);
}

public final class UrlUtils {
    public static String buildRequestUrl(HttpServletRequest request);
    public static String buildFullRequestUrl(HttpServletRequest request);
    public static boolean isAbsoluteUrl(String url);
}

Request Matching and Utilities

Reactive Web Security

Reactive programming support for WebFlux applications with non-blocking security filters and handlers.

public interface SecurityWebFilterChain {
    boolean matches(ServerWebExchange exchange);
    Flux<WebFilter> getWebFilters();
}

public class WebFilterChainProxy implements WebFilter {
    public WebFilterChainProxy(List<SecurityWebFilterChain> filters);
    public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain);
    public void setFirewall(ServerHttpFirewall firewall);
}

public interface ServerAuthenticationEntryPoint {
    Mono<Void> commence(ServerWebExchange exchange, AuthenticationException ex);
}

Reactive Web Security

Types

// Core filter chain types
public interface Filter {
    void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) 
        throws IOException, ServletException;
}

public interface FilterChain {
    void doFilter(ServletRequest request, ServletResponse response) 
        throws IOException, ServletException;
}

// Security context types
@FunctionalInterface
public interface SecurityContextHolderStrategy {
    SecurityContext getContext();
    void setContext(SecurityContext context);
    SecurityContext createEmptyContext();
    void clearContext();
}

// Authentication types
public interface Authentication extends Principal, Serializable {
    Collection<? extends GrantedAuthority> getAuthorities();
    Object getCredentials();
    Object getDetails();
    Object getPrincipal();
    boolean isAuthenticated();
    void setAuthenticated(boolean isAuthenticated) throws IllegalArgumentException;
}

public class AuthenticationException extends RuntimeException {
    public AuthenticationException(String msg);
    public AuthenticationException(String msg, Throwable cause);
}

// Request/Response holders
public class HttpRequestResponseHolder {
    public HttpRequestResponseHolder(HttpServletRequest request, HttpServletResponse response);
    public HttpServletRequest getRequest();
    public HttpServletResponse getResponse();
}

// Reactive types (for WebFlux support)
public interface ServerWebExchange {
    ServerHttpRequest getRequest();
    ServerHttpResponse getResponse();
    Map<String, Object> getAttributes();
    Mono<WebSession> getSession();
}

// Authentication Manager types
public interface AuthenticationManager {
    Authentication authenticate(Authentication authentication) throws AuthenticationException;
}

public interface AuthenticationManagerResolver<T> {
    AuthenticationManager resolve(T context);
}

// Grant Authority types
public interface GrantedAuthority extends Serializable {
    String getAuthority();
}

public class SimpleGrantedAuthority implements GrantedAuthority {
    public SimpleGrantedAuthority(String role);
    public String getAuthority();
}

// Request Cache types
public interface RequestCache {
    void saveRequest(HttpServletRequest request, HttpServletResponse response);
    SavedRequest getRequest(HttpServletRequest request, HttpServletResponse response);
    HttpServletRequest getMatchingRequest(HttpServletRequest request, HttpServletResponse response);
    void removeRequest(HttpServletRequest request, HttpServletResponse response);
}

public interface SavedRequest extends Serializable {
    String getRedirectUrl();
    List<Cookie> getCookies();
    String getMethod();
    List<String> getHeaderValues(String name);
    Collection<String> getHeaderNames();
    List<Locale> getLocales();
    String[] getParameterValues(String name);
    Map<String, String[]> getParameterMap();
}
Workspace
tessl
Visibility
Public
Created
Last updated
Describes
mavenpkg:maven/org.springframework.security/spring-security-web@6.5.x
Publish Source
CLI
Badge
tessl/maven-org-springframework-security--spring-security-web badge