Spring Security Web module provides comprehensive web security features for Spring-based applications, including servlet-based authentication, authorization, CSRF protection, session management, and security filter chain implementation
—
Spring Security Web provides reactive programming support for WebFlux applications with non-blocking security filters and handlers that integrate with Project Reactor.
public interface SecurityWebFilterChain {
boolean matches(ServerWebExchange exchange);
Flux<WebFilter> getWebFilters();
}
public class WebFilterChainProxy implements WebFilter {
public WebFilterChainProxy(List<SecurityWebFilterChain> filters);
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain);
public void setFirewall(ServerHttpFirewall firewall);
}
public interface ServerAuthenticationEntryPoint {
Mono<Void> commence(ServerWebExchange exchange, AuthenticationException ex);
}
public interface ServerRedirectStrategy {
Mono<Void> sendRedirect(ServerWebExchange exchange, URI location);
}
public class DefaultServerRedirectStrategy implements ServerRedirectStrategy {
public void setStatusCode(HttpStatus statusCode);
public Mono<Void> sendRedirect(ServerWebExchange exchange, URI location);
}public class ServerFormLoginAuthenticationConverter implements Function<ServerWebExchange, Mono<Authentication>> {
public void setUsernameParameter(String usernameParameter);
public void setPasswordParameter(String passwordParameter);
public Mono<Authentication> apply(ServerWebExchange exchange);
}
public class ServerHttpBasicAuthenticationConverter implements Function<ServerWebExchange, Mono<Authentication>> {
public Mono<Authentication> apply(ServerWebExchange exchange);
}// Reactive filter chain
List<WebFilter> filters = Arrays.asList(
new ServerFormLoginAuthenticationWebFilter(authenticationManager),
new AuthorizationWebFilter(authorizationManager)
);
SecurityWebFilterChain chain = new MatcherSecurityWebFilterChain(
ServerWebExchangeMatchers.anyExchange(),
filters
);
WebFilterChainProxy proxy = new WebFilterChainProxy(Arrays.asList(chain));
// Reactive authentication
ServerFormLoginAuthenticationConverter converter = new ServerFormLoginAuthenticationConverter();
converter.setUsernameParameter("email");
converter.setPasswordParameter("password");Install with Tessl CLI
npx tessl i tessl/maven-org-springframework-security--spring-security-web