Speaker A
and now it's time to focus on security see the thing is when you talk about software development of course we build projects and then in that process basically we have to first learn the language we have to learn the Frameworks
Telusko's Spring Security 6 tutorial explains why application security matters, introduces OWASP Top 10, and demonstrates securing a Spring Boot web app with login protection.
Key Takeaways
- Build a working, stable product first, then add security.
- Use OWASP Top 10 as a checklist of common security risks.
- Spring Security dramatically reduces the effort needed to secure web applications by default.
- Adding Spring Security to a project immediately protects endpoints with login and logout.
What the video covers
- Working, stable software is the foundation; security builds on top of it.
- Most software has bugs; reducing major bugs and handling exceptions improves stability.
- Applications need security with roles and login/logout so only authorized users can perform actions.
- Implementing security manually in plain JSP-based web apps is a large effort; Spring Security simplifies it.
- OWASP Top 10 (released roughly every four years, 2021 edition discussed) lists the major web security risks such as access control, cryptography, and injection.
- Spring Security provides default protections and guidance that restrict unsafe behavior when followed.
- The demo creates a Maven Spring Boot project with web and DevTools dependencies, initially with Spring Security commented out.
- A simple REST controller returning a welcome message serves as the resource to protect.
- Enabling Spring Security shows a default login page; the default username is 'user' with a generated password from the console.
- Logging out invalidates the session, and accessing the endpoint again prompts for credentials, demonstrating real protection.
Chapters
- 00:00Why Software Needs to Work and Be Stable
- 00:56Bugs, Stability, and Importance of Security
- 02:32Securing Applications and Roles Overview
- 03:32Manual vs Spring Security Implementation
- 05:10Creating the Spring Boot Project
- 07:30Building a Simple REST Controller
- 08:30Enabling Spring Security and Testing Login
- 12:00Verifying Logout and Closing Remarks
Full Transcript — Download SRT & Markdown
Speaker A
and then we start implementing the project the most important thing in a project when you build it is it should work of course right if your software is not working then all the other aspect doesn't make any sense so the first
Speaker A
thing is focus on building a working product next is the project or the software should be stable I mean we build projects which works and then suddenly it stopped working for few inputs and then uh maybe because of some
Speaker A
issues it gives you other issues now that means your software is not stable and most of the application which I use on my phone are not stable right U even it can be a banking application I mean the only thing which works perfectly I
Speaker A
think is calculator right apart from that you will see bugs in most of the software and it will be no software in the world is 100% bug proof and if you think that one of the software is bug proof maybe
Speaker A
we have not done enough hard work to find the bugs but yeah it will it will have some bugs we have to make sure that you reduce the number of bugs at least the major bug should not be there and by
Speaker A
doing that you're making it stable so in Java also we can do that with the help of handling the exceptions and stuff then the most important thing which comes here is the security and we know know the importance of security right
Speaker A
and that's why on your phone as well you implement the locks maybe it can be your fingerprint reader or your face unlock or using a pattern or a password we do keep the password as 0000 just to make
Speaker A
it easy but again not a good idea uh still we know the importance of security Now whatever we have built till this point and whatever we have learned in the project which we have built is not secure because anyone can go there
Speaker A
anyone can do anything with the project uh what if you want to make it secure you'll be having multiple users not everyone should be able to do everything example if you are building e-commerce uh we will be having different rules
Speaker A
there so someone the seller will add the product the buyer will buy the product right so everyone will have different role and they have to log in to achieve those roles and that's how you can basically you can secure it and that's
Speaker A
not the only way you can secure it there are multiple ways of securing it but as a developer we focus on uh login log out or with the help of username password or maybe some other formats so yeah so how do we Implement security Now
Speaker A
if you're not using spring if you're using a normal s JSP to build web application implementing security is a big task I mean trust me if you spend 10 hours building a product you'll be spending another 20 hours securing it
Speaker A
but Spring Security will make your work easy how we'll see that step by step but then how do we know how do we secure the application what are the steps you have to follow sometime we feel that it is
Speaker A
secure secure and then some hacker will hack it by showing hey it's not secure then you will secure it it works in the normal applications but think about banking application think about uh uh Healthcare records U so sometime we are
Speaker A
not sure how do we secure it we don't want to wait for someone to hack and then tell us that's how I can hack your software or the application now to do this uh we have something called oasp now oos stands for open web
Speaker A
application security project and what they do is every four years they release some important security measures which you can take or some issues and then you can work on those issues and make sure that you don't have that in your project
Speaker A
and they call it as oasp top 10 so if I click on this top 10 here so you can see these are the top 10 risk of 2021 so they release this in every four years so the next version or next update is
Speaker A
expected to be coming into 2025 so depend upon when you're watching this uh so you can look at the recent uh top 10 so this was 2017 this is 2021 and these are the measures these are the security
Speaker A
risk and you can just go through this it talks about access control cryptography uh how do you encrypt and how do you decrypt which standards you following are you handling the injection attacks U then designing is it is it your the way
Speaker A
you design your software is it secured there are lot of things which are mentioned here uh I would also add a link of OAS top 10 in the description I already made a video on this so you can
Speaker A
have a watch but make sure that you follow this to understand different security issues which we have okay so the good thing is if I mean if you are not using spring then you have to think about all those things you have to
Speaker A
implement them step by step now when you use a framework like spring which has its own uh security implementation which is called Spring Security it takes care of most of these things and it by default it will say hey you're doing
Speaker A
this maybe it will not make your web secure so do this and it will give you suggestions as well it will restrict you to do certain things and if you follow that you're basically making your application secure and what I'm talking
Speaker A
about you will get to know that in some time uh I mean in the upcoming videos so now let's try to build a project and let me show you how easy it is to secure your application using Spring Security
Speaker A
so to do that what I will do is first of all let's create a new project of course I can edit my existing project but I want to show you how do you start a project thinking Security in the mind
Speaker A
okay so let's go to our start. spring.io and here we'll create a mavin project with Java language uh this is 3.3.1 the group ID is com. telescope uh the artifact ID is Spring Security example of course you can use
Speaker A
any name doesn't matter and packaging will be J versions 21 now dependencies of course you can secure different type of applications uh example if you are securing your Hardware let's say I have this this uh uh phone with me and I want
Speaker A
to secure this basically I can just keep it in a room and I can lock the room so that no one can access it that's external security but what if someone can hack it online so for that we have
Speaker A
to build Spring Security so I'm basically trying to secure a web application using sping security so I want to have a web feature uh I will also get Dev tool just in case if I want to use that we can also use database see
Speaker A
ultimately when you say login usern login password you may want to store that in database so of course we need to have database as well but maybe we can add database part later at this point just try to keep it simple uh so we got
Speaker A
web and uh Dev tools I will get now Spring Security Now this will make your app secure and I will click on generate so it will download the project that the only thing we have to do is we have to
Speaker A
unzip it and open that in the intelligy idea Community version so unzip done I will just open this project now so this is a project I will click on open and yeah I got my project here so basically
Speaker A
I got Spring Security project and now uh I want to test it if this is working so what I will do is to start with I will disable the Spring Security part so at this point I will just say comment and
Speaker A
reload the mavin changes that's important now when you once you reload you don't have Spring Security in the project so it is it is normal spring boot application and I will go to SRC in the main I will create a controller
Speaker A
because at this point we don't have any controllers and if you want to secure you need some resource to secure right so let's create a resource and I will say this as a simple hello controller nothing fancy a simple hello controller
Speaker A
and here basically what I'm going to do is of course I have to make it controller and I'll make it rest controller I don't want to create the uis I will simply go for the rest end points and here I just want one method and we
Speaker A
have used this before so I will simply say greet and this will basically uh get mapping and the URL is homepage so whenever someone request for the homepage I want to return welcome to teliscope that's it nothing fancy just a
Speaker A
simple text okay so for the homepage this is the text I want to return I want to check if this is working so I will go back to my application and here I will click on run this should run on port
Speaker A
number 880 is free and it should be free so if I look at here yeah it is running on port number 880 how do I verify this I will open a browser okay so I got my browser here and I'm going to hit Local
Speaker A
Host 880 and you can see it says welcome to theis scope now this is the resource I want to secure of course this can be a very complex Resource as well something which interacts with the database or maybe it is doing some bigger task it
Speaker A
doesn't matter right resource is a resource maybe you want to secure your a simple pen or maybe you want to secure your gold chain both are resources you will need a locker to secure it so how do we secure this what I want to do is
Speaker A
uh if someone request for the homepage it should first open the login form of course right there should be a login form that means we have to create a UI for the login form that's one next when a user enters the details the username
Speaker A
and password we have to verify that in the back end how do I verify that maybe I need a database where I will have username passwords lot of steps right okay let's do that in this video or maybe in the next video Let's see uh
Speaker A
okay maybe you can judge by the length of the video how difficult it will be so what I will do is I will just go back here uh to the pal and I will enable this Spring Security because now I want
Speaker A
to secure it and just by enabling it let's see if the if the application still works I will just reload the project and let's see what errors you get so that we can focus on the building a login form and other stuff okay so now
Speaker A
I'm hitting the same URL which is Local Host 880 if I enter oh this is weird and awesome at the same time weird because I was expecting some error or maybe it should say something that you don't have a
Speaker A
login form and the awesome thing is Spring Security is giving you a login form just by adding the dependency but the question is is it just a login form or is it working okay now that's tricky first of all I'm not sure what the
Speaker A
username password is I'm just guessing so maybe the username will be user actually the username is user but what about the password is it the user let's try sign in no it's not working so you can see it says bad credential so just
Speaker A
checking something I'm saying user uh password should be naven no it's not working maybe it's not even picking my local uh I mean desktop name so what will be the password and username username is user for sure the password
Speaker A
where do I where do I find the password now if you go to the console and if you if you scroll up can you see that it says using generated security password is this this is the password I can
Speaker A
simply copy this and go back here and paste it and voila so just by adding a dependency it is giving you a login form it is also giving you the logic to check if the username password is correct and
Speaker A
it is doing that okay now now let me show you it's actually working if I open the another tab another incognit to tab here or private window for Safari and if I say Local Host 880 it is still asking
Speaker A
for the login form so it maintains the session as well but if I open a normal tab or let a new tab and if I hit the same URL it is not asking for the login form so session is also maintaining so a
Speaker A
lot of things is doing doing behind the scene right this is cool now we got this right and this perfectly makes sense but it also says something it says this generated password is for development use only don't use it in the production
Speaker A
okay that's good also we only got one password in your system you'll be having multiple users how do I achieve that how do we have multiple username password and now you might be thinking there should be some magic where Spring
Speaker A
Security will have all the username password no Spring Security is Magic but it's not actually a superhuman can I say that or in India we say rajnikant I'm not how many of you know this context but yeah so Spring Security has no idea
Speaker A
what username password you'll be going to use and that's why you have to use database how we are going to do that let's see in the upcoming videos but we have to do a lot of work to secure it
Speaker A
with the help of username password but the main thing what it has done is it is giving you a login form it also gives you one more thing what if you want to log out so you can just use a URL here
Speaker A
and say log out enter it will say are you sure yes I'm sure log out and then if you're thinking this is just a UI gimmick uh no let me just just open this tab once again and I will hit the Local
Speaker A
Host 880 it is asking you to sign in again so log out actually works it's not just a gimmick where you see a UI which says log out done it's actually protecting your application so once you log in once you log out it's gone okay
Speaker A
and uh but yeah there are a lot of things we have to talk about and we'll going to discuss that in the upcoming videos but this point we just added the dependency for Spring Security and it is giving you a login form if if you want
Speaker A
to change something if you want to change a password you can do that in the resource so in the application properties you can set your username passwords here but again you can only set only one username password maybe you
Speaker A
don't want to go for this password every time so maybe a Super Root uh password you can set it here username password uh but the ideal way is to work with database and how we're going to do that
Speaker A
let's see in the upcoming videos so I hope you are enjoying this series where you're talking about different concepts of spring and if you're enjoying it let me know in the comments and also hit the like button which will motivate me to
Speaker A
make the videos faster thank you so much bye-bye
Topics:Spring SecuritySpring BootOWASP Top 10web securityauthenticationloginJavaMavenREST controllerTelusko
