{"id":15046671,"url":"https://github.com/auth0/auth0-spring-security-api","last_synced_at":"2025-06-12T18:07:12.731Z","repository":{"id":41448534,"uuid":"137390788","full_name":"auth0/auth0-spring-security-api","owner":"auth0","description":"Spring Security integration with Auth0 to secure your API with JWTs","archived":false,"fork":false,"pushed_at":"2024-08-05T10:17:14.000Z","size":428,"stargazers_count":78,"open_issues_count":0,"forks_count":27,"subscribers_count":9,"default_branch":"master","last_synced_at":"2025-05-20T14:07:30.073Z","etag":null,"topics":["dx-sdk","spring-security"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/auth0.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2018-06-14T17:50:01.000Z","updated_at":"2025-04-22T10:20:16.000Z","dependencies_parsed_at":"2024-12-28T15:11:18.503Z","dependency_job_id":"679a7546-e0ac-4b92-92b7-55601c133df9","html_url":"https://github.com/auth0/auth0-spring-security-api","commit_stats":null,"previous_names":[],"tags_count":32,"template":false,"template_full_name":null,"purl":"pkg:github/auth0/auth0-spring-security-api","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fauth0-spring-security-api","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fauth0-spring-security-api/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fauth0-spring-security-api/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fauth0-spring-security-api/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/auth0","download_url":"https://codeload.github.com/auth0/auth0-spring-security-api/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/auth0%2Fauth0-spring-security-api/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259518832,"owners_count":22870301,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["dx-sdk","spring-security"],"created_at":"2024-09-24T20:53:22.023Z","updated_at":"2025-06-12T18:07:12.703Z","avatar_url":"https://github.com/auth0.png","language":"Java","funding_links":[],"categories":["Java"],"sub_categories":[],"readme":"# Auth0 Spring Security for API\n\n[![CircleCI][circle-ci-badge]][circle-ci-url]\n[![MIT][mit-badge]][mit-url]\n[![Maven][maven-badge]][maven-url]\n[![Download][jcenter-badge]][jcenter-url]\n[![codecov][codecov-badge]][codecov-url]\n[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fauth0%2Fauth0-spring-security-api.svg?type=shield)](https://app.fossa.com/projects/git%2Bgithub.com%2Fauth0%2Fauth0-spring-security-api?ref=badge_shield)\n\n\u003e **Note**\n\u003e As part of our ongoing commitment to best security practices, we have rotated the signing keys used to sign previous releases of this SDK. As a result, new patch builds have been released using the new signing key. Please upgrade at your earliest convenience.\n\u003e \n\u003e While this change won't affect most developers, if you have implemented a dependency signature validation step in your build process, you may notice a warning that past releases can't be verified. This is expected, and a result of the key rotation process. Updating to the latest version will resolve this for you.\n\nSpring Security integration with Auth0 to secure your API with Json Web Tokens (JWT)\n\n\u003e This library targets Spring 4 and Spring Boot 1. If you are using Spring 5 and Spring Boot 2, please see the [Spring Security 5 API Quickstart](https://auth0.com/docs/quickstart/backend/java-spring-security5).\n\n## Security Considerations\n\nThis library uses Spring Security 4, and is targeted at applications using Spring 4 and/or Spring Boot 1.\n\nThe following are vulnerabilities that could affect this library when used with Spring 4/Boot 1:\n- [CVE-2021-22112 ](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22112) is a medium severity vulnerability in Spring Security (`org.springframework.security:spring-security-web`) 5.4.x prior to 5.4.4, 5.3.x prior to 5.3.8.RELEASE, and 5.2.x prior to 5.2.9.RELEASE.\n  - 5.2.x prior to 5.2.9.RELEASE.\n  - 5.3.x prior to 5.3.8.RELASE.\n  - 5.4.x prior to 5.4.4.\n- [CVE-2021-22060](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22060) is a medium severity vulnerability in `org.springframework:spring-core` affecting:\n  - 5.2.x prior to 5.2.19.RELEASE.\n  - 5.3.x prior to 5.3.14.\n- [CVE-2021-22096](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22096) is a medium severity vulnerability in `org.springframework:spring-core` affecting:\n  - 5.2.x prior to 5.2.18.\n  - 5.3.x prior to 5.3.12.\n\nIt is recommended that projects using this library upgrade to at least:\n- `org.springframework.security:spring-security-web` to `5.2.9.RELEASE`, `5.3.8.RELASE`, `5.4.4`, or better\n- `org.springframework:spring-core` to `5.2.19.RELEASE`, `5.3.14`, or better\n\n💡 Developers will often find it more convenient to use's Spring's native, out-of-the-box OAuth2 support. Please review Auth0's [Spring Boot API quickstart](https://auth0.com/docs/quickstart/backend/java-spring-security5/01-authorization) for guidance on that implementation path.\n\n## Download\n\nGet Auth0 Spring Security API using Maven:\n\n```xml\n\u003cdependency\u003e\n    \u003cgroupId\u003ecom.auth0\u003c/groupId\u003e\n    \u003cartifactId\u003eauth0-spring-security-api\u003c/artifactId\u003e\n    \u003cversion\u003e1.5.2\u003c/version\u003e\n\u003c/dependency\u003e\n```\n\nor Gradle:\n\n```gradle\nimplementation 'com.auth0:auth0-spring-security-api:1.5.2'\n```\n\n## Usage\n\nInside a `WebSecurityConfigurerAdapter` you can configure your API to only accept `RS256` signed JWTs:\n\n```java\n@EnableWebSecurity\n@Configuration\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\n\n    @Override\n    protected void configure(HttpSecurity http) throws Exception {\n        JwtWebSecurityConfigurer\n                .forRS256(\"YOUR_API_AUDIENCE\", \"YOUR_API_ISSUER\")\n                .configure(http);\n    }\n}\n```\n\nor for `HS256` signed JWTs:\n\n```java\n@EnableWebSecurity\n@Configuration\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\n\n    @Override\n    protected void configure(HttpSecurity http) throws Exception {\n        JwtWebSecurityConfigurer\n                .forHS256(\"YOUR_API_AUDIENCE\", \"YOUR_API_ISSUER\", \"YOUR_API_SECRET\".getBytes())\n                .configure(http);\n    }\n}\n```\n\n\u003e If you need further customization (like a leeway for JWT verification) use the `JwtWebSecurityConfigurer` signatures which accept a `JwtAuthenticationProvider`.\n\n\u003e If you need to configure several allowed issuers use the `JwtWebSecurityConfigurer` signatures which accept a `String[] issuers`.\n\n\nThen using Spring Security `HttpSecurity` you can specify which paths requires authentication:\n\n```java\n    http.authorizeRequests()\n        .antMatchers(\"/api/**\").fullyAuthenticated();\n```\n\nTo restrict access based on the presence of a specific scope or permission claim, you can use the `hasAuthority` method.\nScope and permissions claim values are prefixed with `SCOPE_` and `PERMISSION_`, respectively.\n\nTo require a specific scope (`read:users` in the example below):\n\n```java\n    http.authorizeRequests()\n        .antMatchers(HttpMethod.GET, \"/api/users/**\").hasAuthority(\"SCOPE_read:users\");\n```\n\nTo require a specific permission (`admin` in the example below):\n\n```java\n    http.authorizeRequests()\n        .antMatchers(HttpMethod.GET, \"/api/admin/**\").hasAuthority(\"PERMISSION_admin\");\n```\n\n`JwtWebSecurityConfigurer#configure(HttpSecurity)` also returns `HttpSecurity` so you can do the following:\n\n```java\n@EnableWebSecurity\n@Configuration\npublic class SecurityConfig extends WebSecurityConfigurerAdapter {\n\n    @Override\n    protected void configure(HttpSecurity http) throws Exception {\n        JwtWebSecurityConfigurer\n                .forRS256(\"YOUR_API_AUDIENCE\", \"YOUR_API_ISSUER\")\n                .configure(http)\n                .authorizeRequests()\n                        .antMatchers(HttpMethod.GET, \"/api/users/**\").hasAuthority(\"SCOPE_read:users\")\n                        .antMatchers(HttpMethod.GET, \"/api/admin/**\").hasAuthority(\"PERMISSION_admin\");\n    }\n}\n```\n## Sample\n\nPerhaps the easiest way to learn how to use this library (and quickly get started with a working app) is to study the [Auth0 Spring Security API Sample](https://github.com/auth0-samples/auth0-spring-security-api-sample) and its README.\n\n\n## What is Auth0?\n\nAuth0 helps you to:\n\n* Add authentication with [multiple authentication sources](https://docs.auth0.com/identityproviders), either social like **Google, Facebook, Microsoft Account, LinkedIn, GitHub, Twitter, Box, Salesforce, amont others**, or enterprise identity systems like **Windows Azure AD, Google Apps, Active Directory, ADFS or any SAML Identity Provider**.\n* Add authentication through more traditional **[username/password databases](https://docs.auth0.com/mysql-connection-tutorial)**.\n* Add support for **[linking different user accounts](https://docs.auth0.com/link-accounts)** with the same user.\n* Support for generating signed [Json Web Tokens](https://docs.auth0.com/jwt) to call your APIs and **flow the user identity** securely.\n* Analytics of how, when and where users are logging in.\n* Pull data from other sources and add it to the user profile, through [JavaScript rules](https://docs.auth0.com/rules).\n\n## Create a free account in Auth0\n\n1. Go to [Auth0](http://developers.auth0.com) and click Sign Up.\n2. Use Google, GitHub or Microsoft Account to login.\n\n## Issue Reporting\n\nIf you have found a bug or if you have a feature request, please report them at this repository issues section. Please do not report security vulnerabilities on the public GitHub issue tracker. The [Responsible Disclosure Program](https://auth0.com/whitehat) details the procedure for disclosing security issues.\n\n## Author\n\n[Auth0](auth0.com)\n\n## License\n\nThis project is licensed under the MIT license. See the [LICENSE](LICENSE) file for more info.\n\n\u003c!-- Vars --\u003e\n\n[circle-ci-badge]: https://img.shields.io/circleci/project/github/auth0/auth0-spring-security-api.svg?style=flat-square\n[circle-ci-url]: https://circleci.com/gh/auth0/auth0-spring-security-api/tree/master\n[mit-badge]: http://img.shields.io/:license-mit-blue.svg?style=flat-square\n[mit-url]: https://raw.githubusercontent.com/auth0/auth0-java/master/LICENSE\n[maven-badge]: https://img.shields.io/maven-central/v/com.auth0/auth0-spring-security-api.svg?style=flat-square\n[maven-url]: http://search.maven.org/#search%7Cga%7C1%7Cg%3A%22com.auth0%22%20AND%20a%3A%22auth0-spring-security-api%22\n[jcenter-badge]: https://api.bintray.com/packages/auth0/java/auth0-spring-security-api/images/download.svg?style=flat-square\n[jcenter-url]: https://bintray.com/auth0/java/auth0-spring-security-api/_latestVersion\n[codecov-badge]: https://codecov.io/gh/auth0/auth0-spring-security-api/branch/master/graph/badge.svg\n[codecov-url]: https://codecov.io/gh/auth0/auth0-spring-security-api\n\n\n[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fauth0%2Fauth0-spring-security-api.svg?type=large)](https://app.fossa.com/projects/git%2Bgithub.com%2Fauth0%2Fauth0-spring-security-api?ref=badge_large)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fauth0%2Fauth0-spring-security-api","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fauth0%2Fauth0-spring-security-api","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fauth0%2Fauth0-spring-security-api/lists"}