{"id":21307468,"url":"https://github.com/jdegand/spring-basic-auth","last_synced_at":"2025-03-15T19:49:22.283Z","repository":{"id":220436860,"uuid":"670340392","full_name":"jdegand/spring-basic-auth","owner":"jdegand","description":"Basic Auth implementation from hogwarts-artifacts-online","archived":false,"fork":false,"pushed_at":"2024-02-02T02:28:16.000Z","size":31,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-01-22T09:12:57.938Z","etag":null,"topics":["java17","spring-boot-3","spring-security","tests"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jdegand.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-07-24T20:42:58.000Z","updated_at":"2023-07-24T20:49:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"db106709-65cf-4648-a343-e06fb673a4a4","html_url":"https://github.com/jdegand/spring-basic-auth","commit_stats":null,"previous_names":["jdegand/spring-basic-auth"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdegand%2Fspring-basic-auth","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdegand%2Fspring-basic-auth/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdegand%2Fspring-basic-auth/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jdegand%2Fspring-basic-auth/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jdegand","download_url":"https://codeload.github.com/jdegand/spring-basic-auth/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":243784103,"owners_count":20347409,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["java17","spring-boot-3","spring-security","tests"],"created_at":"2024-11-21T16:32:10.898Z","updated_at":"2025-03-15T19:49:22.245Z","avatar_url":"https://github.com/jdegand.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Spring Basic Auth\n\nBasic Spring User Authentication based off this [playlist tutorial by Bingyang Wei](https://www.youtube.com/watch?v=asS2kcalidY\u0026list=PLqq9AhcMm2oPdXXFT3fzjaKLsVymvMXaY\u0026index=1).  \n\nThe video series is high quality and watching it pushed me to examine the approaches I use in my Spring Boot applications.  \n\n## Built With\n\n- Java 17\n- Spring Boot 3\n- H2 Database\n- Spring Boot Starter Oauth2 Resource Server\n- Spring Data JPA\n- Spring Security Test\n\n## Thoughts\n\n- The tutorial uses a structure-by-feature approach. I use a structure-by-layer approach. In reading about [the two approaches](https://www.geeksforgeeks.org/spring-boot-code-structure/), I think it is important that I try to adopt structure-by-feature, as it greatly helps productivity with easier code reuse. I intend to reference or rework the basic authentication in this repository for future projects.\n- Adding `final` to injected services and repositories is a quick and easy fix to improve code quality.\n- Using records with DTO conversion is a better solution than what I've done previously. Records are read-only, and this helps the security and reliability of an application.\n- Adding `@Transactional` to services helps rollback failed database operations.\n- The `DBDataInitializer` was surprisingly simple to add, so I added a similar one to my [LCOGT-spring-backend](https://github.com/jdegand/LCOGT-spring-backend).\n- I had to make some modifications to the security configuration to replace deprecated methods.\n- Adding `serializable` to entities can be [problematic](https://stackoverflow.com/questions/2020904/when-and-why-jpa-entities-should-implement-the-serializable-interface).\n- I removed the Result class and used a Response Entity or a standard entity object.\n- 3/4 of the Result class is redundant. Having a standard response to every endpoint can be beneficial, especially for testing.\n- I did not add any validation to the User entity fields; this prevents the `handleValidationException` from being invoked. You can also not test failure paths for `updateUser` or `addUser`.\n- I added a `changePassword` route and used \"reset\" for the path name. I updated the security configuration to allow the route.\n- I thought about adding the reset route to its own controller, but I decided to leave it in the user controller.\n- `ChangePasswordRequest` could go in the DTO package.\n- I just returned a string saying \"Password changed successfully\" for the success response of the changePassword method. If you want to return a user back, you need to convert the user object to a user DTO so you don't send the password back to the client.\n- I used a UserPrincipal object to help change the password so I could reuse `loadUserByUsername`. I used username as my unique identifier in the ChangePasswordRequest class.\n- I had to mock 3 methods to get the updatePasswordSuccess test to pass.\n- You can get the failure test for updatePassword to pass without having a correct test. If you don't mock certain methods, the test will fail.\n- I didn't test the CORS configuration by making a request from a frontend.\n\n## Improvements\n\n- Validation\n- Failure path tests\n- Delete user returns void - you could use a Response Entity and return \"User {id} deleted successfully\". \n- Lombok - parallel move?\n- Refresh JWT Tokens \n\n## Useful Resources\n\n- [Mageddo](https://mageddo.com/tools/yaml-converter) - YAML Converter\n- [Geeks for Geeks](https://www.geeksforgeeks.org/spring-boot-code-structure/) - spring boot code structure\n- [Stack Overflow](https://stackoverflow.com/questions/2020904/when-and-why-jpa-entities-should-implement-the-serializable-interface) - jpa entities should implement serializable interface?\n- [Baeldung](https://www.baeldung.com/java-record-keyword) - record\n- [YouTube](https://www.youtube.com/watch?v=B5Zrn1Tzyqw) - Spring ResponseEntity - How to customize the response in Spring Boot\n- [BezKoder](https://www.bezkoder.com/spring-boot-refresh-token-jwt/) - spring boot refresh token jwt\n- [Stack Overflow](https://stackoverflow.com/questions/4350874/unable-to-use-table-named-user-in-postgresql-hibernate) - unable to use table named user in postgresql hibernate\n- [Blog](https://www.buggybread.com/2015/03/spring-framework-list-of-exceptions.html) - spring framework list of exceptions\n- [Reflectoring](https://reflectoring.io/spring-boot-exception-handling/) - spring boot exception handling\n- [Blog](https://www.roshanadhikary.com.np/2022/10/spring-boot-mvc-test.html) - spring boot mvc test\n- [YouTube](https://www.youtube.com/watch?v=CB32_mdgXq8) - How to Implement Change Password Functionality in Spring Security | Spring Boot","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjdegand%2Fspring-basic-auth","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjdegand%2Fspring-basic-auth","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjdegand%2Fspring-basic-auth/lists"}