{"id":24773956,"url":"https://github.com/tawfik-s/spring-security-tasks-solution","last_synced_at":"2025-06-30T08:07:58.431Z","repository":{"id":270952243,"uuid":"910750865","full_name":"tawfik-s/Spring-Security-Tasks-Solution","owner":"tawfik-s","description":"Master Spring Security by practice. spring security tasks and solutions. you can find tasks description at the README file. freely use, modify, and distribute the code.","archived":false,"fork":false,"pushed_at":"2025-01-06T19:14:46.000Z","size":5731,"stargazers_count":7,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-09T19:53:21.510Z","etag":null,"topics":["bycrypt","csrf","github-oauth2","google-oauth2","java","jwt","jwt-authentication","method-level-authorization","method-level-security","oauth","oauth2","oauth2-client","preauthorize","security","spring","spring-boot","spring-security","spring-security-oauth2","tasks"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-2-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/tawfik-s.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-01-01T09:54:59.000Z","updated_at":"2025-01-09T10:08:17.000Z","dependencies_parsed_at":null,"dependency_job_id":"e7078714-ad16-4f8b-a2e2-e14967a75b19","html_url":"https://github.com/tawfik-s/Spring-Security-Tasks-Solution","commit_stats":null,"previous_names":["tawfik-s/spring-security-tasks-solution"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/tawfik-s/Spring-Security-Tasks-Solution","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tawfik-s%2FSpring-Security-Tasks-Solution","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tawfik-s%2FSpring-Security-Tasks-Solution/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tawfik-s%2FSpring-Security-Tasks-Solution/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tawfik-s%2FSpring-Security-Tasks-Solution/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/tawfik-s","download_url":"https://codeload.github.com/tawfik-s/Spring-Security-Tasks-Solution/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/tawfik-s%2FSpring-Security-Tasks-Solution/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262736611,"owners_count":23356148,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bycrypt","csrf","github-oauth2","google-oauth2","java","jwt","jwt-authentication","method-level-authorization","method-level-security","oauth","oauth2","oauth2-client","preauthorize","security","spring","spring-boot","spring-security","spring-security-oauth2","tasks"],"created_at":"2025-01-29T05:20:13.694Z","updated_at":"2025-06-30T08:07:58.404Z","avatar_url":"https://github.com/tawfik-s.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Spring Security Tasks Solution\n\nTest and enhance your Spring Security expertise with this comprehensive quiz!  \nEach task challenges you to configure Spring Security for a specific use case, providing a hands-on approach to mastering real-world scenarios.  \n## Spring Security Architecture diagram\n![SpringSecurityArchitectureDiagram.svg](SpringSecurityArchitectureDiagram.svg)\n\n## 🌟 Features  \n- 📚 Practical tasks for mastering Spring Security.  \n- 🛠️ Real-world use cases to boost your confidence.  \n- 💡 Opportunity to experiment with different configurations.  \n\n---\n\n## 📝 Tasks Overview  \n\n### 🔒 Task 1: Basic Authentication  \nConfigure a Spring Boot application with Spring Security to:  \n- Require **username and password** authentication for all endpoints.  \n- Use **in-memory user details** with roles `USER` and `ADMIN`.  \n\n---\n\n### 🛡️ Task 2: Role-Based Access Control  \nImplement **role-based access control**:  \n- `USER` can access `/user/**`.  \n- `ADMIN` can access `/admin/**` and `/user/**`.  \n- Restrict `/admin/**` to only `ADMIN` users.  \n\n---\n\n### ✨ Task 3: Custom Login Page  \n- Create a **custom login page** to replace the default form-based login.  \n- Redirect users to different pages after login based on their roles.  \n\n---\n\n### 🔑 Task 4: Password Encoding  \n- Integrate a **password encoder** (e.g., `BCryptPasswordEncoder`) to hash and verify passwords stored in a database.  \n- Use a **database** to manage user details instead of in-memory users.  \n- Use Spring Security's `SecurityContext` to pass user details into a service layer.  \n- Create a **custom user details service** to load user data from a database.  \n---\n\n### 📜 Task 5: JWT Authentication  \n- Configure the application to use **JWT** for authentication.  \n- Implement **token generation and validation**.  \n- Secure endpoints using JWT tokens.  \n  \u003e **Note**: The solution uses the JJWT library, but you can explore other options like Auth0.  \n\n---\n\n### 🌐 Task 6: OAuth2 Login  \n- Set up **OAuth2 login** with GitHub \u0026 Google as an identity provider.  \n- Allow users to log in using their **GitHub accounts**.  \n- Allow users to login using their **Google sccounts**\n---\n\n### 📋 Task 7: Method-Level Security  \n- Enable **method-level security annotations**.  \n- Use `@PreAuthorize` and `@PostAuthorize` to secure specific methods in a service.  \n\n---\n\n### 🔒 Task 8: CSRF Protection  \n- Enable **CSRF protection** in the application.  \n- Configure CSRF tokens for form submissions.  \n\n---\n\n### 📂 Task 9: LDAP Authentication  \n- Configure the application to authenticate users against an **LDAP server**.  \n\n\n\u003c!--\ntasks under consideration\n---\n\n### 🔐 Task : Multi-Factor Authentication  \n- Add a second layer of authentication using an **OTP (One-Time Password)** system.  \n- Use **Google Authenticator** or a similar app for generating OTPs.  \n\n---\n\n### 💾 Task : Remember Me  \n- Add a \"**Remember Me**\" functionality to the login flow.  \n- Ensure users can stay logged in even after closing their browser.  \n\n---\n\n---\n\n### 🧪 Task : Security Testing  \n- Write **unit tests** to verify the security configuration:  \n  - Test access to endpoints with and without valid credentials.  \n  - Mock user authentication for service-level tests.  \n--\u003e\n\n\n---\n## 🐱‍💻I will Add More Tasks to the Repo Stay Watching the Repo\n---\n\n## 🛠️ How to Contribute  \nFeel free to fork the repository, enhance the solutions, or even add new tasks!  \n\n## 📢 Acknowledgments  \nThis project is inspired by the need to bridge the gap between learning concepts and applying them in real-world scenarios. Let's code securely!  \n\n---\n\nHappy Learning! 🎉 And Don't forget to KISS 💋💋 (keep it simple stupid)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftawfik-s%2Fspring-security-tasks-solution","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ftawfik-s%2Fspring-security-tasks-solution","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ftawfik-s%2Fspring-security-tasks-solution/lists"}