Hard Code

This bean is configured as shown below: <bean id="securityContextPersistenceFilter" class="org.springframework.security.web.context.SecurityContextPersistenceFilter"/> This bean has two main tasks and they are very important In a typical web application like Skyphoto the user will login once and then subsequently do several operations or click several links and buttons generating several authenticated requests to the server. Since the user was authenticated once it is important to store the security context somewhere and by some means. Otherwise he/she has to authenticate for each request and will sooner or later never use Skyphoto. In a typical web application you will store an user object in HttpSession and each time a request comes in, the server identifies this session with a session id and you get the user object. It is the responsibility of the server to cache/store and manage these session objects during the lifetime of the session. “In Spring Secur...

Going back to the filter chain configuration in my last post, you can see a chain filters configured as shown below: <bean id="springSecurityFilterChain" class="org.springframework.security.web.FilterChainProxy"> <sec:filter-chain-map path-type="ant"> <sec:filter-chain pattern="/SkyPhotoWeb/**" filters=" securityContextPersistenceFilterWithASCFalse, basicAuthenticationFilter, exceptionTranslationFilter, filterSecurityInterceptor" /> <sec:filter-chain pattern="/**" filters=" securityContextPersistenceFilterWithASCTrue, formLoginFilter, exceptionTranslationFilter, filterSecurityInterceptor" /> </sec:filter-chain-map> </bean> Let us assume that a request is send as http://www.skyphoto.com/SkyPhotoWeb/dosomething.html the request runs through the filters as shown in picture below: In my next post I will explain all these and few other important filters in greater detail.

DelegatingFilterProxy The DelegatingFilterProxy is a special filter provided by the Spring framework.It acts as a bridge connecting the web container and spring application container. In other words it helps pipeline request processing from the web container filter to a bean in Spring web application context. DelegatingFilterProxy is configured in the web.xml as shown below: <filter>     <filter-name>springSecurityFilterChain</filter-name>     <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>   </filter>   <filter-mapping>     <filter-name>springSecurityFilterChain</filter-name>     <url-pattern>/*</url-pattern>   </filter-mapping>       DelegatingFilterProxy is essentially a dumb filter and implements no logic. Its sole responsibility is to delegate the Filter's met...

So far we have been quick to setup Spring Security and apply it in our application. But behind that minimal configuration and non-invasive behavior lot has been happening behind the scenes. It is time to uncover the activities under hood, draw some diagrams to understand the framework and move ahead in style. I will not draw out all the balls from the magic box now. Instead will slowly take out one ball at a time to make it slow and easy to comprehend and assimilate. Let us go back to the web.xml configuration. You will see that we have configured a DelegatingFilterProxy . This filter is named 'springSecurityFilterChain'. The delegating filter proxy looks for a bean named 'springSecurityFilterChain' in the root Spring web application context. So note that this name is kind of a reserved bean name and should not be used elsewhere. The delegating filter proxy as the name suggests delegates the entire security processing then to the beans declared in the Spring web appl...

As you have seen in my previous post the access to index.html was restricted. Whenever the user tries to access this page they were redirected to the login page. But this should not be case. The logical index.html page should be accessible to guest users as well as authenticated users. Turning this on is just a matter of configuration. This is shown in the modified spring-security.xml file. Listing 1 - spring.security.xml I have now added a new intercept url line. <intercept-url pattern="/index.html" access="IS_AUTHENTICATED_ANONYMOUSLY" /> This line makes it possible to access index.html as a guest user. Now when you click on any link on the index.html page you will be redirected to the login page in case you have not signed in. In my next post, I will try to get into some theoretical details/framework internals before proceeding to the next round of coding and adding additional features.

1> Add few more jars in your WEB-INF/lib folder. The current view of jars is shown in the figure below. Figure 1 - Adding the Jars 2> Add a new member named - spring-security.xml in the WEB-INF/config folder. The contents of this file is shown in Listing 1 below: Listing 1 - spring-security.xml This is the bare minimum configuration you need to do to get Spring Security started. This is a great relief for those of you who had worked with earlier versions of Spring Security or its ancestor Acegi Security. You had to explicitly configure the entire filter chain. That was tedious and very cumbersome leading to lot of errors and time and effort going down the drain. Thanks Ben and team for this good change. I will explain the different elements in this configuration in future posts as the intention of this post is to quickly get started with Spring Security as promised earlier. Step 3 - wire everything now in the web.xml. The modified web.xml looks like the one shown be...

1> Add jstl.jar (version 1.1 i guess) to your WEB-INF/lib folder 2> Modify index.jsp as shown below Listing 1 - index.jsp 3> Add a controller for the landing or index page. Listing 2 - EntryController.java 4> Add a controller for the upload page view Listing 3 - UploadController.java 5> Time to launch the browser and test it on the browser. Figure 1 - Skyphotos 6> Click on upload photo, you will see it is accessible to any one. But only logged on users should be able to access that page. Figure 2 - secure page In the next post I will start with the first step to ensure that a user is logged in / signed in before he or she can access the upload photo page.