Annotations Name Description @Model Interface, holder for model attributes @ModelMap Class, in ModelMap attibute key can be omitted and the value of the attribute will be use to generate the key. @ModelAndView ModelAndView it’s a container for both View object and ModelMap @ModelAttribute Annotation that binds a method parameter or method return method to a…
Author: Armando Marques
Spring Security Entities
Spring Security Entities
Spring Security
Security concepts Architecture SecurityContextHolder – The SecurityContextHolder is where Spring Security stores the details of who is authenticated. SecurityContext – is obtained from the SecurityContextHolder and contains the Authentication of the currently authenticated user. Authentication – Can be the input to AuthenticationManager to provide the credentials a user has provided to authenticate or the current…
Spring Security II
Security filters Spring Security MVC is based on Server Filters. DelegatingFilterProxy – Filter implementation that allows bridging between servlet container lifecycle and ApplicationContext. This filter follows standard servlets containers mechanisms but delegates all work to a spring bean that implements filter. FilterChainProxy – special filter, provided by Spring Security that allows delegating to many filter…
Method security
Spring Security’s method authorization support is handy for: And since Method Security is built using Spring AoP. Annotation @EnableMethodSecurity Annotation @Secured is a legacy option to authorize invocations, superseded by @PreAuthorized. JSR 250 annotations correspond to @RolesAllowed, @PermitAll and @DenyAll. Annotations @PreAuthorize and @PostAuthorize – verifies condition before or after method invocation. @PreFilter and @PostFilter…