Skip to main content

Spring Security 安全

1. How to you secure your REST API?​

  • Always use only HTTPS protocol.
  • Use Password Hash.
  • Rely on framework provided validation features as they are tested by large community already.
  • Always validate data in back-end server.
  • Use quotas and rate limiting. Make rules for throttling to protect your APIs from spikes and Denial-of-Service attacks.
  • Use an API gateway to authenticate traffic as well as control and analyze how your APIs are used.
  • Use a WAF. Integrate a web application firewall for detecting malicious payload

2. What is Spring security authentication and authorization?​

  • Authentication 身份认证
    • to verify who a user is.
    • eg. username and password
  • Authorization 授权 权限鉴定
    • to verify what permissions they have
    • different permissions for different roles, like ROLE_USER, ROLE_ADMIN

3. What do you mean by basic authentication?​

  • Basic Authentication is a method for an HTTP user agent (e.g., a web browser) to provide a username and password when making a request. When employing Basic Authentication, users include an encoded string in the Authorization header of each request they make.

4. Explain SecurityContext and SecurityContext Holder in Spring security?​

  • The SecurityContext and SecurityContextHolder are two fundamental classes of Spring Security. The SecurityContext is used to store the details of the currently authenticated user, also known as a principle. So, if you have to get the username or any other user details, you need to get this SecurityContext first.

5. Explain spring security OAuth2​

  • It serves as an open authorization protocol for enabling a third party application to get limited access to an HTTP service on behalf of the resource owner. It can do so while not revealing the identity or the long-term credentials of the user. A third-party application itself can also use it on its behalf.
  • The working principle of OAuth2 consists of the delegation of user authentication to a service hosting the user account and authorizing the third-party application access to the account of the user. eg. a user login a website by Github account or Google account.

6. What is PasswordEncoder?​

  • When the user registers in the application we hash the password and save it to the database.
  • When the user wants to authenticate, we hash the provided password and compare it with the password hash from the database.
  • password hashing algorithms
    • bcrypt
    • scrypt
    • PBKDF2
    • md5

7. Explain salting and its usage​

  • A salt is a sequence of randomly generated bytes that is hashed along with the password. The salt is stored in the storage and doesn’t need to be protected.
  • Whenever the user tries to authenticate, the user’s password is hashed with the saved salt and the result should match the stored password.

8. What is JWT?​

  • JWT, or JSON Web Token, is an open standard used to share security information between two parties — a client and a server. Each JWT contains encoded JSON objects, including a set of claims. JWTs are signed using a cryptographic algorithm to ensure that the claims cannot be altered after the token is issued.
  • JSON Web Tokens are useful for:
    • Authorization
    • Information Exchange
  • JSON Web Tokens consist of three parts separated by dots ., which are:
    • Header
    • Payload
    • Signature
  • Therefore, a JWT typically looks like the following.
  • xxxxx.yyyyy.zzzzz
  • Session
    • Sessions are server-side files that contain user data. 服务端储存 更消耗服务端资源
    • When the user quits the browser or logs out of the programmed, the session is over.
    • Session are more secured compare than cookies.
  • Cookie
    • Cookies are client-side files on a local computer that hold user information.
    • Cookies end on the lifetime set by the user. We can set expiration time, e.g. 7 days
    • Client sends the request with Cookie in the http request

10. What is Spring Security Filter Chain?​

  • Spring Security's web infrastructure is based entirely on standard servlet filters. It doesn't use servlets or any other servlet-based frameworks (such as Spring MVC) internally, so it has no strong links to any particular web technology. It deals in HttpServletRequests and HttpServletResponses and doesn't care whether the requests come from a browser, a web service client, an HttpInvoker or an AJAX application.
  • Spring Security maintains a filter chain internally where each of the filters has a particular responsibility and filters are added or removed from the configuration depending on which services are required. The ordering of the filters is important as there are dependencies between them. If you have been using namespace configuration, then the filters are automatically configured for you and you don't have to define any Spring beans explicitly but here may be times when you want full control over the security filter chain, either because you are using features which aren't supported in the namespace, or you are using your own customized versions of classes.