Authorization

🏰 The Castle Gatekeeper: Spring Security Authorization

Imagine your application is a magnificent castle. Anyone can walk up to the gate, but only special people can enter specific rooms. That’s what Authorization does!

🎭 The Big Picture: What is Authorization?

Think of a school building:

• Authentication = The guard checking your student ID at the entrance
• Authorization = The rules saying which classrooms YOU can enter

You proved WHO you are ✅ (Authentication)
Now we check WHAT you can do ✅ (Authorization)

Real Life Example

🏫 School Building
├── 📚 Library → All students allowed
├── 🔬 Science Lab → Only science students
├── 🏢 Staff Room → Only teachers
└── 🔐 Principal Office → Only principal

🛡️ Authorization Concepts

Authorization answers ONE simple question:

“Is THIS person allowed to do THAT thing?”

The Three Key Players

graph TD
    A["👤 User/Principal"] --> B{🎭 Has Role?}
    B -->|Yes| C["✅ Access Granted"]
    B -->|No| D["❌ Access Denied"]

Code Example: Basic Setup

// User has ROLE_ADMIN
// Can access /admin/** pages

http
  .authorizeHttpRequests()
  .requestMatchers("/admin/**")
  .hasRole("ADMIN");

🛑 CSRF Protection: The Secret Handshake

What is CSRF?

Imagine someone tricks you into clicking a button that transfers YOUR money to THEIR account. Scary, right?

CSRF = Cross-Site Request Forgery A bad guy makes YOUR browser do bad things without YOU knowing

The Token Solution

graph TD
    A["🖥️ Server"] -->|Gives Secret Token| B["📝 Your Form"]
    B -->|Sends Token Back| C["🔍 Server Checks"]
    C -->|Token Matches?| D["✅ Real Request!"]
    C -->|No Token?| E["❌ Fake Request!"]

How Spring Helps

// CSRF is ON by default! 🎉
// Spring adds hidden token to all forms

// Your HTML form gets this automatically:
// <input type="hidden"
//        name="_csrf"
//        value="abc123-secret-token"/>

When to Disable (Rare!)

// Only for REST APIs with JWT tokens
http.csrf().disable();

// WHY? JWT tokens already prevent CSRF
// They're sent in headers, not cookies

🍪 Session Management: Remember Me!

What is a Session?

When you log in, the server gives you a visitor badge (session). You show this badge with every request so you don’t have to log in again.

Session Flow

graph TD
    A["🔐 Login Success"] --> B["🎫 Get Session ID"]
    B --> C["🍪 Stored in Cookie"]
    C --> D["📤 Sent with Every Request"]
    D --> E["🔍 Server Recognizes You"]

Spring Session Controls

http.sessionManagement()
    // One login at a time
    .maximumSessions(1)

    // Kick out old session when new login
    .maxSessionsPreventsLogin(false)

    // Session timeout
    .invalidSessionUrl("/login?expired")

    // Create new session after login (security!)
    .sessionFixation().newSession();

Session Settings Explained

🏷️ Method Security Annotations

The Magic Decorators

Instead of configuring everything in one place, you can protect methods directly!

// First, enable it!
@EnableMethodSecurity
public class SecurityConfig { }

The Three Musketeers 🗡️

1. @PreAuthorize - Check BEFORE running

@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(Long id) {
    // Only admins can delete users
}

2. @PostAuthorize - Check AFTER running

@PostAuthorize("returnObject.owner == principal.username")
public Document getDocument(Long id) {
    // You can only see YOUR documents
    return documentRepo.findById(id);
}

3. @Secured - Simple role check

@Secured("ROLE_MANAGER")
public void approveExpense() {
    // Only managers can approve
}

Quick Reference Table

📜 Authorization Rules

Building Your Security Castle

@Bean
public SecurityFilterChain filterChain(
    HttpSecurity http) throws Exception {

    http.authorizeHttpRequests(auth -> auth
        // 🌍 Public pages (everyone)
        .requestMatchers("/", "/home").permitAll()

        // 👤 User pages (logged in users)
        .requestMatchers("/profile/**").authenticated()

        // 👑 Admin pages (admins only)
        .requestMatchers("/admin/**").hasRole("ADMIN")

        // 🔧 API endpoints (specific permission)
        .requestMatchers("/api/reports/**")
            .hasAuthority("VIEW_REPORTS")

        // 🚫 Everything else needs login
        .anyRequest().authenticated()
    );

    return http.build();
}

Rule Priority = ORDER MATTERS! ⚠️

Rules are checked TOP to BOTTOM
First match wins!

✅ Good Order:
/admin/secret → ADMIN only
/admin/**    → MANAGER or ADMIN
/**          → authenticated

❌ Bad Order:
/**          → authenticated (catches everything!)
/admin/**    → never reached 😱

Common Matchers

🔑 OAuth2 and JWT Basics

The VIP Pass System

OAuth2 = A way to let users login using Google, Facebook, etc. JWT = A special encoded ticket that contains user info

OAuth2: Login with Others

graph LR
    A["👤 User"] -->|Click 'Login with Google'| B["🔵 Google"]
    B -->|Who are you? Password?| A
    A -->|My Google password| B
    B -->|Here's proof token| C[🏠 Your App]
    C -->|Token valid? User info please| B
    B -->|Yes! Here's email, name| C
    C -->|Welcome!| A

JWT: The Magic Ticket 🎟️

JWT = Three parts separated by dots

Header.Payload.Signature

eyJhbGc.eyJzdWI.SflKxw
   |         |        |
   |         |        └── 🔐 Signature (proof it's real)
   |         └── 📦 Payload (user info, expiry)
   └── 📋 Header (token type, algorithm)

JWT Contains:

{
  "sub": "john@email.com",
  "roles": ["USER", "ADMIN"],
  "exp": 1699999999
}

Spring OAuth2 + JWT Setup

// application.yml
spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: your-google-id
            client-secret: your-secret

// Security Config for JWT
http
  .oauth2Login()  // Enable Google/FB login
  .and()
  .oauth2ResourceServer()
  .jwt();  // Accept JWT tokens

OAuth2 vs JWT: When to Use?

🎓 Putting It All Together

graph TD
    A["🚪 Request Arrives"] --> B{🔐 Authenticated?}
    B -->|No| C["📝 Login Page"]
    B -->|Yes| D{🎫 CSRF Valid?}
    D -->|No| E["❌ Forbidden"]
    D -->|Yes| F{📜 Authorized?}
    F -->|No| G["❌ 403 Access Denied"]
    F -->|Yes| H["✅ Process Request"]

Real App Example

@Configuration
@EnableMethodSecurity
public class SecurityConfig {

  @Bean
  SecurityFilterChain security(HttpSecurity http)
      throws Exception {
    return http
      // Session: one device only
      .sessionManagement(s -> s.maximumSessions(1))

      // CSRF: enabled for web, disabled for API
      .csrf(c -> c.ignoringRequestMatchers("/api/**"))

      // Rules
      .authorizeHttpRequests(a -> a
        .requestMatchers("/public/**").permitAll()
        .requestMatchers("/api/**").authenticated()
        .requestMatchers("/admin/**").hasRole("ADMIN")
      )

      // OAuth2 login
      .oauth2Login(Customizer.withDefaults())

      .build();
  }
}

🌟 Key Takeaways

💡 Remember: Authentication says “I know who you are.” Authorization says “Here’s what you’re allowed to do.”

You’ve just learned how to be the gatekeeper of your Spring castle! 🏰