# spring sceurity in action

**Repository Path**: u1w2/spring-sceurity-in-action

## Basic Information

- **Project Name**: spring sceurity in action
- **Description**: spring sceurity in action
- **Primary Language**: Unknown
- **License**: Not specified
- **Default Branch**: master
- **Homepage**: None
- **GVP Project**: No

## Statistics

- **Stars**: 0
- **Forks**: 0
- **Created**: 2024-07-05
- **Last Updated**: 2024-07-11

## Categories & Tags

**Categories**: Uncategorized

**Tags**: None

## README



## Overview
This is a sample application that demonstrates of Spring Security In Action.

## Modules
* spring-security-in-action-chapter02: 
  * ssia-ch2-ex1: 
* spring-security-in-action-chapter03: 
  * ssia-ch6-ex1: 
* spring-security-in-action-chapter011:
  * ssia-ch11-ex1-s1: 
  * ssia-ch11-ex1-s2: 


## new Technologies

* JPA
```JAVA
// when you use JPA to persist Enum type, you need to use @Enumerated(EnumType.STRING)
class SomeEntity{
    @Enumerated(EnumType.STRING)
    private Color color; 
}

Enum Color {
    RED,GREEN
}
```

### Authentication process

1. **Collect Authentication Request:**
   The process begins when a user attempts to log in, providing their credentials (usually username and password) to the system.

2. **AuthenticationManager receives Authentication Object:**
   The `AuthenticationManager` is responsible for handling the authentication request. It receives an `Authentication` object that encapsulates the user's credentials.

3. **Delegation to AuthenticationProvider:**
   The `AuthenticationManager` delegates the actual authentication process to one or more `AuthenticationProvider`s. Each provider can handle different types of authentication tokens.

4. **UserDetailsService Loads User Details:**
   The `AuthenticationProvider` calls the `UserDetailsService` to retrieve the user's details from the database. This typically includes the user's role(s), permissions, and other necessary information.

5. **Password Encoding/Decoding:**
   The `PasswordEncoder` is used by the `AuthenticationProvider` to compare the provided password with the stored hashed password. If they match, the authentication is successful; otherwise, it fails.

6. **Authentication Success/Failure:**
   If the credentials are valid, the `AuthenticationProvider` creates a new `Authentication` object with the user's details and returns it to the `AuthenticationManager`. If not, an exception is thrown, indicating authentication failure.

7. **Return Authentication Object:**
   Finally, the `AuthenticationManager` returns the authenticated `Authentication` object to the caller, which can then be used to grant access to protected resources based on the user's roles and permissions.

### Client Authentication process
1. **Client Sends a Request to the Server:**
   A client (such as a web browser or an application) initiates a request to access a protected resource on the server.

2. **Server Checks Credentials:**
   Upon receiving the request, the server checks the provided credentials. This could involve checking a username and password against a database or using token-based authentication methods like OAuth.

3. **Server Responds Based on Credential Validation:**
  - **Credentials Valid:** If the credentials are valid, the server grants access to the requested resource.
  - **Credentials Invalid:** If the credentials are invalid, the server denies access and returns an error message or prompts for re-authentication.

4. **Client Receives Response and Acts Accordingly:**
  - **Access Granted:** The client proceeds to access the protected resource.
  - **Access Denied:** The client may prompt the user for correct credentials or display an error message.

5. **Subsequent Requests:**
   For subsequent requests within the same session:
  - **Session/Token-Based Authentication:** The client includes a session ID or authentication token in each request. The server validates this token instead of asking for credentials repeatedly.
  - **Re-Authentication:** If the session expires or the token is invalidated, the client must re-authenticate.

6. **Process Continues:**
   This cycle repeats for each request made by the client. If access is consistently denied, the client should provide feedback to the user and possibly offer options for resolving authentication issues, such as resetting passwords or contacting support.

It’s important to note that modern authentication systems often use secure mechanisms like HTTPS, OAuth, JWT (JSON Web Tokens), and session management to ensure that the communication between the client and server remains secure throughout the entire process.