You just revived my passion for spring boot based backend development. Thank you so much. This is the best spring security crash course I've found on RU-vid even better than the inspirations you mentioned in this video. The reason is, that you used less jargon and fancy Java. You showed basic Java skills to explain an already complex spring security concept which feels smooth. Most of the creators from the Java community tend to use a lot of fancy Java design patterns and advanced Java features which causes great difficulty for freshers to understand such complex concepts. Constructive Criticism: I have one small suggestion for you, the cutting of your voice is really not good. There are no pauses between your speech, leading to you sounding monotonous even when you're not. Also, it made me rewind many times since I never understood where one sentence ended and the other began. Love your content. keep going ♥
This video hit the nail on the head, I watched countless other videos from other people before I found this one, and the content was either outdated or poorly explained. I appreciate that you did everything from scratch and explained each step. Wish I found this video about 8 videos earlier, but I finally understand the whole implementation process for Jwt's. 11/10 will watch again.
All I could say this is an extraordinary tutorial. I tried all of the spring security tutorials but they did not cover the nitty gritty aspects of it like the jwt token creation and authorization but you just were superb. Thank you very much for uploading a gem ❤
Great video and working around the deprecated methods wasn’t too bad and was a very good practice of working with documentation. Thanks for putting this all together. 👏🏼👏🏼👏🏼
Holy crap. Thank you so much; this is amazing. Top tier content. I learned so much from this compared to hours of Amigoscode or Dan Vega. Nothing against those guys, they just have so much content to get through and a lot of it is outdated. Thank you so much for putting this together. I got what I needed out of it and then some.
Liked the video! Here's an idea for future tutorials, can you create git branches for each chapter? this way we can go back and forth between different chapters to compare and contrast the changes.
Man, this video is top notch. It is exactly what was missing from youtube. Could you, please, share with us, how did you figure all this out? What materials did you use for documentation or how was your thought process? Or maybe is it just experience? I watched Dan Vegas' video about JWT and I was really wondering how to achieve role authorization. I wouldn't have figured it out by myself.
This video is a compilation of everything useful that is said in the other videos, discarding all the other useless things that are said, updating it to the latest versions of spring. Liked the video, keep it up.
What a fantastic to the point video it is, Thank you so much Ethan for sharing valuable knowledge with all of us, my knowledge before and after watching this video has increased very much, looking forward to more of your videos. I had watched a bunch of videos on this topic, but your explanation made it much easy to follow and code along with you.
What I usually want to see in security videos is handling security for different type of roles. E.g a backend service for sellers and buyers, drivers and riders, students and teachers and so on
Finally found a video for working around the older deprecated methods. Thank you very much. Edit: Unable to generate the jwt token during login, and getting a 401 Unauthorized error response back. Might be an issue with the deprecated jwt() method in oauth2ResourceServer(oauth2ResourceServerConfigurer::jwt()). But even with the new code oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults())) which provides a default implementation of the oauth2ResourceServerConfigurer class its not working. If anyone has faced the same issue and solved it, Please let me know. Thank you.
I had exact the same issue but I skipped the line 'daoProvider.setPasswordEncoder(passwordEncoder());' under SecurityConfiguration class -> AuthenticationManager ... i had only "daoProvider.setUserDetailsService(detailsService);" hope it helps.
@@TheMrBatica Thanks, I had the same problem. Maybe someone has the same issue, so here I put proper code: @Bean public AuthenticationManager authManager(UserDetailsService detailsService) { DaoAuthenticationProvider daoProvider = new DaoAuthenticationProvider(); daoProvider.setUserDetailsService(detailsService); daoProvider.setPasswordEncoder(passwordEncoder()); return new ProviderManager(daoProvider); }
This was fantastic! I followed it, but changed JPA to jdbcTemplate, because the road to Hell is paved with too much abstraction. Doing it that way, everything made perfect sense. Thank you!
Good video, I watched it to the end, kinda hard to understand the whole thing because I've just started learning this framework but with the time for sure I will comeback and watch it again!
I have done exactly as you have mentioned in the video upto configuring basic authentication, I keep getting 401 unauthorized exception despite supplying the username and password correctly
Wow, first time I get it right. Thank you! This channel should have much more followers. I had some issues using Lombok, but when I did all the constructors, getters, setters manually it's finally worked! I guess I need more experience with constructors first, then use lombok.
Much needed video on the upgraded ways of Spring Security, I'm glad that i was able to find it I have a request though, could you also post a video on formLogin using spring security
great content video with proper explanation keep doing contents like this 😍, i was looking for this type content for many days, i just wasted a lot of time but this saved my time and can explain how to save roles in DB annd retrieve it from DB and also about OAuth 2.0
Lovely just what i needed ... i'm new to this level of spring security ... so I hope this question isn't a silly one ... i would like to know how and where you generated the public and private key in you code... thank you :)
Hey @Unknown Koder, I fixed the bug you encountered at 1:41:35, apparently this stems from a deprecated use of the jwt() Method, this is the correct way of configuring it as of Spring Security 6.1.x: .oauth2ResourceServer((oauth2) -> oauth2 .jwt(jwtConfigurer -> jwtConfigurer.jwtAuthenticationConverter(jwtAuthenticationConverter())))
fyi if you are struggling with deprecated methods, or other things (example: I was unable to run project due to an error with the security filter chain method, request matchers specifically. You can always just downgrade the version of Spring Boot in your POM.xml to use what was used in the video and everything will work.
Greate tutorial, Am asking for getting an end-point which returns an access token by accepting refresh token, Note Access token should also be returned on login attempt.
Awesome video, I followed everything you said (mostly) and got postman working at the end, but Im a bit confused on how to implement a login page and move to a secured page?
Fantastic video...only problem I recieved was at 1:35:00 during login There is no PasswordEncoder mapped for the id "null" i don't know if I have done something wrong or need to update spring security....it doesnt work with admin as well
I double checked it and there was nothing missing..but when I copied all code from Config class it suddenly worked..thanks for the answer@@unknownkoder
I have one more question though..now that we have functional webapp working through postman.. how can I set up this to work within webpage ? I mean now we have working hashing and tokens.. I created login and register form.html but don't know how to connect those parts together
I had the same problem, for me I had not set the password encoder in the AuthenticationManager Bean in security config @Bean public AuthenticationManager authManager(UserDetailsService detailsService){ DaoAuthenticationProvider daoProvider = new DaoAuthenticationProvider(); daoProvider.setUserDetailsService(detailsService); daoProvider.setPasswordEncoder(passwordEncoder()); //this line I had not written return new ProviderManager(daoProvider); }
Thanks very much for the vid! Really enjoy your teaching style! I am having a bit of a problem though, when I change the loadUserByUsername() method inside the UserService class to call findUserByUsername on the repo, the app stops accepting a valid username & password combination of admin. I have checked the database and the user admin tuple is definately there but I get an error 401 no matter what I enter? Have been stuck on this for a few days so would appreciate any help! Thanks very much in advance!
@@unknownkoder Configuration public class SecurityConfig { @Bean public PasswordEncoder passwordEncoder(){ return new BCryptPasswordEncoder(); } @Bean public AuthenticationManager authenticationManager(UserDetailsService detailsService){ DaoAuthenticationProvider daoAuthenticationProvider = new DaoAuthenticationProvider(); daoAuthenticationProvider.setUserDetailsService(detailsService); return new ProviderManager(daoAuthenticationProvider); } @Bean public SecurityFilterChain filterChain (HttpSecurity http) throws Exception{ http .authorizeHttpRequests((authz) -> authz.anyRequest().authenticated() ) .httpBasic(withDefaults()); return http.build(); } } This is my ssecurityConfig at 47 mins - Can you see anything that might be causing this? Thanks in advance!
@@paulosamvrosiadis3484 Yes! Turns out I wasn't sending the POST request properly. Using postman & ensuring I was sending a POST request properly helped solve it. Goodluck!
Hi, this was an exhaustive example I've been looking for. Thank you very much! I would like to extend this project with static HTML pages. How can I do that? I've added HTML pages (e.g. an index.html under resources/static) but I can't access any of the pages. they're all blank and I get 401 responses to them. I tried to add the static path to auth request matchers, but no joy so far. Any ideas what's missing? Thanks in advance!
Hi man, i have this erro in my securityConfiguration. line : .oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt) Error: 'jwt()' is deprecated and marked for removal Do you no fix?
why so much boilerplate code? why is the framework not making it easier to configure it? Thank you very much for this. Everything else out htere on youtube was deprecated. You also had some deprecated lines but I figured their new implementations out.
Do we really need to return user credentials (even if it's wrapped into some DTO without any sort of sensitive information)? I mean is it so-called "best practice" or we can just return simple status code? Is it mandatory to return anything or we can just use void methods in such cases?
Its not mandatory, however some applications may use some of the users information in the frontend of the application. This is why I send back basic info in the tutorial.
the video is really helpful, but faced a problem, can you help me out ? 1:09:44 => there is no arg for httpBasic() method in Filtercahain config method 1:09:47 => Suddunly a the arg appeared as httpBasic(withDefaults()) can you explain the purpose of withDefault() method? did you create it or it will be refered from somewhere else
If you take a look at the repository in the description, and go to the AuthConfiguration class you will see that withDefault() is a static import from Spring Security.
@@unknownkoder Thanks for clarification, btw the actual problem is, I am facing while adding the permitAll() access to the auth/** for registraion at 1:09:50 , I got an error while starting the server after adding it i.e Factory method 'filterChain' threw exception with message: This method cannot decide whether these patterns are Spring MVC patterns or not. If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); otherwise, please use requestMatchers(AntPathRequestMatcher). so I think it may prevented by adding withDefaults(), but showing same even after addding, can you help me out ?
![Spring Security 6 | How to Create a Login System with Spring Data JPA and JWTs [NEW 2023]](/img/logo.svg){kind=logo}
