Skip to content

Latest commit

 

History

History
53 lines (36 loc) · 1.72 KB

README.md

File metadata and controls

53 lines (36 loc) · 1.72 KB

SpringSecurityAuthTemplate

Built with the tools and technologies:


How does it work?

User logs in via GET request or a default Spring provided login form and gets a csrf token in response. He then sends his CSRF token anytime he wants to make a state-changing request i.e PUT, POST, DELETE. Worst case scenario? attacker gets ur CSRF and tries to make a request but he cudn't coz Spring checks for the JSESSIONID in the sent cookie if it matches the one token was generated for. So even if the attacker also grabs ur JSESSIONID, he wud not b able to send it as a requet header coz the cookie that is automatically sent along with the request will fail the auth coz it will have a different JSESSIONID.

Features

  1. Basic Auth via Login Form
  2. CSRF Safety
  3. Session Hijack Safety

Getting Started

Prerequisites

Before getting started with SpringSecurityAuthTemplate, ensure your runtime environment meets the following requirements:

  • Programming Language: Java

Installation

Install SpringSecurityAuthTemplate using one of the following methods:

Build from source:

  1. Clone the SpringSecurityAuthTemplate repository:
❯ git clone https://github.com/Devang-sharma609/SpringSecurityAuthTemplate
  1. Navigate to the project directory:
❯ cd SpringSecurityAuthTemplate

Usage

Run Application File with the @SpringBootApplication annotation Use Postman for API Requests