Use Spring Security for robust, standard-compliant authentication and authorization in Java web applications. 2. Implement authentication via form-based login or JWT for stateless APIs, ensuring passwords are hashed with BCrypt and tokens are securely managed. 3. Apply authorization using URL-level and method-level controls (e.g., @PreAuthorize) to restrict access based on roles or conditions. 4. Follow security best practices including HTTPS, secure cookies, input validation, CSRF protection, and rate limiting. 5. Avoid custom authentication mechanisms unless absolutely necessary, as they are error-prone and lack built-in safeguards. Spring Security remains the recommended solution for secure, scalable, and maintainable security implementation in Java web apps.

Implementing authentication and authorization in a Java web application is essential for securing access to resources and ensuring that only legitimate users can perform specific actions. Whether you're building a simple web app or a full-fledged enterprise system, here’s how to do it effectively using standard Java technologies and frameworks.

1. Choose the Right Framework: Spring Security (Recommended)

While you can implement security manually using servlet filters and session management, Spring Security is the de facto standard for authentication and authorization in Java web apps. It integrates seamlessly with Spring Boot and provides robust, configurable security features out of the box.

Why Spring Security?

• Handles authentication, authorization, session management, CSRF protection, etc.
• Supports multiple authentication methods (form login, OAuth2, JWT, LDAP, etc.)
• Fine-grained access control via annotations like @PreAuthorize
• Active community and extensive documentation

Add to pom.xml (for Maven):

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

2. Set Up Authentication: How Users Log In

Authentication verifies who the user is. Common approaches:

Form-Based Login (Simple Username/Password)

Spring Security provides default login forms or lets you customize your own.

Example configuration:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(authz -> authz
                .requestMatchers("/public/**").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .permitAll()
                .defaultSuccessUrl("/home")
            )
            .logout(logout -> logout.permitAll());
        return http.build();
    }

    @Bean
    public UserDetailsService userDetailsService() {
        UserDetails user = User.withDefaultPasswordEncoder()
            .username("user")
            .password("password")
            .roles("USER")
            .build();

        UserDetails admin = User.withDefaultPasswordEncoder()
            .username("admin")
            .password("admin")
            .roles("ADMIN")
            .build();

        return new InMemoryUserDetailsManager(user, admin);
    }
}

?? Note: Never use withDefaultPasswordEncoder() in production. Use BCrypt instead.

JWT (Stateless Authentication)

For REST APIs or microservices, use JWT (JSON Web Tokens) instead of sessions.

Steps:

• User logs in with credentials.
• Server validates and returns a signed JWT.
• Client sends JWT in Authorization: Bearer <token> header.
• Server validates token on each request.

Use libraries like jjwt:

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>

Create a filter to intercept requests and validate JWT tokens.

3. Implement Authorization: What Users Can Do

Authorization determines what an authenticated user is allowed to do.

URL-Level Security

Restrict access based on URL patterns:

.authorizeHttpRequests(authz -> authz
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .requestMatchers("/profile").authenticated()
    .anyRequest().permitAll()
)

Method-Level Security

Use annotations like @PreAuthorize:

@Service
public class UserService {

    @PreAuthorize("hasRole('ADMIN') or #userId == authentication.principal.id")
    public User getUser(int userId) {
        // only admin or self can access
    }
}

Enable method-level security:

@Configuration
@EnableMethodSecurity
public class SecurityConfig { ... }

4. Secure Best Practices

• ? Use HTTPS in production to protect credentials and tokens.
• ? Hash passwords using strong algorithms like BCrypt.
• ? Validate and sanitize inputs to prevent injection attacks.
• ? Set secure cookie flags (HttpOnly, Secure, SameSite).
• ? Implement rate limiting to prevent brute-force attacks.
• ? Use CSRF protection for stateful sessions (enabled by default in Spring Security).

5. Alternative: Custom Authentication (Not Recommended for Most Cases)

You can manually handle authentication using:

• Servlet filters
• HttpSession to track logged-in users
• Custom login servlets

But this approach is error-prone and lacks built-in protections. Only consider it for very specific legacy needs.

Example filter snippet:

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) {
    HttpServletRequest request = (HttpServletRequest) req;
    HttpServletResponse response = (HttpServletResponse) res;

    if (request.getSession().getAttribute("user") == null) {
        response.sendRedirect("/login");
        return;
    }
    chain.doFilter(request, response);
}

Again, prefer Spring Security unless you have a strong reason not to.

Final Notes

• For simple apps: Spring Security in-memory or database users
• For APIs: Spring Security JWT stateless setup
• For social login: Spring Security OAuth2 / OpenID Connect

Basically, use Spring Security, configure it properly, hash passwords, and always validate who can access what. It’s not trivial, but getting it right keeps your app safe.

The above is the detailed content of Implementing Authentication and Authorization in a Java Web App. For more information, please follow other related articles on the PHP Chinese website!