#spring security

Today’s busy digital world pushes businesses to find backend solutions that can grow, stay secure, and be easy to maintain. CloudKodeForm Technologies meets this need using Spring Framework and Spring Boot — two trusted tools in modern Java development.

What Is Spring? Spring is a flexible, modular system for building large Java programs. Spring Boot simplifies setup with automatic configuration and starter templates. This helps teams launch ready-to-run applications with little work. Over the past 20 years, Spring has grown into a full package that handles web APIs, data access, messaging, security, and cloud-based tasks.

Why CloudKodeForm Technologies Prefers Spring

CloudKodeForm Technologies states, “We develop secure, reliable, and enterprise-level apps with Spring Boot and the entire Spring ecosystem.” our focus on safety, dependability, and enterprise use is clear:

Fewer repetitive tasks — Developers spend less time configuring and more time focusing on core features.

Trusted modules — Spring Security, Data, Cloud, and Batch are trusted globally.

Ready for production — Built-in features include monitoring, health checks, metrics, and external configs.

Key Strengths of Spring at CloudKodeForm Technologies

Faster Development Spring Boot’s preset starters make creating microservices or APIs quick — often in just minutes. Whether connecting to MySQL through Spring Data JPA or setting up REST endpoints with Spring Web, the process remains straightforward.

Strong Security for Business Spring Security adds layers of protection. It manages login roles, OAuth2, and JWT tokens. Built-in features also support CSRF, CORS, and password encryption, helping CloudKodeForm meet strict security needs.

Designed for Cloud Use Spring Cloud and Spring Boot work easily with tools like Kubernetes, Docker, and cloud platforms. Features like external settings, service discovery, and failure handling fit perfectly in a microservices setup.

Built-In Monitoring and Control Spring Boot Actuator offers health checks, metrics, tracing, and custom data. CloudKodeForm Technologies can connect this info to systems like Prometheus, ELK, or Zipkin. This lets them spot issues early and keep systems running smoothly.

Modular and Easy to Test Spring’s use of dependency injection helps organize layered apps. Services, data access, and user interfaces can be tested separately. Tools like JUnit, Mockito, and TestContainers make maintenance simple and ensure high quality.

Real Benefits for Companies Fast delivery: Get products to market quicker with reusable parts and simple setup. Reliable operations: Deploy with confidence using built-in health checks, logs, and monitoring. Flexible future plans: Easily add new features, grow services, or move into reactive or serverless models. Lower costs: Save resources by reusing standard components instead of building everything from scratch.

Why Work with CloudKodeForm Technologies? Our deep experience with Spring means you gain real insight, not just tools. They understand how to structure modular apps, adapt to new versions of Spring, and optimize deployments on cloud services and Kubernetes. We also know how to add monitoring, resilience, and compliance from day one.

@Configuration

@EnableWebSecurity

public class SecurityConfig {

  @Autowired

  private CustomKeycloakPreAuthActionsFilter customKeycloakPreAuthActionsFilter;

  @Autowired

  private LicenseCheckFilter  licenseCheckFilter;

  @Autowired

  private JwtDecoder  jwtDecoder;

  private static final int  YEAR_IN_SECOND = 31_536_000;

  @Bean

  protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

    return  http

      .addFilterBefore(licenseCheckFilter, BasicAuthenticationFilter.class)

      .addFilterAfter(customKeycloakPreAuthActionsFilter, BasicAuthenticationFilter.class)

      .authorizeHttpRequests(authorize -> authorize

        .requestMatchers(new AntPathRequestMatcher("/mcs/*/system/ping")).permitAll()

        .requestMatchers(new AntPathRequestMatcher("/mcs/*/system/privacy-policies", HttpMethod.GET.name())).permitAll()

        .requestMatchers(

            new AntPathRequestMatcher("/mcs/*/account/request-reset-password-email"),

            new AntPathRequestMatcher("/**/account/reset-password-by-email"),

            new AntPathRequestMatcher("/mcs/*/account/reset-password")

          ).permitAll()

        .requestMatchers(

            new AntPathRequestMatcher("/mcs/*/account/request-activate-email"),

            new AntPathRequestMatcher( "/**/account/activate-by-email"),

            new AntPathRequestMatcher("/mcs/*/account/activate")

          ).permitAll()

        .requestMatchers(new AntPathRequestMatcher("/mcs/*/account/session", HttpMethod.PUT.name())).permitAll()

        .requestMatchers(new AntPathRequestMatcher("/mcs/*/account/session", HttpMethod.POST.name())).permitAll()

        .requestMatchers(

            new AntPathRequestMatcher("/mcs/*/event/**")

          ).permitAll()

        .requestMatchers(new AntPathRequestMatcher("/static/**")).permitAll()

        .requestMatchers(

            new AntPathRequestMatcher("/mcs/**")

        ).hasRole("DASHBOARD")

        // all the REST API's must be matched in the above lines

        .anyRequest().permitAll())

      .csrf(csrf -> csrf

        .ignoringRequestMatchers(

            new AntPathRequestMatcher("/mcs/*/account/**"),

            new AntPathRequestMatcher("/**/license"))

        .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()))

      .headers(headers -> headers

        .httpStrictTransportSecurity(hsts -> hsts

          .includeSubDomains(true)

          .maxAgeInSeconds(YEAR_IN_SECOND))

        .xssProtection(xss -> xss.headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK))

        .contentSecurityPolicy(csp -> csp.policyDirectives("script-src 'self' 'unsafe-eval'")))

      .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))

      .oauth2ResourceServer(configurer -> configurer

        .jwt(jwtConfigurer -> jwtConfigurer

          .decoder(jwtDecoder)

          .jwtAuthenticationConverter(jwt -> {

            Map<String, Collection<String>> realmAccess = jwt.getClaim("realm_access");

            Collection<String> roles = realmAccess.get("roles");

            var grantedAuthorities = roles.stream()

              .map(role -> new SimpleGrantedAuthority("ROLE_" + role.toUpperCase()))

              .toList();

            return new JwtAuthenticationToken(jwt, grantedAuthorities);

          })))

      .build();

  }

Una vez visto lo sencillo que es proteger nuestra aplicación de una forma básica, vamos a complicar un poco la idea, trabajando con cuantos usuarios queramos, en memoria Continue reading Spring Security – Trabajando con usuarios en memoria

Spring Security, es una parte del sistema Spring orientado a facilitar los métodos de : Autenticación: verificamos la identidad del usuario. Autorización: tipo de permisos que tiene ese usuario. Esto significa, que previa configuración, nos va a permitir identificar al usuario que está accediendo, y a identificar que permisos tiene, permitiéndonos controlar así, lo que puede hacer en nuestro…

En esta ocasión, vamos a ver como podemos incorporar los tokens, y hacer que Spring Security nos controle igualmente la seguridad de nuestra Api Continue reading Untitled

Tras mostraros como trabajar con usuarios en memoria, en este articulo veremos como utilizar cualquier tablade usuarios para basar la seguridad en la misma. Seremos nosotros los que podremos decidir como van a funcionar todas las caracteristicas de Spring Security, al poder establecer tan dinamicamente como queramos el registro de usuarios Continue reading Untitled