[NEW] Spring Security 7 + OAuth2 + JWT + Auth0 + Keycloak

$12.99 (91% OFF)

About This Course

<div>What are we going to cover</div><div> </div><div>Spring Security Basics</div><div><ul><li>Master Security</li><li>Security in Spring Boot & Microservices</li><li>Why Security for your spring boot app?</li><li>What is Spring Security?</li><li>Key Spring Security Concepts</li><li>Authentication</li><li>Authorization</li><li>Servlet Filters</li><li>What are its alternatives?</li><li>Security Implementation - Who’s responsibility</li><li>Let’s get started !</li><li>Why 401 ?</li><li>Summary</li><li>Spring Security: Convention-over-Configuration</li><li>Key Participants in Authentication Framework</li><li>Flow of Authentication in Spring Security</li><li>Spring Security Auto-configured Beans</li><li>UserDetailsService</li><li>PasswordEncoder</li></ul></div><div>Spring Security Configuration</div><div><ul><li>Introduction to POC 2</li><li>Overriding Default Configurations</li><li>Customizing Spring Security Configuration</li><li>Why Authentication Fails Now</li><li>Fixing Authentication Step by Step</li><li>Define User Credentials</li><li>Adding User to InMemoryUserDetailsManager</li><li>Defining a PasswordEncoder Bean</li><li>Why Avoid HTTP Basic Authentication?</li></ul></div><div>User Management</div><div><ul><li>User Management</li><li>User Management Components</li><li>UserDetails</li><li>UserDetailsManager</li><li>User</li><li>Customising User Details Service</li><li>POC 3</li><li>Creating User & Authority Table</li><li>Mapping User & Authorities table</li><li>Why Authorities are eagerly fetched</li><li>Fetch saved Authorities from SecurityContext</li></ul></div><div>Authorization</div><div><ul><li>Authorization</li><li>How Authorization works</li><li>What are we going to learn</li><li>GrantedAuthority</li><li>Difference between Authorities and Roles</li><li>Authorization implementations level</li><li>Endpoint Level Authorization</li></ul></div><div>Security Filter Chain</div><div><ul><li>Security Filter Chain</li><li>Defining a Filter Chain</li><li>Modifying Filter chain</li><li>Why still 403 ?</li><li>anyRequest().authenticated()</li><li>anyRequest().permitAll()</li><li>anyRequest().hasAuthority()</li><li>anyRequest().hasAnyAuthority()</li><li>Role</li><li>anyRequest().hasRole()</li><li>anyRequest().hasAnyRole()</li><li>401 VS 403</li><li>anyRequest().access()</li><li>Advantage of anyRequest().access()</li><li>Disadvantage of anyRequest().access()</li><li>anyRequest().denyAll()</li></ul></div><div>Request Matchers</div><div><ul><li>Matcher Methods</li><li>List of All Matcher Methods</li><li>Request Matcher</li><li>Request Matcher Methods</li><li>Real-life analogy</li><li>How requestMatchers() works in this setting</li><li>Code Block</li></ul></div><div>Types of Matchers</div><div><ul><li>Ant Matcher</li><li>ANT Matcher Methods</li><li>Why it was popular</li><li>Example in Spring Security 5.x</li><li>Why Deprecated in Spring Security 6+</li><li>MVC Matcher</li><li>MVC Matcher Methods</li><li>Why it was used</li><li>Regex Matcher</li><li>regexMatchers()</li><li>Why use it</li><li>Dispatcher Type Matcher</li><li>Purpose - What is DispatcherType</li><li>Servlet Path Matcher</li><li>Purpose</li><li>Is it any relevant in spring boot app?</li><li>Combining all Matcher methods</li></ul></div><div>Method Level Security</div><div><ul><li>Authorization at the method level</li><li>Where do we stand now?</li><li>Can Spring Security Be Used in Non-Web Applications?</li><li>Where Can You Apply Method Security?</li><li>Why Use Method Security?</li><li>Role of Authentication in Enabling Method Security</li><li>Why Not Use permitAll() with Method Security</li><li>Code snippet</li><li>Enabling method security</li><li>New way of enabling Method level Authorization</li><li>What Happens Behind the Scenes</li><li>Why Called “Aspect Behind the Scene”?</li><li>Prevent GOD class with Method level Authorization?</li><li>Best Practice</li><li>Priority of Rules: Security Config vs Method-Level Authorization</li><li>Performance Consideration: Method-Level vs Filter-Level Authorization</li><li>How Method-Level Security Goes Beyond Filters</li><li>Multi-line @PreAuthorize for Complex Security Rules</li><li>Disadvantages of Multi-line rules</li><li>Moving Beyond SpEL: Bean-Based Security Checks</li><li>Post Authorize</li><li>Difference Between @PreAuthorize and @PostAuthorize</li></ul></div><div>Filters in Method Security</div><div><ul><li>Pre filter</li><li>Pre filter - Key Pointers</li><li>Postfilter - Key Pointers</li><li>Post Filter Pitfalls</li><li>PreFilter VS PostFilter</li><li>@Pre/@PostAuthorize VS @Pre/@PostFilter</li></ul></div><div>OAuth 2 & OIDC Basics</div><div><ul><li>OAuth 2 & OIDC</li><li>Basics</li><li>Actors/Roles in OAuth2</li><li>OAuth 2 Flow</li><li>The OAuth 2.0 Solution</li><li>Why this is powerful</li><li>Steps in OAuth 2</li><li>How to get the token?</li><li>Heart of how OAuth2 + Spring Security works</li><li>Grant types</li><li>Types of Grant types</li><li>Deprecated Grant types</li><li>OAuth’s Main Security Principle</li><li>Why Password Grant Type Is Deprecated</li><li>Modern Replacement</li><li>Why Implicit Grant Type Is Deprecated</li><li>Summary</li></ul></div><div>Authorization Code Flow</div><div><ul><li>Authorization Code Flow</li><li>What Is the Authorization Code Grant Type?</li><li>Step-by-Step Flow</li><li>Advantages</li><li>Disadvantages</li></ul></div><div>Authorization Code Flow with PKCE</div><div><ul><li>What is PKCE</li><li>Why PKCE was introduced</li><li>The Players</li><li>Authorization Code Flow with PKCE — Step by Step</li><li>How PKCE Prevents Attacks</li><li>How Verifier & Challenge Work</li><li>Real-World Analogy: The Locker & Key</li><li>Summary of PKCE Flow</li><li>Authorization Code vs Authorization Code + PKCE</li><li>Points to remember</li></ul></div><div>Client Credentials Flow</div><div><ul><li>Client Credentials Grant Type</li><li>What is Client Credentials grant</li><li>When to use it</li><li>The Actors</li><li>Flow (step-by-step)</li><li>Typical token response</li><li>Client authentication methods with AS</li><li>How Scopes → Authorities Mapping Works</li><li>Scopes & authorities</li><li>Tokens: JWT vs opaque</li><li>Security considerations / best practices</li><li>Pitfalls & gotchas</li></ul></div><div>Refresh Token Flow</div><div><ul><li>Refresh Token Grant Type</li><li>What is a Refresh Token?</li><li>Why Refresh Tokens Exist</li><li>Who uses the Refresh Token flow?</li><li>Refresh Token Grant Type Flow</li><li>Static (Reusable) Refresh Tokens</li><li>Rotating (One-time) Refresh Tokens</li><li>How OAuth2 servers decide</li><li>What clients must do</li><li>Key Token Lifetimes</li><li>Why Refresh Tokens Are Sensitive</li><li>Refresh Token Flow vs Access Token Flow</li></ul></div><div>Tokens</div><div><ul><li>What is opaque token?</li><li>How opaque token Works?</li><li>Introspection response</li><li>Non-opaque tokens vs opaque tokens</li></ul></div><div>JWT</div><div><ul><li>JWTs</li><li>What is a JWT?</li><li>The basic structure of a JWT</li><li>How JWT works</li><li>JWT signing methods</li><li>Common JWT claims</li><li>How JWTs are verified</li><li>Private and Public keys</li><li>What is /jwks.json?</li><li>Why JWTs are so popular</li><li>Limitations / Pitfalls</li></ul></div><div>OIDC</div><div><ul><li>OIDC</li><li>What is OIDC</li><li>Authorization code flow with PKCE</li><li>Real-world example (Google Login)</li><li>Why OIDC exists</li><li>What OIDC Actually Is</li><li>Core Components in OIDC</li><li>ID Token</li><li>Standard Claims in ID Token</li><li>OIDC Scopes</li><li>OIDC Endpoints</li><li>Benefits of OIDC</li><li>Common pitfalls</li><li>Nonce</li><li>Why Nonce</li></ul></div><div>SSO</div><div><ul><li>SSO</li><li>What is SSO</li><li>Actors in SSO</li><li>Steps in SSO</li><li>Why SSO works</li><li>Common Pitfalls Of SSO</li><li>Security benefit of SSO</li><li>SSO Logout Scenarios</li><li>Why OAuth2 + OIDC are REQUIRED for SSO</li></ul></div><div>CSRF</div><div><ul><li>CSRF</li><li>What is CSRF</li><li>Core browser behavior</li><li>Why CSRF is dangerous</li><li>How websites stop CSRF</li><li>Why Spring Security enables CSRF by default</li></ul></div><div>CORS</div><div><ul><li>CORS</li><li>What is CORS</li><li>Why CORS exists</li><li>What is an origin</li><li>CORS Rule</li><li>Spring Boot CORS config</li><li>Common CORS mistakes</li><li>CORS vs CSRF</li></ul></div><div>Full Stack POC</div><div><ul><li>Full stack POC</li><li>Intro to Foodify App</li><li>UI Of Foodify App POC</li><li>Backend Of Foodify App POC</li><li>Auth0 configurations</li><li>Spring Security Implementation</li></ul></div><div>Auth0</div><div><ul><li>What is Auth0</li><li>Key Components of Auth0</li><li>What Happens During Login</li><li>Why Use Auth0</li><li>MFA</li><li>Social Login</li><li>Centralized Identity</li><li>Developer Productivity</li><li>When SHOULD you build yourself?</li></ul></div><div>Roles & Permissions</div><div><ul><li>What is Authentication vs Authorization?</li><li>What is OAuth2 / OIDC?</li><li>Architecture for End to end POC with Auth0</li><li>What is Application in Auth0?</li><li>What is API in Auth0?</li><li>What is Audience?</li><li>What are Roles?</li><li>What are Permissions?</li><li>Roles vs Permissions</li><li>RBAC</li><li>Why RBAC is Used</li><li>Why roles & permissions in JWT?</li></ul></div><div>JWT Processing in Spring Security</div><div><ul><li>What is JwtDecoder?</li><li>What is JwtAuthenticationConverter?</li><li>What is Authority in Spring?</li><li>ROLE_ prefix</li><li>Common Mistakes</li></ul></div><div>Implementation Steps</div><div><ul><li>Steps to Implement Spring Security</li><li>Steps to setup Auth0</li><li>Steps to add Roles in token</li><li>What happens in backend</li><li>FINAL FLOW (END-TO-END)</li><li>KEY CONCEPTS</li><li>COMMON MISTAKES</li></ul></div><div>Keycloak</div><div><ul><li>Keycloak</li><li>What is Keycloak?</li><li>High Level Architecture</li><li>Core Terminologies</li><li>Types of Clients</li><li>Role Types</li><li>Client Scope</li><li>Groups</li><li>Identity Provider (IDP)</li><li>Flows</li><li>Keycloak vs Auth0</li><li>Feature Comparison</li><li>who should choose Keycloak vs Auth0</li></ul></div><div>Social Login</div><div><ul><li>Social Login</li><li>What is Social Login</li><li>How Social Login works</li><li>Benefits of Social Login</li><li>Configure Identity Providers in Keycloak</li><li>Google login Steps</li><li>Github social login steps</li></ul></div>

What you'll learn:

MASTER SPRING SECURITY 7 architecture including Authentication, Authorization, Security Filter Chain, and internal request flow
IMPLEMENT USER AUTHENTICATION using UserDetailsService, PasswordEncoder, and database-backed user management
UNDERSTAND ROLES vs AUTHORITIES and implement RBAC (Role-Based Access Control) & ABAC in real applications
APPLY ENDPOINT LEVEL SECURITY and METHOD LEVEL SECURITY using @PreAuthorize and @PostAuthorize
UNDERSTAND REQUEST MATCHERS including Ant, MVC, Regex, and modern Spring Security 6 approaches
MASTER OAUTH2 FUNDAMENTALS including actors, scopes, flows, and secure authorization architecture
IMPLEMENT AUTHORIZATION CODE FLOW and PKCE FLOW used by modern web and mobile applications
IMPLEMENT CLIENT CREDENTIALS FLOW for secure machine-to-machine communication
IMPLEMENT REFRESH TOKEN FLOW and understand token lifecycle and security best practices
MASTER JWT SECURITY including token structure, claims, signing, verification, and public/private key cryptography
IMPLEMENT JWT validation using JwtDecoder and JwtAuthenticationConverter in Spring Boot
UNDERSTAND OIDC (OpenID Connect) and how identity layer works on top of OAuth2
IMPLEMENT SSO (Single Sign-On) architecture using OAuth2 and OIDC
UNDERSTAND CSRF protection and why Spring Security enables CSRF by default
IMPLEMENT CORS configuration and understand cross-origin security behavior
IMPLEMENT AUTH0 including Applications, APIs, Audience, Roles, and Permissions mapping in JWT
IMPLEMENT KEYCLOAK including Realm, Clients, Roles, Groups, and identity provider configuration
IMPLEMENT SOCIAL LOGIN using Google and GitHub with OAuth2 / OIDC
IMPLEMENT RBAC IN MICROSERVICES using roles and permissions extracted from JWT tokens
UNDERSTAND JWT vs OPAQUE TOKENS and when each token strategy should be used
DESIGN END-TO-END SECURITY ARCHITECTURE used in real enterprise applications
BUILD FULL STACK APPLICATION using Angular + Spring Boot secured with Spring Security
BUILD FULL STACK AUTH0 POC implementing login, roles, permissions, and JWT-secured APIs
BUILD FULL STACK KEYCLOAK POC implementing realm, clients, roles, and secured microservices
IMPLEMENT COMPLETE AUTHENTICATION FLOW from frontend login to secured backend APIs
APPLY SECURITY BEST PRACTICES and avoid common mistakes in production systems
UNDERSTAND KEYCLOAK vs AUTH0 differences and when to choose each

About This Course

What you'll learn:

More Course Deals