High level overview of how spring security manages csrf

 

CSRF token is used only for HTTP POST, PUT, PATCH AND DELETE methods.

High level overview of How JDBCUSERDETAILSMANAGER is used to authenticate a user?

 

How authenticationProvide interact with UserDetailService?

 

The AuthenticationProvider is the component that implements the authentication logic and uses the UserDetailsService to load details about the user. To find the user by username, it calls the loadUserByUsername(String username) method.

Relationship between UserDetailService, UserDetails and UserDetails manager

 

The UserDetailsService returns the details of a user, finding the user by its name. The UserDetails contract describes the user. A user has one or more authorities, represented by the GrantedAuthority interface. To add operations such as create, delete, or change password to the user, the UserDetailsManager contract extends UserDetailsService to add operations.

Spring security high level architecture

 

Minimum maven dependencies for spring security

 We should add those below dependencies to pom.xml-

<dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-web</artifactId>

             <version>${springsecurity.version}</version>

</dependency>

<dependency>

            <groupId>org.springframework.security</groupId>

            <artifactId>spring-security-config</artifactId>

             <version>${springsecurity.version}</version>

</dependency>