انتقل إلى المحتوى
أمين أبوزيد
Englishالعربية
JNR-036

Spring Security

  • 8 درس
  • 4 ساعة تدريب (تقدير)
ابدأ الوحدة
في هذه الصفحة 8 موضوعات

نص الدروس والتمارين باللغة الإنجليزية، بينما تبقى واجهة الموقع وعناوين الدروس بالعربية.

نظرة عامة

الموضوعات

  • SecurityFilterChain
  • سلسلة المرشحات (Filter chain)
  • تفويض الطلبات

تعلّم أولًا

4 ساعة تدريب (تقدير)

مخرجات التعلم

  1. Explain the servlet filter chain and where Spring Security sits in it.
  2. Configure a SecurityFilterChain bean with request-matcher rules.
  3. Load users from the database with a UserDetailsService.
  4. Return correct 401 vs 403 responses with Problem Details bodies.
  5. Test secured endpoints with security test support.

الدروس

  1. 01المرشحات (Filters) وسلسلة مرشحات الأمان
  2. 02إعداد SecurityFilterChain
  3. 03المستخدمون من قاعدة البيانات
  4. 04401 مقابل 403 وأجسام الأخطاء
  5. 05اختبار الأمان
  6. 06قراءة مخرجات التصحيح في Spring Security
  7. 07عرض عملي: تأمين Shop API نقطة نهاية بنقطة نهاية
  8. 08عرض عملي: اختبار مصفوفة الصلاحيات

المختبر والتمارين

Lab

JNR-036-LAB1 · Secure Shop

Outcomes: 1–5 · Time: ~3 h Secure the Shop API: public catalog reads; authenticated cart and orders; admin-only catalog writes. Load users from the database and return Problem Details for 401 and 403. Acceptance: tests cover anonymous, customer, and admin access for every endpoint.

Exercises (assessment: access-matrix test suite)

IDOutcomeTask
JNR-036-EX011Draw the path of a request through the filter chain to a controller and say where a 401 is produced.
JNR-036-EX022Write a chain: GET /api/products/** public, POST and DELETE on products admin only, everything else authenticated.
JNR-036-EX032Find the bug: anyRequest().permitAll() then requestMatchers("/admin/**").hasRole("ADMIN").
JNR-036-EX043Implement a UserDetailsService that loads a user by email from a repository.
JNR-036-EX054Decide 401 or 403: no token; customer token on an admin endpoint; expired token.
JNR-036-EX065Write tests for DELETE /api/products/1 as anonymous, customer, and admin.
JNR-036-EX071, 2Turn on security debug logging and find which rule matched a rejected request.
أظهر الحلول
  • EX01 Request → security filters (auth, authorization, exception translation) → DispatcherServlet → controller; the 401 comes from the entry point inside the filter chain, before the controller.
  • EX02 See the authorizeHttpRequests example: GET permitAll, POST/DELETE hasRole("ADMIN"), then anyRequest().authenticated().
  • EX03 The first matching rule wins, so permitAll makes the admin rule unreachable. Put specific rules first, anyRequest() last and never permitAll.
  • EX04 findByEmail(...).orElseThrow(UsernameNotFoundException::new) and build a User with the stored hash and role.
  • EX05 401; 403; 401.
  • EX06 status().isUnauthorized() anonymous; @WithMockUser(roles="CUSTOMER") expects isForbidden(); @WithMockUser(roles="ADMIN") expects isNoContent() (or the endpoint's success status).
  • EX07 The debug log lines name the matched request matcher and the authorization decision.

الاختبار

Outcomes: O1 filter chain · O2 SecurityFilterChain rules · O3 UserDetailsService · O4 401 vs 403 · O5 security tests.

اختبار ذاتي لك: لا توجد درجات، ولا يُحفظ أو يُرسل أي شيء. اختر إجابة ثم تحقق منها، ويمكنك المحاولة مرة أخرى كما تشاء.

  1. 1Spring Security protects requests mainly through:O1
  2. 2If a security filter rejects a request:O1
  3. 3Rules in authorizeHttpRequests are evaluated:O2
  4. 4The safest last rule is:O2
  5. 5hasRole("ADMIN") checks for the authority:O2
  6. 6UserDetailsService has the method:O3
  7. 7A request with no credentials to a protected URL gets:O4
  8. 8A logged-in customer calls an admin-only endpoint and gets:O4
  9. 9@WithMockUser(roles = "ADMIN") is used to:O5
  10. 10An access-matrix test should include:O5

الجزء العملي

Seven exercises JNR-036-EX01 to EX07 plus the lab; the access-matrix suite is the assessment. Pass: at least six exercises correct, the matrix covers every endpoint for all three callers, and quiz 8 of 10.

أخطاء شائعة

permitAll on /** while debugging and forgetting it; deny rules ordered after broad allow rules.

التقييم

Access-matrix test suite.

الصلة بالمسار الوظيفي

Every secured Spring service.

اكتب للبحث في المستويات والمراحل والوحدات والدروس.