title: How to perform a basic Spring Boot application security
body: <p>I'm looking forward to deploying my <code>Spring Application</code> on a production environment and i'd like to include some basic and solid <code>security</code> measures.</p>
  
  <p>First things first, i <strong>extended</strong> <code>WebSecurityConfigurerAdapter</code> into my <code>SecurityConfiguration.java</code></p>
  
  <pre class="lang-java prettyprint-override"><code>@EnableWebSecurity
  public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
      @Autowired
      UserDetailsService userDetailsService ;
  
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          // TODO Auto-generated method stub
          auth.userDetailsService(userDetailsService);
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          // TODO Auto-generated method stub
          http.csrf().disable().authorizeRequests()
          .antMatchers("/admin").hasAuthority("ADMIN")
          .antMatchers("/ekab").hasAuthority("EKAB")
          .antMatchers("/dimos").hasAuthority("DIMOS")
          .antMatchers("/","/users/**","/aeds/**","/events/**","/reports/**","*/static/**").permitAll()
          .anyRequest().authenticated()
          .and()
      .formLogin().loginPage("/login")
      .defaultSuccessUrl("/dashboard",true)
          .permitAll()
          .and()
      .logout()
          .permitAll();
      }
  
      @Bean
      public PasswordEncoder getPasswordEncoder() {
          return NoOpPasswordEncoder.getInstance();
      }
  
  
  }
  
  
  </code></pre>
  
  <p>On a production environment <code>CSRF</code> should be enabled, although i don't handle any csrf tokens for now</p>
  
  <ul>
  <li><p><strong>GET</strong> Endpoints: Note that <code>/users/**</code> contains some <strong>GET</strong> endpoints containing <strong>User Information</strong>, can i apply limitations to who visits them?</p></li>
  <li><p><strong>POST</strong> Endpoints: I've also found some ways to secure <strong>POST</strong> by using
  a JSON Web Token , is it a best practice?</p></li>
  </ul>
  
  <p>Spring also provides <strong>OAuth2.0</strong> , <strong>RSA</strong>, <strong>LDAP</strong>, dependencies to enhance security.</p>
  
  <p>Which one should i use? Does these prevent DDOS attacks as well as brute force attacks?</p>
  
  <p>Do i have to make modifications in the application's deployment environment?</p>