This is the third of a series of articles about setting up a secure RESTful Web Service using Spring 3.1 and Spring Security 3.1 with Java based configuration. This article will focus on the security configuration using Spring Security 3.1, assuming some understanding of Spring Security basics and focusing on the specifics of securing the RESTful web service.
The REST with Spring series:
- Part 1 – Bootstrapping a web application with Spring 3.1 and Java based Configuration
- Part 2 – Building a RESTful Web Service with Spring 3.1 and Java based Configuration
- Part 3 – Securing a RESTful Web Service with Spring Security 3.1
Introducing Spring Security in the web.xml
The architecture of Spring Security is based entirely on servlet filters and, as such, comes before Spring MVC in regards to the processing of HTTP requests. Keeping this in mind, to begin with, a filter needs to be declared in the web.xml of the application:
The filter must necessarily be named ‘springSecurityFilterChain’ to match the default bean created by Spring Security in the container.
Note that the defined filter is not the actual class implementing the security logic but a DelegatingFilterProxy with the purpose of delegating the Filter’s methods to an internal bean. This is done so that the target bean can still benefit from the Spring context lifecycle and flexibility.
The URL pattern used to configure the Filter is /* even though the entire web service is mapped to /api/* so that the security configuration has the option to secure other possible mappings as well, if required.