The Default Login · Spring Security Introduction in Spring Security | Spring Security

The Generated Login Page

Open any page in the browser and you land on http://localhost:8080/login: a simple "Please sign in" form generated by DefaultLoginPageGeneratingFilter. After a successful login you are sent back to the page you originally asked for.

Browser: GET /orders
   |  not logged in
   v
302 Found  Location: /login        (original URL saved in the session)
   |
Browser: POST /login  username=user&password=...&_csrf=...
   |  credentials OK
   v
302 Found  Location: /orders       (session cookie JSESSIONID issued)
   |
Browser: GET /orders  Cookie: JSESSIONID=...  -> 200 OK

Fixed Development Credentials

Configuration

A new password on every restart is annoying. For local development only, set a fixed user in application.yml:

application.yml

spring:
  security:
    user:
      name: admin
      password: admin123
      roles: ADMIN

Note: This is only for trying things out. Real applications load users from a database with a hashed password (see the Users and Passwords module).

Logging Out

Visit /logout and click the button: the generated page sends POST /logout with a CSRF token, Spring invalidates the session and redirects to /login?logout, which shows "You have been signed out".

Exercise: Add the security starter to a Spring Boot app with one @GetMapping("/hello"). Configure user dev / dev123 and call it with curl.

Show answer

# application.properties
spring.security.user.name=dev
spring.security.user.password=dev123

curl -i localhost:8080/hello              # 401
curl -i -u dev:dev123 localhost:8080/hello  # 200 Hello