Spring-Security-101 Flashcards
Which min java version is required for Spring security?
8
What is the artifactid for spring security?
spring-boot-starter-security
What is full form of CSRF?
Cross Site Request Forgery
What is Synchronizer Token Pattern?
It requires that each http request must contain random token name csrf
How can an eavesdropper cannot read the csrf token?
Because it is encryted and also the same origin policy restricts
What is a Same Site attribute in cookies?
This attributes has two values , String and LAx
The Strict says the cookin must come from the same site, or else cookie wont be included, Lax says the request could come from the top level domain
In case because of Samesite attribute, the cookin is not included, how will it save the CSRF attack?
As cookies has the sessionid included, since the cookie wont be inculded in case of not the same site. Thus the absence of session id .
How we can let the MPfile to be uploaded with csrf security?
We can use the CSRF attache din Body ( this ill lead to upload and read the temporary file) or in URL param(not recommended)
What is the role of cache headers i it?
By default the caching is disabled for all sorts of http request and resources, but yes can be tweaked.
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: 0
What is content-sniffing?
There are many browsers like that reads the content-type first of the resources send for a bettter UX.
What is the issue associated with content-sniffing?
It will help attackers to post an XSS attack
What is XSS?
Cross-Site Scripting
How does SSecure safeguards the content-sniffing?
Bu adding the http header: X-Content-Type-Options: nosniff
What is the full form of HSTS?
Http Strict Transport Security
What is HSTS?
So it hap[pens when a user has typed without https, this will add the site to the browser by default https prptocol list
How can it be HSTS list be preloaded into the browser?
By somehow preleading while updates or if the bank is called then adding the Strict-Transport-Security: max-age: … header
How can we avoid clickjacking
With X-Frame-Options: Deny header
What is CSP full form?
Content-Security-Piloicy
What is CSP?
it is to mitigate the XSS and the like attakcs.It makes the browser to guide what to do and and from where to do, for e.g. Content-Security-Policy: script-src domain.com… says from where only to load the scripts
Can SSecurity routes http to https site?
YEs
How can SS helps in removing the load balancer fog?
By using server.use-forward-headers
What is JOSE
Javascript Object Signing & Encryption
What all standards come in JOSE?
JWT(Json Web Token)
JWS(JSOn Web Signature)
JWE(Json Web Encryption)
JWK(Json Web Key)
How does SpSec gets integrated with Servlet Container?
By using a fileter: Filter
Can we use Spring in any Servlet based app?
Yes, because it just need to have the “Filter”
How does SpSec enables the Security?
SpSec by default enables a Filter named : SpringSecurityFilterChain, This is a bean.
What is JAAS?
Java Authentication and Authorization Service Policy File
What is core component for SpSec?
spring-security-core
What is SecurityContextHolder?
It is the fundamental context in Spring Security, and it knows the Principle currently using the app. IT store the info in Threadlocal.
Generally few apps like Desktop doesnot use the Threaloacal ?
Yes So SpringContextHolder can be used to use other mechaniism
How can we obtain the info about current user?
Using Authentication object, populated by SpSec.
Object principle = SecurityContextHolder.getContext().getAuthentication().getPrinciple();
if(principle instanceof UserDetail)
username = (UserDetails) principle.getUserName();
else
username = principle.toString()
What is getContext()
It gives impl of SecurityContext interface
What is UserDetails
It is an adapter between user database or storage and the spring security
Hos do the userdetail is captured inside SpSec?
UserDetailsService interface , it gives only one method and accepts only String username to create the userDetail object.
UserDetails loadUserByName(String username) throws UserNotFoundException
What happens after successful authentication?
The UserDetails obj is used to build the Authentication object which gets stored in SecurityContextHolder
Can we extend UserDetailService object?
Yes many object in Security-core cant be extended without crude purpose, and USerDetailsService Object can be extended , it also uses InMemorMap and JdbcDaoImpl
What basically is UserDetailService>?
It is basically a Dao Sort of Object
What is GrantedAuthority?
to reflect the applicaion-wide permission given to a principle
What are the most basic operations go inside SpSec?
When a user logs in with UN and PW , a UsernamePasswordAuthenticationToken (an instance of Authentication interface), this token is passed to the AuthenticationManager to for validation, The AuthenticationManager rerurn Authetication Object, and then SecurutyContext is called by using SecurityContext.getContext,getAuthentication()…
