深入浅出Spring Security (王松) (Z-Library)

【One-Line Pitch】 A hands-on guide to Spring Security for Java developers who want to move past copy-pasted configuration and actually understand how authentication, authorization, and web attack defense work under the hood. Best for backend engineers already comfortable with Spring Boot who need to secure real projects. 【Book Arc】 - **Opening (~0%–11%)**: Introduces Spring Security's core split between authentication and authorization, its overall architecture, and the default auto-configuration that protects endpoints out of the box. Solves the "what am I even configuring?" confusion. - **Early (~11%–28%)**: Dives into authentication mechanics — form login, user storage via memory/JDBC/MyBatis/JPA, password encoders and the DelegatingPasswordEncoder, plus the builder/configurer source internals (SecurityBuilder, WebSecurityConfigurerAdapter). - **Middle (~28%–56%)**: Covers session and state management — RememberMe token flow, concurrent session control, session sharing with Redis via spring-session, CSRF token defense, HTTP firewall URL blacklists, and security response headers. - **Late (~56%–72%)**: Extends into transport and cross-origin concerns — HTTPS channel requirements, HTTP Basic and Digest authentication filters, and CORS handling through both @CrossOrigin and CorsFilter. - **Ending (~72%+)**: Focuses on exception handling — the AuthenticationException vs AccessDeniedException split, ExceptionTranslationFilter internals, and customizing authentication entry points and access-denied handlers. 【Key Takeaways】 - **Authentication and authorization are deliberately decoupled** (Opening): any authentication method can pair with any authorization rule, which is why the book treats them as separate learning tracks. - **Spring Security auto-defends against attacks you may not know** (Opening): CSRF, session fixation, and malicious URLs are handled by default, so studying the framework doubles as studying common web attacks. - **User storage is pluggable through UserDetailsService** (Early): memory, JDBC, MyBatis, and Spring Data JPA are all shown as interchangeable backends behind the same interface. - **Password encoding uses a delegating scheme** (Early): a prefix-based DelegatingPasswordEncoder maps IDs like bcrypt, argon2, and noop to concrete encoders, enabling automatic upgrade of stored hashes. - **Login success/failure behavior is strategy-driven** (Early): AuthenticationSuccessHandler and AuthenticationFailureHandler implementations control redirects, saved-request replay, and error display. - **Session security is configurable, not automatic** (Middle): concurrent login limits, "kicked offline" behavior, and Redis-backed session registries each require explicit setup. - **CSRF defense rests on token synchronization or SameSite cookies** (Middle): both assume idempotent HTTP methods, and the book walks through the CsrfToken interface and cross-site attack reproduction. - **Exceptions split cleanly into authentication vs access-denied** (Ending): ExceptionTranslationFilter decides which path to take, and custom handlers plug in at AuthenticationEntryPoint and AccessDeniedHandler. 【Reading Tips】 - Deep-read the authentication and authorization chapters first; they are the conceptual spine the rest of the book hangs on. - Skim the source-code walkthroughs (builder states, configurer internals) on a first pass, then return when a configuration behaves unexpectedly. - Treat the attack chapters (CSRF, session fixation, HTTP firewall) as practical checklists for your own projects. - Reproduce the small demo projects as you read — the book teaches through runnable examples rather than abstract theory. - Keep the exception-handling chapter bookmarked; it is the debugging reference you will revisit most. 【Coverage Limits】 This guide is based on stratified excerpts covering the table of contents and selected chapters; some later chapters (e.g., OAuth2, method-level security, or testing) may not be represented. Specific chapter numbering beyond what the excerpts show is not asserted.