Java Spring Framework: Spring Boot, Spring MVC, and Spring Security Tutorial

Spring Boot simplifies the process of creating stand-alone, production-grade Spring-based applications. It provides defaults for code and configuration, allowing you to focus on business logic.

• Key Features:
  • Auto-configuration for Spring and third-party libraries.
  • Embedded servers like Tomcat, Jetty, and Undertow.
  • Production-ready features like metrics, health checks, and externalized configuration.
• Creating a Spring Boot Application:
  Edit Copy

  import org.springframework.boot.SpringApplication;
  import org.springframework.boot.autoconfigure.SpringBootApplication;
  
  @SpringBootApplication
  public class MyApp {
      public static void main(String[] args) {
          SpringApplication.run(MyApp.class, args);
      }
  }

• Adding a REST Controller:

  import org.springframework.web.bind.annotation.GetMapping;
  import org.springframework.web.bind.annotation.RestController;
  
  @RestController
  public class HelloController {
      @GetMapping("/hello")
      public String sayHello() {
          return "Hello, World!";
      }
  }

Spring MVC is a web framework built on the Servlet API that provides a model-view-controller architecture for building web applications.

• Key Features:
  • Supports RESTful web services and traditional web applications.
  • Flexible view resolution (JSP, Thymeleaf, etc.).
  • Integration with Spring Boot for easy configuration.
• Example: Spring MVC Controller:
  Edit Copy

  import org.springframework.stereotype.Controller;
  import org.springframework.web.bind.annotation.GetMapping;
  import org.springframework.web.bind.annotation.RequestMapping;
  
  @Controller
  @RequestMapping("/greet")
  public class GreetingController {
      @GetMapping("/hello")
      public String sayHello() {
          return "hello"; // Returns the view name (hello.jsp or hello.html)
      }
  }

Spring Security is a powerful framework for securing Spring-based applications. It provides authentication, authorization, and protection against common security vulnerabilities.

• Key Features:
  • Authentication (e.g., form-based, OAuth2, JWT).
  • Authorization (e.g., role-based access control).
  • Protection against attacks like CSRF, XSS, and SQL injection.
• Example: Securing a Spring Boot Application:
  Edit Copy

  import org.springframework.context.annotation.Bean;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.web.SecurityFilterChain;
  
  @EnableWebSecurity
  public class SecurityConfig {
      @Bean
      public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
          http
              .authorizeHttpRequests((requests) -> requests
                  .requestMatchers("/public/**").permitAll()
                  .anyRequest().authenticated()
              )
              .formLogin((form) -> form
                  .loginPage("/login")
                  .permitAll()
              )
              .logout((logout) -> logout.permitAll());
          return http.build();
      }
  }

You can combine Spring Boot, Spring MVC, and Spring Security to build a secure and scalable web application.

• Example: Secure Web Application:
  Edit Copy

  @SpringBootApplication
  public class SecureApp {
      public static void main(String[] args) {
          SpringApplication.run(SecureApp.class, args);
      }
  }
  
  @RestController
  class HomeController {
      @GetMapping("/")
      public String home() {
          return "Welcome to the secure application!";
      }
  }
  
  @EnableWebSecurity
  class SecurityConfig {
      @Bean
      public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
          http
              .authorizeHttpRequests((requests) -> requests
                  .requestMatchers("/").permitAll()
                  .anyRequest().authenticated()
              )
              .formLogin((form) -> form
                  .loginPage("/login")
                  .permitAll()
              )
              .logout((logout) -> logout.permitAll());
          return http.build();
      }
  }