spring security

HTTP Request
    |
    v
DelegatingFilterProxy
    |
    v
FilterChainProxy
    |
    v
SecurityFilterChain (ordered filters)
    +-- DisableEncodeUrlFilter
    +-- SecurityContextHolderFilter
    +-- CsrfFilter
    +-- LogoutFilter
    +-- OAuth2AuthorizationRequestRedirectFilter
    +-- BearerTokenAuthenticationFilter  <- JWT validation
    +-- RequestCacheAwareFilter
    +-- AnonymousAuthenticationFilter
    +-- ExceptionTranslationFilter
    +-- AuthorizationFilter              <- access control
         |
         v
    Controller (if authorized)

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
 
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // Tắt CSRF vì REST API Stateless không dùng Cookie/Session
            .csrf(csrf -> csrf.disable())
 
            // Cấu hình CORS chặt chẽ từ một source tách biệt
            .cors(cors -> cors.configurationSource(corsConfigSource()))
 
            // Ép hệ thống chạy ở chế độ Stateless (Không sinh JSESSIONID)
            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
 
            // Định tuyến quyền truy cập từng endpoint
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health", "/api/public/**", "/error").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/**").authenticated()
                .anyRequest().denyAll() // Nguyên tắc Default Deny
            )
 
            // Tích hợp OAuth2 Resource Server cho JWT
            // JwtDecoder do Spring Boot tự tạo từ cấu hình spring.security.oauth2.resourceserver.jwt.*
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(Customizer.withDefaults())
            )
 
            // Xử lý ngoại lệ thanh lịch
            .exceptionHandling(ex -> ex
                .authenticationEntryPoint(new HttpStatusEntryPoint(HttpStatus.UNAUTHORIZED))
                .accessDeniedHandler((req, res, e) -> res.setStatus(HttpServletResponse.SC_FORBIDDEN))
            );
 
        return http.build();
    }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: http://keycloak:8080/realms/tungdadev-realm
          # Jwks-uri giúp load public key động để verify token signature
          jwk-set-uri: http://keycloak:8080/realms/tungdadev-realm/protocol/openid-connect/certs

@Bean
public JwtAuthenticationConverter jwtAuthenticationConverter() {
   // Spring Security 6.4+: đọc claim lồng nhau bằng biểu thức SpEL
   ExpressionJwtGrantedAuthoritiesConverter authoritiesConverter = new ExpressionJwtGrantedAuthoritiesConverter(
           new SpelExpressionParser().parseRaw("[realm_access][roles]")); // Keycloak format
   authoritiesConverter.setAuthorityPrefix("ROLE_");
 
   JwtAuthenticationConverter converter = new JwtAuthenticationConverter();
   converter.setJwtGrantedAuthoritiesConverter(authoritiesConverter);
   return converter;
}
 
// Hoặc custom converter cho Keycloak nested roles
@Bean
public Converter<Jwt, AbstractAuthenticationToken> keycloakJwtConverter() {
   return jwt -> {
       Collection<GrantedAuthority> authorities = extractKeycloakRoles(jwt);
       return new JwtAuthenticationToken(jwt, authorities, jwt.getClaimAsString("preferred_username"));
   };
}
 
@SuppressWarnings("unchecked")
private Collection<GrantedAuthority> extractKeycloakRoles(Jwt jwt) {
   Map<String, Object> realmAccess = jwt.getClaimAsMap("realm_access");
   if (realmAccess == null || !(realmAccess.get("roles") instanceof List<?>)) return Collections.emptyList();
 
   List<String> roles = (List<String>) realmAccess.get("roles");
   return roles.stream()
       .map(role -> new SimpleGrantedAuthority("ROLE_" + role.toUpperCase()))
       .collect(Collectors.toList());
}

@Service
public class OrderService {
 
    // Chỉ ADMIN mới được xóa
    @PreAuthorize("hasRole('ADMIN')")
    public void deleteOrder(String orderId) { ... }
 
    // User chỉ được lấy danh sách đơn hàng của chính mình
    @PreAuthorize("hasRole('USER') and #userId == authentication.name")
    public List<Order> getOrders(String userId) { ... }
 
    // Gọi đến một permission evaluator bean động
    @PreAuthorize("@permissionEvaluator.hasWorkspaceAccess(#workspaceId, 'READ')")
    public Workspace getWorkspace(String workspaceId) { ... }
 
    // Kiểm tra sau khi chạy: lấy order xong mới check xem có phải của mình không (không hợp lệ thì ném AccessDeniedException)
    @PostAuthorize("returnObject.ownerId == authentication.name or hasRole('ADMIN')")
    public Order getOrder(String orderId) { ... }
}

public class ApiKeyAuthFilter extends OncePerRequestFilter {
 
   private static final String API_KEY_HEADER = "X-API-Key";
 
   private final ApiKeyService apiKeyService;
 
   public ApiKeyAuthFilter(ApiKeyService apiKeyService) {
       this.apiKeyService = apiKeyService;
   }
 
   @Override
   protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain) throws ServletException, IOException {
 
       String apiKey = request.getHeader(API_KEY_HEADER);
 
       if (apiKey != null && apiKeyService.isValid(apiKey)) {
           // ApiKeyAuthentication: class tự viết, kế thừa AbstractAuthenticationToken và gọi setAuthenticated(true)
           ApiKeyAuthentication auth = new ApiKeyAuthentication(apiKey, apiKeyService.getAuthorities(apiKey));
           SecurityContext context = SecurityContextHolder.createEmptyContext();
           context.setAuthentication(auth);
           SecurityContextHolder.setContext(context);
       }
 
       chain.doFilter(request, response);
   }
 
   @Override
   protected boolean shouldNotFilter(HttpServletRequest request) {
       return !request.getRequestURI().startsWith("/api/external/");
   }
}
 
// Register filter
@Bean
public SecurityFilterChain filterChain(HttpSecurity http, ApiKeyService apiKeyService) throws Exception {
   http.addFilterBefore(new ApiKeyAuthFilter(apiKeyService), BearerTokenAuthenticationFilter.class);
   return http.build();
}

@Bean
public CorsConfigurationSource corsConfigSource() {
   CorsConfiguration config = new CorsConfiguration();
   config.setAllowedOrigins(List.of("http://localhost:3000", "https://app.example.com"));
   config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
   config.setAllowedHeaders(List.of("*"));
   config.setAllowCredentials(true);
   config.setMaxAge(3600L);
 
   UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
   source.registerCorsConfiguration("/api/**", config);
   return source;
}

// Trong Controller/Service
public String getCurrentUserId() {
   Authentication auth = SecurityContextHolder.getContext().getAuthentication();
   if (auth == null) {
       return null; // chưa xác thực (vd code chạy ngoài HTTP request)
   }
   if (auth instanceof JwtAuthenticationToken jwtAuth) {
       return jwtAuth.getToken().getClaimAsString("sub");
   }
   return auth.getName();
}
 
// Inject trực tiếp trong Controller
@GetMapping("/me")
public UserDTO getCurrentUser(@AuthenticationPrincipal Jwt jwt) {
   String userId = jwt.getSubject();
   String email = jwt.getClaimAsString("email");
   List<String> roles = jwt.getClaimAsStringList("roles");
   return userService.getUser(userId);
}

@Configuration
public class MultiSecurityConfig {
 
   // Chain 1: API endpoints (JWT)
   @Bean
   @Order(1)
   public SecurityFilterChain apiFilterChain(HttpSecurity http) throws Exception {
       http
           .securityMatcher("/api/**")
           .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
           .authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
       return http.build();
   }
 
   // Chain 2: Actuator endpoints (Basic Auth)
   @Bean
   @Order(2)
   public SecurityFilterChain actuatorFilterChain(HttpSecurity http) throws Exception {
       http
           .securityMatcher("/actuator/**")
           .httpBasic(Customizer.withDefaults())
           .authorizeHttpRequests(auth -> auth.anyRequest().hasRole("ACTUATOR"));
       return http.build();
   }
 
   // Chain 3: Public (no auth)
   @Bean
   @Order(3)
   public SecurityFilterChain publicFilterChain(HttpSecurity http) throws Exception {
       http
           .securityMatcher("/public/**", "/health")
           .authorizeHttpRequests(auth -> auth.anyRequest().permitAll());
       return http.build();
   }
 
   // Chain 4: mọi request còn lại (không có securityMatcher = khớp tất cả)
   @Bean
   @Order(4)
   public SecurityFilterChain defaultDenyFilterChain(HttpSecurity http) throws Exception {
       http.authorizeHttpRequests(auth -> auth.anyRequest().denyAll());
       return http.build();
   }
}

@Component
public class CustomAuthEntryPoint implements AuthenticationEntryPoint {
 
   @Override
   public void commence(HttpServletRequest request, HttpServletResponse response,
                        AuthenticationException authException) throws IOException {
       response.setContentType("application/json;charset=UTF-8"); // thiếu charset thì tiếng Việt bị vỡ (mặc định ISO-8859-1)
       response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
       // Có thể dùng ObjectMapper để serialize một ErrorResponse object tĩnh
        response.getWriter().write("""
            {
                "status": 401,
                "error": "UNAUTHORIZED",
                "message": "Token không hợp lệ hoặc đã hết hạn"
            }
        """);
   }
}
 
@Component
public class CustomAccessDeniedHandler implements AccessDeniedHandler {
 
   @Override
   public void handle(HttpServletRequest request, HttpServletResponse response,
                      AccessDeniedException accessDeniedException) throws IOException {
       response.setContentType("application/json;charset=UTF-8");
       response.setStatus(HttpServletResponse.SC_FORBIDDEN);
       response.getWriter().write("""
           {"error": "FORBIDDEN", "message": "Insufficient permissions"}
       """);
   }
}

@WebMvcTest(OrderController.class)
@Import({SecurityConfig.class, OrderService.class}) // @WebMvcTest không tự nạp @Configuration và @Service
class OrderControllerSecurityTest {
 
   @Autowired
   MockMvc mockMvc;
 
   @Test
   @WithMockUser(roles = "ADMIN")
   void adminCanDeleteOrder() throws Exception {
       mockMvc.perform(delete("/api/orders/123"))
           .andExpect(status().isOk());
   }
 
   @Test
   @WithMockUser(roles = "USER")
   void userCannotDeleteOrder() throws Exception {
       mockMvc.perform(delete("/api/orders/123"))
           .andExpect(status().isForbidden());
   }
 
   @Test
   void unauthenticatedGetsDenied() throws Exception {
       mockMvc.perform(get("/api/orders"))
           .andExpect(status().isUnauthorized());
   }
 
   @Test
   @WithMockUser(username = "user-1")
   void userCanOnlyAccessOwnOrders() throws Exception {
       mockMvc.perform(get("/api/users/user-1/orders"))
           .andExpect(status().isOk());
 
       mockMvc.perform(get("/api/users/user-2/orders"))
           .andExpect(status().isForbidden());
   }
}