Spring Security 5: The Reactive Parts - Rob Winch
summary
Shows how Spring Security 5 actually secures a Spring WebFlux app by live coding a demo: adds reactive security starter, fixes CSRF in views by resolving Mono attributes with a controller advice, and uses delegatingPasswordEncoder to migrate sha-256 users to bcrypt on login. Covers offloading blocking ops (LDAP, password hashing) to parallel schedulers, implements reactive method security and URL-based rules, tests with WebTestClient and a custom withMockCustomUser test factory, and explains reactive-only hooks like AuthenticationWebFilter and why servlet filters don’t work.
AI-written summary · about
chapters (14)
- 0:00Introduction and setup
- 1:12When to use reactive programming
- 8:40Live coding demo begins
- 14:43Fixing CSRF token issues
- 18:59Customizing password handling
- 22:59Adding custom login page
- 25:28Custom user details integration
- 32:44Password encoding in signup
- 35:24Password storage migration
- 40:05Password upgrade on login
- 43:22Authorization rules
- 47:10Method security in reactive apps
- 50:37Testing reactive security
- 55:24Q&A session
