Five Spring Security Concepts - Authentication vs authorization - Java Brains Brain Bytes

In this video, you’ll learn 5 key concepts and terms associated with Spring Security that you’ll really need to know.
Authentication, Authorization, Principal, Authority and Role
When you learn Spring Security, you’ll encounter these core terms and concepts over and over. In this video, I’ll break these terms down and explain them for you.
Java Brains website: javabrains.io
#JavaBrains #BrainBytes #WhatIs #SpringSecurity #Spring #SpringBoot #Java #Tutorial

[@MrEvmk]

Note taking for my ref: Authentication : who is the user ? Authorization : Are they allowed to do certain things Principal : curently logged in user Granted Authority : way of providing Authorization. Roles : Group of authority.

[@BharCode09]

Simple. Neat. Perfect! Breaking up some of the most technical/confused concepts to layman level in such succinct manner..

[@JS19190]

This is _by far_ the best channel I've encountered on Spring/Java. Incredible. I really appreciate that you give great metaphors (security guard etc) in order to better explain how the frameworks and technologies work.

[@anushareddy8295]

I’ve been waiting for these videos. Excellent content as always Koushik. I’m hoping this series includes Single Sign-On concepts as well :)

[@amsata.mbengue]

I cant find the words to describe your work. Your courses are always well structured and rigorously explained. Been folowing for a long time now. Keep up the good work Kashug

[@josephpudupermanil704]

Great Presentation, good quality of content, ease understandable by everyone. Awesome Koushik. We all have great respect for you. Thank You.

[@stephyjacob1256]

Thanks man 👍 for this series. Please continue.

[@hyperborean72]

Are you professor in Stanford? amazing level of mentoring and knowledge of the subject

[@shefinshajahan2038]

Thank you koushik ... always waiting for your uploads 👌

[@shantipriya4724]

Amazing content as usual. Always recommend your channel to my friends and colleagues.

[@codingwithgraceandtruth2456]

Very well explained, highly appreciate the content.

[@shaswatdasgupta3776]

Thanks for uploading this video.So fine grained explanation .

[@siddharth4484]

Feels like JVM & Spring itself teaching me... Thank you soo much sir from bottom of the heart...

[@KateShubham]

You are just Amazing sir!!! You explain things so in depth, with conceptual fundamentals! Love it! I am new in software development space and find it mind boggling, but your videos are that peaceful, satisfying, enriching ride which brings clarity and confidence to keep going ahead. Have become Big Fan of your style!

[@yahyafati]

How in the world, did you manage to make this easy-to-understand? It is security. You are awesome, man.

[@bekhruzmakhmudoveducationb9494]

Thank you, sir. Your courses are great. Good luck

[@ek19751]

Thank you so much for making videos on this topic. Applications get compromised on a regular basis, but there seems to be a DMZ between app development and app security! :-) If you can, I would like to see you explain how to handle XSS, SQLi, CSRF etc., within the Spring security framework. Secure webservices would be awesome too. I've also been curious how financial apps and banks mash up data securely, so the user sees information from all their institutions in one place. I wouldn't mind paying for your time either. You're good at what you do and deserve to get paid for it.

[@gameaddicted9399]

Thanks for helping the students and the developer community by providing these awesome tutorials. I request you to please make more about Spring Security login logout functionalities. Really, you are doing a great job.

[@damiajayi4670]

You have the best courses on Spring boot! I am really looking forward to your Java courses on your website

[@abhy_spring]

This video is amazing! Explained the most basics of Spring Security with such ease and visual entertainment! By far the easiest and greatest channel to learn Spring!

[@kostiantynkarzhanov9216]

Thank you! Very well explained! 💛

[@innocentomoyibo6312]

This explanation is sooo simple and incredible!!!!

[@chris.w391]

So well explained, thank you!

[@barkavi9434]

Really good presentation and well understood the concept of security. It's Valuable to spend time.

[@kamboj65]

i'm learning about spring security and it is very userful. concise and well explained! thanks

[@ajitpandey100]

Very nice .... I like your all videos..simple language with covering all things

[@avinashgsr]

Brilliant explanation. Thank you very much

[@sandyj342]

such awesome clarity ❤

[@amirthasaha]

Awesome as always!

[@suraskumarnayak8350]

A very nice explaination of the basic security concepts. !!!

[@vkdagamer2984]

Thank You Sooo Much Sir for Posting this Video! it was very informative and you taught a lesson in 12 minutes when my teacher took 3-4 weeks, keep it up!!

[@sherlockholmes1605]

Koushik is definitely one of the best teachers I've ever encountered on the web!

[@Mohamed-uf5jh]

Thanks , in this hanel you understand the concept and how to implemante it , great job

[@dmytroshmidt5981]

Thank you for the grate explanation.

[@jeffrabitinthewind5592]

Very clear on these concepts

[@dineshchandgr]

Thank you so much for the effort. Amazingly explained using pictorials. ur very creative

[@commentsonly4341]

Amazing videos always keep waiting for them .. suggest u to bring a series of oauth2 , Redis , pcf and session management using spring boot .. 👍

[@alexandrmelnichenko3612]

Thank you for a great explanation. That knowledge are still relevant in September 2022 - so it is very good.

[@br4676]

superb sir , thanks for nice explanation

[@sajeevvasudevan6301]

sir exactly amazing help for me this much of effort for me

[@rajkhare5949]

thank you so much...very good explanation in such a simple way....thanks for creating video like this!!!!

[@mobe1164]

YOU ARE GREAT MAN! MAKE US MORE SUCH GREAT TUTORIALS KOUSHIK

[@shubhamray6839]

hey .. I in love with your explanations ..

[@huseyinavnikadoglu5541]

Thank you so much! That will help me a lot ! :)

[@sciab3674]

nice easy to understand . thanks

[@Miaops]

good content! precise and esay to understand

[@AhamedKabeer-wn1jb]

THANK YOU SIR..WELL EXPLAINED

[@abhiranjankumar8501]

Nicely explained! Thanks... :)

[@kushalsheth0212]

Great animation 👏

[@nagarajukp7820]

Woww .. Really awesome videos from javabrains Simple and more depth . Thanks a lot sir for your time .

[@waiphyotun7633]

Omg. This channel makes me learn better and laugh with smiles..

[@charanahansa752]

Great lesson 👌👍👏💯

[@chandramanigupta6997]

Thank you so much.

[@hekarboi3656]

This is GEM!

[@Mohamed-uf5jh]

Is perfect explain , thanks

[@sudhakar104624]

Thank you koushik

[@burramahesh]

Thank you.

[@kollurusahithi5160]

Well made videos👏

[@anitaig05]

nice video, great info! :)

[@kakashihatake4840]

Thank You

[@vamshikrishna298]

Watching Kaushik @Java brain videos are like an interesting screenplay movie...:))

[@MrPRADEEP705]

Thanks!

[@liubomyr-oleksandrdebryniu8044]

thanks a lot very useful \

[@amanagarwal113]

Well explained sir. Can u make a video with an small Api with example of the same.

[@demidrek-heyward]

thanks love the vidios!

[@dev1dev180]

Good content.

[@pablohernandez4305]

ohh great video

[@vidyakrishnan3821]

hahaha, the principal joke was hilarious ! .... also thanks for the video!

[@elmokhliss4852]

Thanks

[@melsaied101]

That's great

[@aayushkc2306]

Please make the full course on spring boot security and outh2 .I am waiting for a long time..Thanks

[@josephkingstonleomariamich7220]

Please create complete course on springsecurity thanka

[@manjushanmugam4967]

Hi Kowsik.. one small request.. can you please explain why we need to store passwords in char[] array in java.. why not as string..

[@ajay14sharma]

Joined :)

[@santhoshkumargajjala2657]

Hi Sir, could you please upload on Docker or Kubernettes

[@ADGroupOfArtMedia1]

santhosh.g +1

[@AminHasan85]

+1

[@venkatanagasai7354]

Hello sir, please provide the videos on oauth2 with jwt token using spring security

[@javaexpertsa8947]

Authentication: Bob make's a request to the Server (login purposes) and it is the task of the Security part of the Server, to confirm Bob and find out, that he really is who he claims to be. Principle: After the authentification, Bob's details are saved for following requests. Authorization: Is Bob allowed to do a specific thing? Like deleting a user or even view other user details (not the passwords tho). Granted Authority: Basically this is the part, which actually handles the Authorization in Spring Security. A list of Authority for a specific User (if you wouldn't define Roles) must be setup. Roles: It would be a pain to setup for every single person a List of authorities, that's why Roles basically exist. If Bob has the role "User" and in the "Granted Authority" there is set of defined stuff for this role "User", he is only allowed to do the stuff specified. If he would try to do more than allowed, it would'nt be allowed for him (in the frontend-part he shouldn't even see stuff, he can't modify).

[@sarath6789]

Koushik, how can we think of principal, one user having different roles or having different accounts with same role..?

[@Java.Brains]

Principal is just the currently logged in user. That user could have multiple roles

[@amruthakm1042]

Happy Teacher's day :)

[@anshgyl]

Can you please add a video in which we can use a custom login page, instead of a default one, how do we call the login API from our own form?

[@rishabhsharma2133]

I hope to reach to your level of communicating one day.

[@michelchaghoury870]

hey I really like your videos please make more we need your help can you make java android development tutorials, Gradle and the diff between Gradle and maven and which one is better, and what the ADF is really all about, and if we should use it or not and the diff between him and spring and also java desktop dev and if we can make a spring boot desktop app please we need your help and tx a lot

[@netherend8357]

Does Spring Security support JWT and token verification?

[@katiesun1533]

👍

[@estebanmurcia8451]

Hi, what could be the approach for context based authorization, like maybe a user should only edit their own comments and not those of other users

[@rajendracd9782]

Hi Java Brains, Really good presentation! "Principal" is not specific to Spring Security. It's common across all the security frameworks.

[@sushil1922]

why does app remember principal, when i use jwt token , I would just go and validate the token...do i need to remember principal in this case? Pls do answer

[@sushil1922]

where actually are principal object stored?

[@kamra.gaurav]

First view first comment

[@vaibhavvyavahare]

Hello Sir, i want to restrict multiple user login usinng spring security.Not able to understand.please help

[@prerakchoksi2379]

"Principal is someone who I used to hate during my schools :D"

[@sarojsahoo8763]

Even in possesion based authentication Hacker can hack the phone and still can grab your secrets

[@lequocthinh8992]

Authentication - Who are you? Authorization- What can you do? Principal - Currently logged in account Granted authority Role

[@manticha]

Nice Video but Can you give a real example application that do what you are explained above?

[@Java.Brains]

Yup, coming up!

[@manticha]

@@Java.Brains waiting

[@sarojsahoo8763]

It looks for me Authroization and Granted Authority are same.

[@manatoshpritam]

Hi Kaushik, you intro disco song is bit loud. It will be good if you please lower down that.

[@dazelmann6589]

shuddup bitch

[@taxconsultant2971]

Sir I have Join course

[@TheGuroguro12]

Hated principal in primary school 😀😀😀😀

[@RameshBaburbabu]

there are only 2 things authentication , authorization . other things are derivatives , roles are derivative of authorization, Principle of derivation of cookies, grand authorities are derivatives of Roles .

[@jennmoore1326]

Authorization asked is a using for an avoidance of paying.Avoidance of paying a location to impactfully impose actions desired and or needed agendified without used collecting payment?.a scared or fear emotion that money or currency would change actions and a searching and comparing and or Masterial all over again would have to be imposed?..Depopulate

[@AjayKumar-fd9mv]

Thanks