user-icon Andreas Falk
14. February 2016
timer-icon 4 min

Bootiful Security: A secure web application in 5 minutes

Application security is constantly gaining more importance in the information technology world. There is hardly a day without any news on data breaches or security hacks.
Even more security is a crucial part in new IT trends like microservices and the internet of things.

In this bootiful security tutorial blog series I will show step by step how to develop a secure web application using spring boot and spring security.

In this first part I will describe a fast-start on creating a secure web application from scratch in just a few minutes. The finished application will already include basic security features like authentication and protection against common attacks like CSRF (Cross site request forgery) or session fixation.

Creating the application

To create a new bootiful application with spring boot we will use the Spring Initializr. To start with this simply open the url in your web browser.

Bootiful Security: Spring Initializr

The Spring Initializr is a generator that creates maven or gradle projects based on spring boot. It also adds selectable features as dependencies like for example web, JPA or security. Modern IDE’s like IntelliJ or the Spring Tool Suite already include similar built-in wizards.

For our application we will just use the following settings:

  • Generate a maven project with spring boot 1.3.2 (or some later release version)
  • Group ‘info.novatec’ and artifact ‘bootiful-security’
  • Select dependencies ‘Web’ and ‘Security’ (The bootiful security)

Finally the project will be created by clicking on ‘Generate Project’ button. What you will get is a zip file containing a maven pom file and some java source code. You may now open the project in your favorite IDE.

When looking at the generated pom.xml file you will notice that it is quite small. The spring-boot-starter-parent project used as parent manages versions for all used dependencies. For each selected feature in the spring initializr spring-boot-starter-xxx dependencies have been added. These starters basically are pom projects managing all transitive dependencies for features. For example the spring-boot-starter-web adds spring mvc as further dependency. You will also notice that maven will package the project as a jar not war (as you may have expected for a web app).

In addition to maven pom the following artifacts are contained in the generated zip file:

  • This is the starter class for the web-project. It includes a main() method.
  • This is a sample spring integration test just verifying correct application context loading
  • This file is the standard location for application-specific configuration settings

With spring boot the manual deployment of a web application into a web container like Apache Tomcat is not required any more. Instead an embedded container will automatically be started together with the web-application.

We could already start the application now but it does not have any visible web content yet. So we will add a very basic RESTful service to first.

Running the application

After building the maven project we are now ready to start the web-application. This is done by using the BootifulSecurityApplication as main starter class.
When the application has started successfully point your web browser to url http://localhost:8080. This will present a login dialog (using basic authentication by default).

Bootiful Security: Login Dialog

If you get errors when starting the application, then the default port 8080 may already be bound by another application on your machine. To get around this just configure an alternative port in the file.

The default username to be used in login dialog is ‘user’. The default password is generated automatically at each application start and can be copied from console log output of the application.
Just locate a line similar to this in the log to capture the password:

After successful authentication you should see the message ‘Hello security’ in the web page.
Of course it is quite inconvenient to search for new password in console log after each application start. You can easily configure your own username and password in the file using two predefined spring boot properties.

Now you will be able to log in using ‘myuser’ and ‘secret’.
As spring security has built in a secure by default configuration,  the created web application already has enabled basic protection against threats like

All HTTP responses already include recommended security headers as well. These will be described in one of the next parts of this tutorial.


In this first part we have created a basically secure web application in a few small steps which can be performed in just minutes.
As you have noticed this can be done because of the ‘convention over configuration’ principle of spring boot. This especially includes the auto configuration for web and web security.

What to expect next

In the next parts of this bootiful security tutorial I will show you

  • how to integrate form-based login dialog for authentication
  • how to authenticate using a persistent user/password store
  • easily switching from cleartext http to transport security (https)
  • what is needed to use securely encrypted passwords
  • how authorization is added to UI and service level

Comment article