Spring Boot Role Based Form Login

Role-Based Access Control (RBAC) is a security approach that limits system access based on predefined roles. Each role defines a set of permissions that dictate what a user can do within an application. Implementing RBAC helps enhance security, improve user management, and streamline permission control.

DemoApplication.java

package com.example.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;


@SpringBootApplication
public class DemoApplication {

	public static void main(String[] args) {
		SpringApplication.run(DemoApplication.class, args);
	}

}

TestController.java

A REST controller handles HTTP requests and provides responses directly to the client. Using the @RestController annotation, define endpoints with @RequestMapping. Here’s a quick example:

package com.example.demo.controller;

import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TestController {

	@RequestMapping("/info")
	public String info() {
		return "This is a info page";
	}

	@RequestMapping("/home")
	public String user() {
		return "This is a home page";
	}

	@RequestMapping("/teacher")
	public String teacher() {
		return "This is a teacher page";
	}

	@RequestMapping("/admin")
	public String home() {
		return "This is a admin page";
	}

}

HTTP Endpoints

HTTP Method	Endpoint	Response
GET	/info	“This is a info page”
GET	/home	“This is a home page”
GET	/teacher	“This is a teacher page”
GET	/admin	“This is a admin page”

SecurityConfiguration.java

• @Configuration: Marks this class as a configuration class for Spring.
• @EnableWebSecurity: Enables Spring Security for the application.

The filterChain() method configures HTTP security rules using the HttpSecurity object. These rules define which endpoints are accessible to which roles and handle authentication methods.

package com.example.demo.configuration;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

	@Bean
	public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception {
		httpSecurity.csrf().disable().authorizeHttpRequests()
		.requestMatchers("/info").permitAll()
				.requestMatchers("/teacher").hasRole("TEACHER")
				.requestMatchers("/admin").hasRole("ADMIN")
				.anyRequest().authenticated().and().formLogin();
		return httpSecurity.build();
	}

	@Bean
	public InMemoryUserDetailsManager userDetailsService() {
		// InMemoryUserDetailsManager (see below)
		UserDetails user1 = User.withUsername("user1").password(passwordEncoder().encode("password")).roles("USER")
				.build();

		UserDetails user2 = User.withUsername("user2").password(passwordEncoder().encode("password")).roles("TEACHER")
				.build();

		UserDetails user3 = User.withUsername("user3").password(passwordEncoder().encode("password")).roles("ADMIN")
				.build();

		return new InMemoryUserDetailsManager(user1, user2, user3);
	}

	@Bean
	public PasswordEncoder passwordEncoder() {
		return new BCryptPasswordEncoder();
	}

}

CSRF Disabled: For simplicity, CSRF (Cross-Site Request Forgery) protection is disabled in this setup.

Role-Based Access: The /teacher endpoint requires the TEACHER role, while /admin requires the ADMIN role.

Form-Based Login: A login form is provided for user authentication.

Application User Credentials

Username	Password	Role	Accessible Endpoints
user1	password	USER	/info
user2	password	TEACHER	/info, /teacher
user3	password	ADMIN	/info, /teacher, /admin

POM.xml

	4.0.0
	
		org.springframework.boot
		spring-boot-starter-parent
		3.1.1
		 
	
	com.example
	demo
	0.0.1-SNAPSHOT
	demo
	Demo project for Spring Boot
	
		17
	
	
		
			org.springframework.boot
			spring-boot-starter-security
		
		
			org.springframework.boot
			spring-boot-starter-web
		
		
			org.projectlombok
			lombok
			true
		
		
			org.springframework.boot
			spring-boot-starter-test
			test
		
		
			org.springframework.security
			spring-security-test
			test
		
	
	
		
			
				org.springframework.boot
				spring-boot-maven-plugin
				
					
						
							org.projectlombok
							lombok