0

Hi I'm having issues security my application, enabling authenticated users access to specific endpoints, non-authenticated users access to others and most importantly, continuing to enable the application to communicate with itself, without storing passwords as a String in the case base.

The code base:

My code base consists of numerous packages that communicate via REST and GraphQL calls. With no authentication, this system works fine. Development is in Java 8 with Maven.

Aim:

I am currently in the process of adding authentication to the code base which should enable three things to occur.

  1. The different projects in the application continue to communicate easily.
  2. An "admin" user can log in and make calls either via Swagger or GraphiQL or any methods they require.
  3. The average user will only be able to access specific endpoints such as UI elements (e.g. localhost:8082/user-ui [unique_key])

Current Development:

I've implemented Spring Security In-Memory Authentication (https://www.appsdeveloperblog.com/spring-security-in-memory-authentication/). Which successfully blocks URLs being called and prompts the user for credentials, except on certain predefined endpoints. This fulfilling criteria 3 and part of criteria 2 (as the Admin can access Swagger and GraphiQL).

My Problem:

Unfortunately setting up this system has broken the internal calls as the RestTemplate used to communicate between packages no longer has the correct authentication.

While I could use BasicAuthenticationInterceptor(https://www.baeldung.com/how-to-use-resttemplate-with-basic-authentication-in-spring) to provide the authorization, this would mean having to write the password in a String in the code base. As I understand it, this is bad form as the String is then stored in the String pool. Elsewhere I've managed to avoid this using the CharBuffer before encoding the password, however BasicAuthenticationInterceptorrequires a String.

Any advice on how to proceed would be greatly appreciated.

John Duskin
  • 355
  • 5
  • 12

1 Answers1

1

If you are using basic authentication, you will have to provide the password when you are making internal calls with resttemplate. That doesn't mean you need to store the sensitive data (in this case credentials for your basic authentication) in plain text in the code base. One of the most common practices is to use an external file to store the sensitive data and then get the application to use them at run time. You may also want to ignore that file from git repository to prevent that being part of the code base.

If you are using Spring boot have a look at the environment specific properties files, which could be an ideal way to store profile specific configuration and data like these. https://docs.spring.io/spring-boot/docs/1.5.5.RELEASE/reference/html/boot-features-external-config.html https://www.baeldung.com/properties-with-spring

If you are worried about storing the credentials in plain text in properties file, you can also encrypt sensitive data in your properties files. Spring Boot how to hide passwords in properties file

Kasun
  • 642
  • 1
  • 7
  • 16