I'm extremely new to Spring security and I wanted to see if there was a way to secure these query strings so that they won't be seen in the developers console when you do things like "login", but are still accessible in my springboot services (such as UserService)?
Is there a way to encrypt these that I don't know about? I'm a bit perplexed as to the best way of doing this.
(I'm using vue frontend for my project, not the built in Springboot login, etc)
My WebSecurityConfig -
@Configuration
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
public static final String AUTHORITY_QUERY = "SELECT email, password, firstName, lastName, phoneNumber FROM ***.user";
public static final String USERS_QUERY = "INSERT INTO ***.user (firstName, lastName, phoneNumber,email,password,emailIsVerified,agreedToTermsOfService,dateTimeCreated,psapAffiliationHasBeenVerified,hasSeenWalkthrough,isAdmin,is_enabled) values(:firstName, :lastName, :phoneNumber,:email,:password,0,0,now(),0,0,0,1)";
public static final String CONFIRMATION_QUERY = "INSERT INTO ***.user (phoneNumber,email,password,emailIsVerified,agreedToTermsOfService,companyName,is_enabled) values(:phoneNumber,:email,:password,1,1,:companyName,1)";
@Autowired
private DataSource dataSource;
@Bean
public BCryptPasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(20);
}
@Override
protected void configure(AuthenticationManagerBuilder auth) throws Exception {
auth.jdbcAuthentication()
.usersByUsernameQuery(USERS_QUERY)
.authoritiesByUsernameQuery(AUTHORITY_QUERY)
.dataSource(dataSource);
}
protected void configure(HttpSecurity http) throws Exception {
http
.cors()
.and()
.csrf().disable()
.anonymous().disable()
.authorizeRequests()
.antMatchers("/api").permitAll()
.antMatchers(HttpMethod.OPTIONS, "/**").permitAll();
}
}
UserService example -
public void confirmNewUserAccount(User user) {
if(user.getEmailVerificationCode() != null) {
namedParameterJdbcTemplate.update(WebSecurityConfig.CONFIRMATION_QUERY, new BeanPropertySqlParameterSource(user));
System.out.println("Account verified");
} else {
new ResponseEntity<Error>(HttpStatus.CONFLICT);
}
}