8-modul · 7-dars: Spring Security

Daraja: Ilg'or

Spring Security. Spring Framework bo‘yicha nazariya, amaliy namuna va mustaqil mashq.

Tushuntirish

## Dars maqsadi Spring Security tushunchalarini farqlash, nima uchun kerakligini izohlash va kichik misolda qo‘llash.

## Nazariya Authentication kimligini, authorization esa nima qilishga haqli ekanini aniqlaydi. RBAC rollarga asoslanadi; permission maydaroq huquqni ifodalaydi. Spring Security servlet filter zanjiri orqali requestni himoyalaydi. DelegatingFilterProxy Spring beaniga delegatsiya qiladi; FilterChainProxy mos SecurityFilterChainni tanlaydi. SecurityContextHolder joriy security contextni saqlaydi; odatda u thread bilan bog'liq. @AuthenticationPrincipal controllerga tekshirilgan principalni beradi. UI yoki Thymeleafda foydalanuvchi holatini ko'rsatish qulaylik, serverdagi tekshiruvning o'rni emas. Yangi thread va async ishlarda context avtomatik ko'chadi deb taxmin qilmang. CSRF browser avtomatik yuboradigan cookie kabi credentiallardan foydalanib boshqa saytdan amal yuborishdir. Cookie-authda CSRF himoyasini saqlang; CORS uning o'rnini bosmaydi. Parol saqlansa adaptive PasswordEncoder ishlating. Default deny, minimal endpoint ruxsatlari va eski token bilan rol bekor qilingan holatni test qilish xavfsizlikning asosidir.

## Manbalar [Moduldagi savollar yo‘nalishi](https://github.com/jlkesh/pdp_online_java_lessons/blob/main/interviewquestions/8-module%28Spring%20Introduction%29.md) [Rasmiy qo‘llanma](https://docs.spring.io/spring-framework/reference/)

Kod quyida o‘quv namunasi sifatida berilgan. To‘liq ilova uchun import, dependency va konfiguratsiya kerak bo‘lishi mumkin. SQLni faqat ajratilgan test bazasida bajaring.

Kod misoli

@org.springframework.context.annotation.Bean
org.springframework.security.web.SecurityFilterChain web(
    org.springframework.security.config.annotation.web.builders.HttpSecurity http) throws Exception {
  return http.authorizeHttpRequests(a -> a
    .requestMatchers("/public/**").permitAll().anyRequest().authenticated())
    .formLogin(org.springframework.security.config.Customizer.withDefaults()).build();
}

Keng tarqalgan xatolar

• CSRFni sababini bilmasdan disable qilish cookie bilan kiriladigan ilovani zaiflashtiradi.

Mashqlar

• Mehmon, oddiy user va admin uchun bir protected amalning 401/403/muvaffaqiyat testlarini yozing.
• Bitta endpointni himoyalab, tokensiz va token bilan so'rov yuborib javob kodini solishtiring.

Teglar: pdp, nazariya, modul-08

Interaktiv ko'rinish (viktorina, izohlar, tarix)