ApiHug Spring Security Extension

The security framework provides authentication, authorization, and protection against common attacks.

ApiHug offers a minimalist and efficient security solution, different from traditional frameworks like Apache Shiro or Spring Security.

It is still based on resource (API) permission management, combined with roles, creating a very simple RBAC (Role-Based Access Control) structure that is ready to use out of the box.

​Protocol

How to define the protocol at the Proto layer: Minimal Authentication & Authorization

​Implementation

1. SecurityAspect: Aspect
2. SecurityContext: Runtime security context, including resource to CheckerAuthorization mapping
3. HopeSecurityManager: Runtime security parameter assembly
4. JWTFilter: JWT filter

Currently, the Aspect SecurityAspect only supports BEFORE checks, meaning it validates before entering the resource (API) business logic.

​Configuration

Configuration path: hope.security; Configuration object: HopeSecurityProperties.

Configuration	Remarks
enabled	Whether to enable ApiHug Security.
jwt	JWT configuration.
jwt.base64Secret	Base64 secret.
jwt.secret	Secret.
jwt.tokenValidityInSecondsForRememberMe	Validity period for Remember Me, default is 30 days.
jwt.tokenValidityInSeconds	Default validity time, 7 days.

​Disable Spring Security

The simplest way to disable Spring Security is to remove its dependency from the project.

By doing this, we’ll remove all security-related configurations and defaults provided by Spring Security:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
    <version>...</version>
</dependency>

Removing this dependency eliminates all Spring Security features from the application.

But if you want leverage some Spring security components, we recommend you to disable the spring security autoconfiguration manually:

Excluding Spring Security Auto-Configuration

Spring Boot automatically configures security when we include spring-boot-starter-security in our classpath. To disable it, exclude the auto-configuration by adding the following property to application.properties:

spring.autoconfigure.exclude=org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration

If we want to disable Spring Security completely, we should use spring.autoconfigure.exclude without creating a SecurityConfiguration class.

Manually configuring the Spring Security class overrides the application.properties configuration, so exclusion in the application.properties has no effect when both are used together.

​Refer

1. Authentication & Authorization
2. Spring Security
3. Apache Shiro
4. RBAC - Role-based access control