Security

Brutusin-RPC seamless integrates with Spring security.

Configuration

Configuration can be performed according to the AbstractSecurityWebApplicationInitializer without Existing Spring topic.

Usage

Programmatic security via getPrincipal() and isUserInRole(String roleName) obtained HttpActionSupport.getInstance() and WebsocketActionSupport.getInstance(), as corresponding.

Non-authorized action executions must throw a java.lang.SecurityException.

Websockets

The framework uses JSR-356 Websockets, with a custom implementation to integrate with Spring security with the following characteristics:

• Websocket enpoint is deployed behind spring springSecurityFilterChain
• In order to avoid CSRF attacks the following origin verification algorithm is performed (see WebsocketEndpointConfigurator):
  1. If the handshake request doesn't have an Origin header skip validation
  2. If a accessControlOriginHost environment variable has been configured, verify Origin header matches this value
  3. Else (default case): Verify Origin and Host header values match

Example

See rpc-demo-security-jar demo project