如何在具有AngularJS UI和带有Spring Security的Spring Boot Rest Server的应用程序中对最终用户进行身份验证

Question

I have two apps.

Front end - AngularJS website running on localhost:9000 and getting data from rest service (database)

Back end - Spring Boot Rest Service localhost:8080

How to create authenticate process for this two app? Login from (user, password). I reading some tutorials on spring website, but front end are build in spring project on the /resouce folder, not separated.

Answer 1

There are a couple of things you need to keep in mind if you are setting up your app the way you want to.

What kind of authentication mechanism do you want? For rest services Basic and oAuth2 are most common.

With Basic auth you would send authorization header in each request.

• Each request will perform authentication all over again.
• There is no state between client and server
• Https is mandatory if you use basic auth.

With oAuth2 first you need to send basic authentication request to end point your.app/oauth/token? --- parameters

Response will contain access_token": "CQPt2VR2HJuCY3mb0xA1BVMyDltgvnpf6N2CXdsds3423YkGQID7VO-Mmu4idymlz"

Which you then include in every request with bearer token : Authorization Bearer CQPt2VR2HJuCY3mb0xA1BVMyDltgvnpf6N2CXVPXkaewYkGQID7VO-Mmu4idymlz

• access_token has an expiration time. You can also send refresh_token which has longer expiration time.
• There is no state between client and server
• For smaller applications oAuth2 is too complicated and basic will suffice.

This is just an overview of common authentication methods. There are a lot of implementation tutorials. Example : https://spring.io/guides/tutorials/spring-boot-oauth2/ and http://www.baeldung.com/rest-api-spring-oauth2-angularjs

One thing to keep in mind is you will need to setup CORS filter. If you run your service and client on different ports. For starters annotate methods you want to use with @CrossOrigin(origins = "http://localhost:9000") You can of course register global cors filter.