{defaultBaseUrl}
.
+ In the following steps, we assume your app is running on {props.defaultBaseUrl || defaultBaseUrl}
.
{`${props.defaultRedirectUri || defaultRedirectUri}`}
.
{`${props.defaultPostSignOutUri || defaultPostSignOutUri}`}
as the post sign-out redirect URI below.
+
{`spring.security.oauth2.client.registration.logto.client-name=logto
spring.security.oauth2.client.registration.logto.client-id=${props.app.id}
spring.security.oauth2.client.registration.logto.client-secret=${props.app.secret}
@@ -86,19 +79,23 @@ spring.security.oauth2.client.provider.logto.jwk-set-uri=${props.endpoint}oidc/j
-In order to redirect users back to your application after they sign in, you need to set the redirect URI using the `client.registration.logto.redirect-uri` property in the previous step.
+
-
-
-e.g. In our example, the redirect URI is `http://localhost:8080/login/oauth2/code/logto`.
+Make sure the redirect URI in Logto matches the `redirect-uri` set in the `application.properties` file in the previous step.
-#### Create a new class `WebSecurityConfig` in your project:
+The `WebSecurityConfig` class will be used to configure the security settings for your application. It is the key class that will handle the authentication and authorization flow. Please check the [Spring Security documentation](https://spring.io/guides/topicals/spring-security-architecture) for more details.
-```java
+### Create a new class `WebSecurityConfig` in your project
+
+```java title="WebSecurityConfig.java"
package com.example.securingweb;
import org.springframework.context.annotation.Configuration;
@@ -112,11 +109,11 @@ public class WebSecurityConfig {
}
```
-#### Create a idTokenDecoderFactory bean to set the JWS algorithm to `ES384`:
+### Create a idTokenDecoderFactory bean to set the JWS algorithm to `ES384`
This is required because Logto uses ES384 as the default algorithm, we need to update the OidcIdTokenDecoderFactory to use the same algorithm.
-```java
+```java title="WebSecurityConfig.java"
import org.springframework.context.annotation.Bean;
import org.springframework.security.oauth2.client.oidc.authentication.OidcIdTokenDecoderFactory;
import org.springframework.security.oauth2.client.registration.ClientRegistration;
@@ -135,11 +132,11 @@ public class WebSecurityConfig {
}
```
-#### Create a LoginSuccessHandler class to handle the login success event:
+### Create a LoginSuccessHandler class to handle the login success event
Redirect the user to the user page after successful login:
-```java
+```java title="LoginSuccessHandler.java"
package com.example.securingweb;
import java.io.IOException;
@@ -160,11 +157,11 @@ public class CustomSuccessHandler implements AuthenticationSuccessHandler {
}
```
-#### Create a LogoutSuccessHandler class to handle the logout success event:
+### Create a LogoutSuccessHandler class to handle the logout success event
Clear the session and redirect the user to the home page.
-```java
+```java title="LogoutSuccessHandler.java"
package com.example.securingweb;
import java.io.IOException;
@@ -192,11 +189,11 @@ public class CustomLogoutHandler implements LogoutSuccessHandler {
}
```
-#### Create a `securityFilterChain` bean to configure the security configuration:
+#### Create a `securityFilterChain` bean to configure the security configuration
Add the following code to complete the `WebSecurityConfig` class:
-```java
+```java title="WebSecurityConfig.java"
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.DefaultSecurityFilterChain;
@@ -227,13 +224,12 @@ public class WebSecurityConfig {
-
+
(You may skip this step if you already have a home page in your project)
-HomeController.java:
-```java
+```java title="HomeController.java"
package com.example.securingweb;
import java.security.Principal;
@@ -252,9 +248,7 @@ public class HomeController {
This controller will redirect the user to the user page if the user is authenticated, otherwise, it will show the home page.
-home.html:
-
-```html
+```html title="resources/templates/home.html"
Welcome!
@@ -264,11 +258,11 @@ home.html:
-
+
Create a new controller to handle the user page:
-```java
+```java title="UserController.java"
package com.example.securingweb;
import java.security.Principal;
@@ -304,9 +298,7 @@ public class UserController {
Read the user information from the `OAuth2User` object and pass it to the `user.html` template.
-user.html:
-
-```html
+```html title="resources/templates/user.html"
User Details
@@ -325,4 +317,10 @@ user.html:
+
+
+
+
+
+