Made withSpring BootClip

OAuth2 Login Made Easy in Java: A Spring Boot & Spring Security Walkthrough

D

Dan Vega

Creator on the Spring Boot channel

Watch on YouTube ↗

202K viewsApr 28, 202313:05 runtime

Learn how to easily implement OAuth2 social logins in your Java applications using Spring Boot and Spring Security. This step-by-step walkthrough demonstrates how to configure your app to allow users to authenticate via third-party providers like GitHub and Google, eliminating…

Chapters

#springboot#clip#frameworks

Key Concepts: OAuth2 Login with Spring Security

This document outlines the key steps and concepts for implementing social logins (GitHub, Google) in a Spring Boot application using Spring Security.

## Project Setup

Start by creating a new Spring Boot project with the following core dependencies:

Spring Web: For creating REST controllers and web endpoints.
OAuth 2.0 Client: This is the key dependency that brings in Spring Security and provides all the necessary functionality for OAuth2 login.

## Security Configuration

To enable and customize OAuth2 login, you must create a SecurityFilterChain bean within a @Configuration class.

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http
                .authorizeHttpRequests(auth -> {
                    auth.requestMatchers("/").permitAll(); // Public endpoint
                    auth.anyRequest().authenticated(); // All other endpoints require login
                })
                .oauth2Login(withDefaults()) // Enable OAuth2 login with default settings
                .formLogin(withDefaults()) // Optionally enable form login
                .build();
    }
}

Note
If you only have one OAuth2 provider configured and do not enable .formLogin(), Spring Security will automatically redirect users to that provider's authentication page when they access a secured endpoint.

## Provider Configuration in `application.properties`

For each OAuth2 provider, you must configure a Client ID and a Client Secret.

Property Structure:

spring.security.oauth2.client.registration.<provider>.client-id
spring.security.oauth2.client.registration.<provider>.client-secret

Example for GitHub and Google:

# GitHub Credentials
spring.security.oauth2.client.registration.github.client-id=YOUR_GITHUB_CLIENT_ID
spring.security.oauth2.client.registration.github.client-secret=YOUR_GITHUB_CLIENT_SECRET

# Google Credentials
spring.security.oauth2.client.registration.google.client-id=YOUR_GOOGLE_CLIENT_ID
spring.security.oauth2.client.registration.google.client-secret=YOUR_GOOGLE_CLIENT_SECRET

Important
When registering your application with a provider (like GitHub or Google), you must provide an Authorized Redirect URI. Spring Security's default pattern is http://localhost:8080/login/oauth2/code/<provider>, where <provider> is github, google, etc.

## Debugging and Customization

Enable Trace Logging: For deep insight into the security filter chain and OAuth2 flow, add the following to your application.properties:

logging.level.org.springframework.security=TRACE
Custom Login Page: Spring Security's default login page can be replaced with a custom one, allowing for tailored branding and user experience. This can be configured in your SecurityConfig.

Project Setup and Dependencies

What's up Friends, Dan Vega here and today we are talking about OAuth 2 logins in Spring Security. So if you have an application and you want to provide a way for users to log in, you can have them log in via form using something like a username and password, maybe an email address. But if you don't want to have to have your users register on your system, you can have them log in via some social login like GitHub, Google, Twitter, whatever the case may be. That's what we're going to look at today.

We're going to use Spring Boot, Spring Security, and the OAuth 2 login functionality that's built into Spring Security to make that happen, and it's actually really easy to do. I've gotten a lot of questions about this lately, so I thought we'd just jump right in. Here I am at start.spring.io. I'm going to create a new project. I'm going to select Maven as my build tool, Java as my language. I'm going to change that group to dev.danvega. We'll call this a social-login, if I could spell, Dan. And then we'll choose Java 17 and we're going to need a couple dependencies. So I'm going to choose Web. I'm also going to choose the OAuth 2 Client. This will bring in Spring Security as a transitive dependency, and so we'll have everything we need. That's really all we need to get started. So what we're going to do is we're going to generate that project. It's going to download a zip. I'm going to open it up in IntelliJ Ultimate IDEA, that is my favorite IDE, but you should open it up in whatever text editor or IDE you're most productive in. What are we waiting for? Let's write some code.

Creating Public and Private Endpoints

Alright, I'm going to get started by renaming this to application and we are good to go. So the first thing that we need is we need a controller. So I'm going to create a new Java class called HomeController. I basically want to set up a route that is public and a route that is private. So I'm going to mark this with @RestController and then we'll create a couple of methods in here. One @GetMapping for the root context, so /.

This is going to be public String home(). This is going to return "Hello Home" and that is all for that. And then we'll need a secure mapping, so we'll say /secured and this will be public String secured() and then this will just return "Hello Secured" and that is all we need. So we'll need to set up some configuration where anybody can get to home but if you log in or if you hit at /secured, then you will need to go ahead and log in.

So just to make sure everything is working... Why did that not go in a package called controller? Come on, Dan. Alright so we refactored that. Now I can go ahead and run my application and because Spring Security is on the class path we basically get a default user and a default password. If this is your first time using kind of Spring Security, you go ahead and check out my channel, there's a bunch of videos on the topic. But we have this randomly generated password that we need to log in with, and then everything is secure by default.

Customizing Spring Security Configuration

To change this, we want to override our security configuration. So we're going to create a new Java class, we'll call this SecurityConfig, and we'll put it in the config package. So SecurityConfig, and we'll mark this with @Configuration, @EnableWebSecurity. This will get us going.

And then we need to create a new bean of type SecurityFilterChain called securityFilterChain. This takes in our HttpSecurity, and then we'll return http.build(). And this will go ahead and add an exception and we are ready to go. So now we need to configure Spring Security.

Alright, so we'll use authorizeHttpRequests and the Lambda DSL here, and we'll say auth.requestMatchers(). So we'll say for our home route, that anyone can get to that. We'll say that, and then we'll say any other request, I want you to make sure that they are authenticated. Now, how are you going to log in? So we can provide a formLogin with some defaults, and that will... let's go ahead and import that static... and that will give us a form login. So now when we visit /secured, the user will have to log in with their username and password to be able to view that.

But we don't want to just provide a form login, maybe we want to provide OAuth 2 login. So how do we do that? So first off, we can say oauth2Login(). We can also pass the defaults to that and that's all there is to it. That is our setup there.

Preparing Application Properties for OAuth2

We need to create some properties in application.properties to say what OAuth2 clients we're going to support, or what OAuth2 providers. So if I go into application.properties, I can fill in some properties. So I can set up, let's just say for this example we're going to set up a GitHub login and we'll set up a Google login.

So one other kind of hack that I love is anytime I'm working with Spring Security, I like to set the logging level for org.springframework.security equal to TRACE. This just gives me some visibility into what's happening in my application. So I like to go ahead and set that first. Now to do GitHub and Google or Twitter or whatever you need to create OAuth2 client credentials on their applications. So let's start with one. We're going to head back over to the browser and we'll talk about setting up GitHub first and then we'll move on to Google.

Configuring GitHub as an OAuth Provider

Alright, so here I am on my GitHub account. I am going to go over to this little icon here and I'm going to go to Settings. From there, we are going to go all the way down here into Developer settings, and we're going to go into OAuth 2 apps. So you see I have one here from before. Let's create a new OAuth app. We'll call it Spring Security Social Login, and then you need a home page URL, the full URL to access your application. We'll just say localhost:8080. You could fill in some information about the description here, and then you need an authorized callback URL.

So this callback URL is something that you would get in the documentation. I actually have it here: localhost:8080/login/oauth2/code/github. Turns out this URL is the same, just whatever this is going to be replaced with something like Google. So I'm using that as my authorization callback URL and then this is going to control the flow in my application. So I'm going to do is register my application. And now you can see I have a client ID and I have to generate a secret.

Let's take this client ID first and head back over to my application.properties. So in here for GitHub Login I'm going to say spring.security.oauth2.client.registration, and then the name of the provider so in this case it's github and I'm going to say the client-id is equal to this. All right so we're going to copy that and then just say the client-secret is going to be equal to... and then we'll go back over here, we'll generate a new client secret and I have this, I'm going to copy it again. I'll go ahead and delete this after the video. But now I have my client ID and my secret. So with that, I should be able to go ahead and run the application.

And if we head back to the browser and if I go to localhost:8080 we get to home. This one is allowing anyone without authentication to get to it, but if we go to /secured, it's going to ask us to log in. So again, we provided a form login as one of the options. If I didn't provide the form login and I only had one OAuth 2 provider, in this case GitHub, it would automatically forward to that GitHub login. I'm having both options here so that's why it shows me the form that comes out of the box with Spring Security, and then it actually sets up the links for you as well for any of the OAuth 2 providers. So in this case it's GitHub. I need to log in with GitHub to view this secured page. I'm going to say okay, go ahead and authorize that, and I'm forwarded on to the secured route. So great, that was it. That's that easy to get going. What I want to do now is do the same for Google.

Configuring Google as an OAuth Provider

So Google, you will want to go over to console.cloud.google. I will say it was a little confusing, you have to set up the OAuth 2 consent screen first. If you've never done this, you need to do that first. Once you're done there, you can go ahead and go to the Credentials area and then create an OAuth 2 client ID.

So we're going to create credentials, OAuth 2 client ID. You're going to pick a web application and then you're going to give it a name, so Spring Security Social Login. And then you need to add an authorized redirect URI. So again, this is going to be the same as before, which was localhost:8080/login/oauth2/code/google. All right so we're going to add that URI and then create. And then what it's going to do is it's going to give us that client ID and that client secret.

So I'm going to head over to here and I'm going to say the same thing. So spring.security.oauth2.client.registration.google.client-id and then we'll pass that in. And then let's head back over here and copy the secret. spring.security.oauth2.client.registration.google.client-secret. So there's some other things that you can configure in here. There is like, so if I'm in spring.security.oauth2.registration.google.scope, so there are things like scope where you can say like what is the available scope of this OAuth 2 application, like what information do we want to access? So go ahead and read the documentation if you want to dig down and figure out what else you can configure here, but that is it for this.

I'm going to go ahead and restart this and we will see that if we go to localhost:8080/secured we are now given two options. So we can log in with GitHub or we can log in with Google. So now I'm going to try Google. Here are my different options for my Google account. I'm going to sign in with that, and as you can see, I am taken to the secured page.

Conclusion and Next Steps

Alright, thanks for sticking around to the end of that tutorial. It was a short one but a sweet one. I know a lot of you were asking me about how to do that. Obviously this is just kind of one piece of the puzzle when it comes to security and OAuth and OpenID, there's a lot to learn, but this is extremely easy to set up in Spring Boot and Spring Security. So I just wanted to kind of walk you through that.

Now something else I've been asked about and I'm interested to hear from you to see if it's something you're interested in. We get that out of the box form login, that out of the box ability to log in with GitHub and Google, but what if you wanted to customize that page? You can do it, you can override the login page, you can kind of set that up in Spring Security, and maybe you're interested in customizing that. If you'd like a tutorial on that, let me know. I'm a big fan of creating front ends, so I would create—you could do this in like Thymeleaf—but I would use something like Vite and Vue to create that and something like Tailwind to style it up. So I think that would be a fun tutorial if you're interested in something like that, let me know.

But what about this one? If you found some value in this tutorial friends, do me a favor, give me a thumbs up, subscribe to the channel, and as always, happy coding.