Studio: TechJobs Authentication

For this studio, you’ll be tasked with adding simple user authentication to your techjobs application. The steps to do this will match what you have already done in codingevents. You should refer back to the tutorial starting here .

1. Create the User Model
2. Create the Login and Registration Forms
3. Filter Requests

The Starter Code

1. Fork and clone the starter code for TechJobs (Auth Edition) .

2. The dependencies for the database connection and hashing function are already added for you in build.gradle. You will need to do some work to ensure that the schema, user, and database password match your own local MySQL setup.

   1. Open application.properties and view the first three statements:

   # Database connection settings
   spring.datasource.url=jdbc:mysql://localhost:3306/techjobs?useLegacyDatetimeCode=false&verifyServerCertificate=false&useSSL=false&requireSSL=false&allowPublicKeyRetrieval=true&serverTimezone=America/Chicago
   
   spring.datasource.username=techjobs
   spring.datasource.password=techjobs
   

   1. You likely do not already have a schema named techjobs_auth or this combination of username and password so you must create them.

Create the User Model

1. In the project you have cloned, create a User model identical to that in codingevents. The class needs:

   1. To be an entity.
   2. To have username and encrypted password fields.
   3. To have appropriate constructors, getters, setters.

2. Encode the User password field.

   1. Add a static BCryptPasswordEncoder variable.
   2. Update the constructor that has arguments to encode the password field.
   3. Add a method to check password values.

3. Create a UserRepository.

   1. Add the special query method to find a user by username.

Create the Login and Registration Forms

1. Create an AuthenticationController.

   1. Include an autowired UserRepository.

2. Add session handling utilities. This includes:

   1. A static final variable for the session key.
   2. A method to get the user information from the session.
   3. A method to set the user in the session.

3. Create two DTOs for the user registration and login forms in a new package, dto, under models.

   1. Create a login form DTO with username and password fields.
   2. Create a register form DTO with the fields above and a field to verify a password.

4. Handle the registration data.

   1. Add a GET handler in AuthenticationController to display a registration form.

   2. Create a register template with form fields corresponding to the register DTO.

   3. Create a POST handler in AuthenticationController to process the form.

      1. If the form has validation errors, re-render the registration form with a useful message.

      2. If the username is already tied to a user, add a fitting error message and re-render the form.

      3. If the two form fields for passwords do not match, add an error message and re-render the form.

      4. If none of the above conditions are met,

         • Create a new user with the form data,
         • Save the user to the database,
         • Create a new user session,
         • Redirect to the home page.

5. Handle the login data.

   1. Repeat steps 1 + 2 for handling the registration data, this time with the login information.

   2. Apart from model validation checks and the final redirect, the POST handler for the login form will have some different checks from that of the registration form:

      1. If the database does not contain a user with the submitted username, add an error message and re-render.
      2. If the submitted password does not match the encoded password attached to the username in the form, add an error message and re-render.
      3. If the submission passes all of these checks, create a new user session.

6. Handle logging out.

   1. Still in AuthenticationController, create a GET handler method for a path to logout.

      1. Invalidate the session data from the request object.
      2. Redirect the user to the login form.

Filter Requests

1. Create an AuthenticationFilter class in the techjobsauth package.

   1. Have this class implement the HandlerInterceptor.

   2. Add autowired instances of both UserRepository and AuthenticationController.

   3. Add a preHandle method.

      1. This must override the inherited method of the same name.
      2. Grab the session information from the request object.
      3. Query the the session data for a user.
      4. If a user exists, return true. Otherwise, redirect to the login page and return false.

2. Create a whitelist.

   1. In the top of AuthenticationFilter, add a whitelist variable containing the paths that can be accessed without a user session.

   2. Create a method next that checks a given path against the values in the whitelist.

   3. Update preHandle with a call to this method.

      1. Before looking for session and user status, add a conditional that checks the whitelist status of the current request object.

3. Register the filter with Spring.

   1. Create a class called WebApplicationConfig at the same level as AuthenticationFilter with the following:

      1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

      @Configuration public class WebApplicationConfig implements WebMvcConfigurer { // Create spring-managed object to allow the app to access our filter @Bean public AuthenticationFilter authenticationFilter() { return new AuthenticationFilter(); } // Register the filter with the Spring container @Override public void addInterceptors(InterceptorRegistry registry) { registry.addInterceptor( authenticationFilter() ); } }

That’s it, that’s all. You’re done. Go forth and test the auth flow. Then add this to any other Spring project you’re working on!