Spring security without jsp

Question

I will use Spring security in my Javascript frontend + Spring MVC project (A user management admin web app) I was trying to figure out if there is any security benefits to put these frontend html code especially in a jsp file in same server as my backend code, so I can take benefit of certain jsp tags. Or can I perfectly make it an ajax application, serve the frontend in a different server. and still use spring security fully?

Answer 1

Here I assume:

• a javascript front end
• a Spring MVC rest application serving mainly JSON

On a security point of view, spring security can only protect the back-end application, and you should remember that front-end security (hiding links or commands in a browser view) is only a illusion because a user can always forge a request, even an Ajax one.

On a user experience point of view, it is clear that you should never show a possibility to your user, and when he use it, tell him that he is not allowed to. So your front end must know what privileges are awarded to a user. Spring security comes with some tags that are useable server side in JSP pages, but for an Javascript frontend, you can (should?) implement a special URL server side that returns the current user abilities, send a request here as soon as the user is authenticated, and cache the result in the client session (Windows.sessionStorage). That way your javascript code knows what should be displayed to a particular user.

Answer 2

You can use spring security to secure the request URLs that provide your AJAX JSON call level in your controller, and that is what I would suggest.

Regardless of how you show/hide features, data, etc. in your JS frontend, what is important is securing the JSON calls that provide the features and data. This way, even if an end user attempts to hack your frontend (and they might, because it'll be easy), ensure that they will fail in executing a REST call because of lack of access.

A little on point with your question as to "can you" make this secure vs using JSP tags? Absolutely - make sure all of your security at the call level is handled properly as described above, and you'll be set. You should build your REST/JSON services like a separate application, that could be used in any kind of frontend.