Now, we have a custom requirement in our application saying that the first four services, which is
my account, my balance, my loans and my card should be secured and the services related to notices
and contact should not be sick.
That means anyone should be able to access them without any credentials.
Let's go and try to customize customizer called passport requirement.
So if you see in our previous video, we have a copy paste or whatever default implementation present
in the spring security framework and that code expect any requests that is coming has to be authenticated
in order to process the business.
So let's try to remove this line now inside authorize request I have in my third call.
And demand has actually accepted part of a string thing that what is the app I want to consider in this
configuration, in this configuration?
First, I want to configure for my account so that providing that configuration, it is a method we
have to call it, is authenticated.
That means anyone calling a card which is matching my account has to be authenticated.
Similarly, we have to mention for the remaining all the OTS here, I have my balance also should be
authenticated and for my loans also it should be authenticated and my card could be also authenticated.
Now make sure all this for services has to be authenticated.
Similarly, we can go ahead and do configuration for notices as well.
But instead of a there we should.
It all means.
This line indicates insecurity.
If anyone calling my services with the potlatch notices you don't have to enforce security on the path,
you are free to let the business logic execute without violating any credentials.
We can copy paste the same configuration for contact also.
Now this code works as per custom requirements.
So if you see clearly I have configured first of all, services has to be authenticated and they have
to be secure, whereas remaining last two seconds services, which is notices and slash contact, are
free to be called by anyone without any credentials.
So this is what we have implemented in the code.
Let's go and test this code using Postma.
Firstly, let me start the server by going to the main class and as a application, this will start
our application in the 88 code.
Now I will go to Postman here.
I don't have any authentication details.
I'm trying to call my account.
We should get four zero one unauthorized response, which is correct.
But now I will go and try to call contact, which is like does not have any security you can see here
without any authorization details.
Also, I'm getting the response from the back and similarly, the same will happen for notice as well.
Like you can see the response here of the notice returns from the database.
But again, if I go and try to call any of the security like Richwood customer, like my cards on my
account, my balance on my loans, anything, we will get four zero one ever.
But if you provide the authentication details to them that we configure, we will get the response that
we are expecting.
Now, with our custom configuration in the postman, and it's working perfectly.
Let's try to see one more time what we have done.
We have to extend all this Web security Conficker adapter, which is the base glass for intercepting
security related stuff once I extended the class.
I also annotated my class with Aderet configuration so that spring board will consider this while booting
of the application once are done that I rent and read configure method which accepted strictly security
as a parameter.
If you see the code that we have written, we are telling every request.
Really, you are trying to authorize check for this and match a spot which matches with this part and
authenticate them.
If you're seeing any matches with notices and slash contact.
Please allow them without any security.
Similarly, we can configure any number of parts inside matter Bozak.
We are also telling on top of these conditions or configurations, make sure that you are also implementing
these security restrictions to all the form logged ins and historically basic requests coming from the
outside of this application.
Hope this is making sense to you.
If we have any questions, please post in Q&A.
I'll get you in the next room.
Thank you.
By.