Learn Spring Security OAuth

The definitive guide to secure your application with OAuth2

Why Learn About Security?

The Java ecosystem is vast and quite mature, but when it comes to security, right now, in 2023, there’s really no debate. If you’re working on the security of your application, you’re most likely using Spring Security.

Simply put, the framework is able to handle everything you throw at it – from simple scenarios to highly complex, distributed security requirements. There are some OK alternatives, but nothing really comes close.

Should I do OAuth?

There’s a lot of confusion out there around what OAuth actually is.

So, before all the “deep-dives” into the advanced aspects of the standard – we’re starting with the very basics, and we’re building up a clear understanding of the protocol.

It’s critical to learn where OAuth fits well and is great solution, and in what scenarios you actually need to avoid it.

And, once you know you’re doing OAuth – you need to understand exactly how it works – to do it well. This is where this material gets interesting – the deep-dives.

After teaching more than 1900 students security through my “Learn Spring Security” course, I’m finally taking the OAuth material to the next level with this new, fully dedicated course!

The New OAuth2 Stack in Spring Security 5

About two years ago, the Spring Security core team did something unexpected – they announced they were going to do a full rewrite of the OAuth2 support in the framework. This was big news!

It was also the very first time a core Spring project has made such a bold commitment towards a ground-up, major rewrite in the framework.

The new OAuth2 stack is now moving fast with the Spring Security 5 release out now – and the new functionality is already significantly better than the old stack.

That’s what I’m focusing on in this new course, with the 2 classes below:

The Master Class

This is the full material – the comprehensive, start-to-finish path from just learning what OAuth is – to having a real-world, solid understanding of how to use it in practice.

The 7 in-depth modules focus on the new OAuth2 stack in Spring Security 5 with Spring and Boot, today, in 2023, not looking back at the XML days of Spring Security.

The Certification Class

This class is simple – it contains the full material from the Master Class, plus downloads and multiple-choice questions – to help you get the most out of the material.

When you’re done, you’re going to get a “Certificate of Completion” for the course.

Video in key lessons, along with actual coding practice through a real-world project – is the best way to learn a complex framework like Spring Security

Practice by Coding

Each lesson in the course is either code-focused on a specific OAuth scenario, or theoretical, introducing you to the core concepts. Like all of my courses, the approach is “learn by doing” – or, more specifically, by coding.

I’ve structured the material to show you how to secure very different types of applications, each with their own characteristics, where a specific flow that fits and others that don’t.

I’m Eugen, and I’ll be your instructor through this course.

I’ve been using OAuth extensively in my own consulting practice for many years now. I’ve helped teams implement (most commonly re-implement) security in their systems over a ridiculous number of Spring versions. And I’ve been teaching security throughout most of that time.

The lessons here come out of that experience, with a simple goal – to get you super comfortable with OAuth2, Spring Security and Spring Boot.

To be clear – you can’t get there by just going through the lessons – you’ll need to code, along with me, through the material. The lessons and the multiple-choice questions are your reference to come back to – whenever you need them.

This course, as I’m sure you’re aware – is primarily focused on OAuth.

Naturally, if you’re doing OAuth in your own application, you’ll get a lot out of the material here.

But, if you’re focusing on the full Spring Security framework, beyond just OAuth, keep in mind this course is half of the full “Learn Spring Security” course.

The Master Class

The canonical reference for securing a web application with Spring Security and OAuth2.

The 6 modules cover everything from the basics of the OAuth2 flows to a full deep-dive into OpenID, JWT, Spring Boot support.

And, most importantly, the material is focused on the entirely new OAuth2 stack the Spring Security team has been working on since late 2017 now.

Simply put, every possible corner of an OAuth2 implementation with Spring Security.

~33 Hours

1. Intro to OAuth2 and the OAuth2 Roles

4 LESSONS (2 Video + 2 Text) ~ 2 HOURS

Intro to OAuth2 and the OAuth2 Roles (theory) (text)
Picking the Right OAuth Grant Type/Flow to Use (theory)
The State of OAuth2 in Spring Security (preview lesson)
Setting up the Project (text)

2. The Basics of OAuth2 (New Stack)

5 LESSONS (4 Video + 1 Text) ~ 3 HOURS

The Authorization Code Flow (theory) (preview lesson)
The Authorization Server with Keycloak
The New OAuth2 Client Support (2 parts)
The New Resource Server Support (2 parts)
JWT Support (text)

3. OAuth2 Beyond the Basics - The Resource Server (New Stack)

8 LESSONS (8 Text) ~ 8 HOURS

Basic Authorization with OAuth2 (text)
Verify/Validate Claims from the JWT (text)
Accessing JWT Bearer Token Authentication Attributes (text)
Accessing JWT Bearer Token Authentication Attributes Using SpEL (text)
Custom Authorities From JWT Claims (text)
Custom Validators For JWT Claims (text)
Resource Server Multi-Tenancy Support (text)
Resource Server Testing Support (text)

4. OAuth2 Beyond the Basics - The Client (New Stack)

4 LESSONS (4 Text) ~ 5 HOURS

The Client Configuration Under the Hood (text)
New OAuth2 Social Login (text)
Refreshing a Token (text)
Testing OAuth2 Clients (text)

5. OAuth2 Beyond the Basics - Deep-Dives (New Stack)

9 LESSONS (9 Text) ~ 11 HOURS

OAuth2 and SPAs (theory) (text)
OAuth2 and SPAs (implementation) (text)
Exploring JWS with OAuth2 (text)
Testing OAuth2 with REST-assured (text)
OAuth2 and OpenID Connect (text)
Logout with OAuth and OIDC (text)
The Client Credentials Flow (text)
Token Revocation (text)
The Legacy Stack Authorization Server (text)

6. Microservices, Spring Security and OAuth2 (New Stack)

WORKSHOP ~ 4 HOURS

OAuth Security Patterns in a Microservice Application
Sharing Principal Information in Microservices
Exploring Topologies – Gateway API as OAuth2 Client (2 parts)

The Certification Class

This Class contains the same material as the Master Class, but goes beyond the core material with:

multiple-choice questions in each lesson to make sure you fully understood the material
a Certificate of Completion (example)
the download ability for all video lessons – to help you learn offline

Of course, if you have any questions about the material, ping me directly here, on chat, or over email.

~33 Hours

All 6 Modules
30 Lessons
-
-
-

All 6 Modules
30 Lessons
+ Exercises in Each Lesson
+ Full Downloads for All Videos
+ Certificate of Completion

All 20 Modules
85 Lessons
+ Exercises in Each Lesson
+ Full Downloads for All Videos
+ Certificate of Completion

If you’re looking to get both this course as well as Learn Spring Security Core,

Have a look at the full Learn Spring Security Course →

Do you have a team who would benefit from taking the course?

Here are our team licenses →

20-Day Money Back Guarantee

I believe strongly in the quality of the course material to teach you the fundamentals of API design as well as the advanced tactics to take your API into production. I’ve put a lot of work and care into the material and hope you’re going to use it and really make your REST APIs a lot better.

I confidently back all classes with a 20-Day Money Back Guarantee. I want you to dive in deep and experience the full wealth of this resource without hesitation.

If the material isn’t a good fit, just contact me within 20 days of purchase, and ask for a full refund for any single course package.