Package com.codename1.backend.security

package com.codename1.backend.security

Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.

A server with no such bean links none of this.

Related Packages

Package	Description
com.codename1.backend	The Codename One backend runtime: the server side of an application, written in the same Java as the app and compiled to a native server binary.
com.codename1.backend.security.apikey	API keys: long-lived secrets a program presents instead of signing in.
com.codename1.backend.security.crypto	Password hashing: the PasswordEncoder contract, the delegating encoder that reads the {id} in front of a stored password, and the encoders behind it.
com.codename1.backend.security.mfa	A second factor at sign-in: one-time codes from an authenticator app, and the recovery codes that stand in for a lost phone.
com.codename1.backend.security.ratelimit	Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.
com.codename1.backend.security.rememberme	Remember-me: recognizing a returning user by a cookie, so that closing the browser does not sign them out.
com.codename1.backend.security.webauthn	Passkeys: signing in with a credential an authenticator holds, as the Web Authentication specification defines it.

Class	Description
AbstractAuthenticationToken	The parts every Authentication shares: its authorities, its details and the name read off its principal.
AccessDeniedException	The caller may not do what it asked.
AccessDeniedHandler	Answers a signed-in caller that asked for something it may not have.
AccessDeniedHandlerImpl	Answers 403.
AccountExpiredException	The account has expired.
AccountStatusException	The account exists and may not be used as it stands: locked, disabled or expired.
AnonymousAuthenticationFilter	Gives a request nobody signed in for an AnonymousAuthenticationToken, so the rules that follow always have an authentication to judge.
AnonymousAuthenticationToken	Who a request is from when nobody signed in: a principal called anonymousUser holding ROLE_ANONYMOUS, so authorization rules always have someone to ask about.
AnonymousConfigurer	The authentication of a request nobody signed in for; see AnonymousAuthenticationToken.
AntPathRequestMatcher	Matches a request's path against an Ant-style pattern, and optionally its method.
AnyRequestMatcher	Matches every request.
ApiKeyAuthenticationFilter	Authenticates a request from the API key it presents, in X-API-Key or as Authorization: Bearer <key>.
ApiKeyConfigurer	Sign-in with an API key on each request.
AuthenticatedAuthorizationManager<T>	Grants access by whether the caller signed in at all.
Authentication	Who a request is from: a credential presented for checking, or -- once an AuthenticationManager has accepted it -- the principal and what it may do.
AuthenticationCodec	Keeps one kind of Authentication in the HTTP session, and makes it again on the next request.
AuthenticationEntryPoint	Answers a request that has to authenticate first: with a challenge, or a redirect to where the user signs in.
AuthenticationException	The request could not be authenticated.
AuthenticationFailureHandler	Answers a sign-in that was refused.
AuthenticationManager	Decides whether a presented Authentication is genuine.
AuthenticationManagerResolver	Chooses what authenticates a request, by the request: a server with several tenants, or tokens from several issuers.
AuthenticationProvider	One way of checking an Authentication: a ProviderManager asks each of its providers that supports the token's class.
AuthenticationServiceException	Authentication could not be attempted at all: the user store failed, or the layer is misconfigured.
AuthenticationSuccessHandler	Answers the request that signed a user in.
AuthorityAuthorizationDecision	A decision that turned on what the caller is granted, with the authorities any one of which would have done.
AuthorityAuthorizationManager<T>	Grants access to an authenticated caller holding one of a set of authorities.
AuthorizationDecision	Granted, or not.
AuthorizationFilter	Puts the request to the chain's authorization rules, and throws AccessDeniedException when they refuse it.
AuthorizationManager<T>	Decides whether an authentication may reach something: for a request rule, a RequestAuthorizationContext.
AuthorizationServerConfigurer	Makes the server an OAuth2 authorization server and OpenID Connect provider.
AuthorizeHttpRequestsConfigurer	The authorization rules of a chain: which requests need what.
BadCredentialsException	The credentials are wrong: an unknown user or a password that does not match.
BasicAuthenticationEntryPoint	Answers 401 with the challenge that makes a client send HTTP Basic credentials: WWW-Authenticate: Basic realm="Realm".
BasicAuthenticationFilter	Authenticates a request from its Authorization: Basic header.
BearerTokenAuthenticationFilter	Authenticates a request from its bearer token.
Clock	Where the parts of the layer that judge time -- a token's expiry, a rate limit's window -- read it from, so a test can move it.
CookieCsrfTokenRepository	Keeps the token in a cookie, XSRF-TOKEN, for a page whose script reads the cookie and sends its value back in the X-XSRF-TOKEN header -- the convention Angular and axios follow.
CredentialsExpiredException	The password was right and has expired.
CsrfConfigurer	Protection against cross-site request forgery.
CsrfException	A state-changing request did not prove it came from the application's own pages.
CsrfFilter	Refuses a state-changing request that does not carry the chain's CSRF token.
CsrfToken	The token a page sends back with a state-changing request to show the request came from the application's own pages.
CsrfTokenRepository	Where a chain keeps the CSRF token it expects a client to send back.
Customizer<T>	Configures one part of an HttpSecurity: the lambda handed to formLogin, csrf, authorizeHttpRequests and the rest.
DaoAuthenticationProvider	Checks a username and password against a UserDetailsService: loads the user, compares the password through a PasswordEncoder, and refuses an account that is locked, disabled or expired.
DefaultCsrfToken	A CsrfToken that is its three values.
DefaultLoginPageGeneratingFilter	Serves a plain login page at GET /login for a chain that uses form login and names no page of its own.
DefaultSecurityFilterChain	A SecurityFilterChain that is a matcher and a list of filters: what HttpSecurity.build() returns.
DisabledException	The account is disabled.
ExceptionHandlingConfigurer	How a chain answers a request that must sign in, and one that may not have what it asked for.
ExceptionTranslationFilter	Turns the security exceptions thrown by what follows it -- the authorization rules, a controller, a service the controller calls -- into answers.
FilterChain	The rest of the chain, as a SecurityFilter sees it: the filters after it and then the application's routes.
FormLoginConfigurer	Sign-in through an HTML form.
GrantedAuthority	One thing an Authentication has been granted: a role, written ROLE_ADMIN, or any other authority the application checks by name.
HeadersConfigurer	The security headers a chain puts on its responses.
HeadersConfigurer.ContentSecurityPolicyConfig	Content-Security-Policy.
HeadersConfigurer.FrameOptionsConfig	X-Frame-Options.
HeadersConfigurer.HstsConfig	Strict-Transport-Security.
HeadersConfigurer.Toggle	A header that is either sent or not.
HeaderWriter	Writes a header onto every response a chain's requests get:
HeaderWriter.Headers	The headers of the response being written.
HeaderWriterFilter	Holds the chain's HeaderWriters.
Http403ForbiddenEntryPoint	Answers 403: what a chain with no way of signing in says to a request that would have to.
HttpBasicConfigurer	Sign-in with HTTP Basic credentials on each request.
HttpSecurity	Builds one SecurityFilterChain.
HttpSessionCsrfTokenRepository	Keeps the token in the HTTP session: the default.
HttpSessionRequestCache	Remembers the address in the HTTP session, under HttpSessionRequestCache.SAVED_REQUEST.
HttpSessionSecurityContextRepository	Keeps who is signed in in the HTTP session, under HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY.
HttpStatusEntryPoint	Answers with a status and nothing else: new HttpStatusEntryPoint(401) for an API whose clients know how to authenticate without being told.
HttpStatusReturningLogoutSuccessHandler	After sign-out, answers with a status and no page: for an API.
InsufficientAuthenticationException	The request is anonymous, or not authenticated strongly enough, for what it asked for.
InvalidCsrfTokenException	The request's CSRF token is not the one the server issued.
LockedException	The account is locked.
LoginUrlAuthenticationEntryPoint	Sends a request that has to sign in to the login page, with a 302.
LogoutConfigurer	Sign-out: POST /logout ends the session, forgets who was signed in and redirects to /login?logout.
LogoutFilter	Signs the user out when a request asks for it -- POST /logout unless configured otherwise -- and answers with the chain's LogoutSuccessHandler.
LogoutHandler	Something to undo when a user signs out: a session, a cookie, a stored token.
LogoutSuccessHandler	Answers the request that signed a user out.
MfaConfigurer	A second factor at sign-in.
MissingCsrfTokenException	The request carried a CSRF token and the server holds none to compare it with -- the session it belonged to is gone -- or carried none at all.
NullRequestCache	Remembers nothing.
NullSecurityContextRepository	Keeps nothing: every request authenticates itself.
OAuth2AuthorizationEndpointFilter	Answers the endpoints of an authorization server a user must be signed in for: the authorization endpoint and the device verification page.
OAuth2AuthorizationRequestRedirectFilter	Starts a sign-in at an identity provider: keeps the request this browser is sent away with, and redirects it to the provider.
OAuth2AuthorizationServerFilter	Answers the endpoints of an authorization server that a client calls as itself: the token, revocation, device authorization, JWK Set, user info and metadata endpoints.
OAuth2LoginAuthenticationFilter	Ends a sign-in at an identity provider: takes the provider's answer at /login/oauth2/code/{registrationId}, holds it to the request this browser was sent away with, exchanges the code, verifies the ID token and signs the user in.
OAuth2LoginConfigurer	Sign-in through another identity provider, with OAuth2 or OpenID Connect.
OAuth2ResourceServerConfigurer	Sign-in with a bearer token on each request: the routes under the chain are an OAuth 2.0 resource server, and the token is a JWT.
OAuth2ResourceServerConfigurer.JwtConfigurer	How the JWTs of a resource server are verified and read.
ProviderManager	An AuthenticationManager that asks a list of AuthenticationProviders in order and takes the first answer.
ProviderNotFoundException	No AuthenticationProvider of a ProviderManager checks tokens of the class it was handed.
RateLimitConfigurer	The rate limits of a chain; filled in by HttpSecurity.rateLimit(RequestMatcher, RateLimitKeyResolver, RateLimiter).
RateLimitFilter	Answers 429 to a request that is over one of the chain's rate limits; see HttpSecurity.rateLimit(RequestMatcher, RateLimitKeyResolver, RateLimiter).
RememberMeAuthenticationFilter	Recognizes a returning user by their remember-me cookie, on a request nobody has signed in for.
RememberMeAuthenticationToken	Who a request is from when the user was recognized by a remember-me cookie rather than signing in during this session.
RememberMeConfigurer	Remember-me: a cookie that signs a returning user in.
RequestAuthorizationContext	What a request rule is asked about: the request, and the variables its pattern bound.
RequestCache	Remembers where an anonymous request was going, so that signing in can send the user there instead of to a fixed page.
RequestCacheConfigurer	Whether a chain remembers where an anonymous request was going; see RequestCache.
RequestMatcher	Decides whether a rule applies to a request: which chain guards it, which authorization rule covers it, which requests CSRF protection leaves alone.
RequestMatcher.MatchResult	Whether a request matched, and the variables its pattern bound.
RequestMatchers	Combines matchers: all of them, any of them, or not one.
SavedRequestAwareAuthenticationSuccessHandler	After sign-in, sends the user to the page that asked them to sign in, or to a default when they came to the login page on their own.
SecondFactorAuthenticationFilter	Asks a user who has a second factor for it, between their password being accepted and their being signed in.
SecondFactorPolicy	Stands between a user passing their first factor and being signed in.
SecurityConfigurer	One configurable part of an HttpSecurity: form login, CSRF protection, the authorization rules.
SecurityContext	What the security layer knows about the thread's current request: who it is from.
SecurityContextConfigurer	Where a chain keeps who is signed in between requests.
SecurityContextHolder	Who the calling thread's request is from.
SecurityContextHolderFilter	Loads who is signed in from the chain's SecurityContextRepository into SecurityContextHolder before anything else looks.
SecurityContextImpl	A SecurityContext that holds its authentication and nothing else.
SecurityContextRepository	Where a chain keeps who is signed in between one request and the next.
SecurityExchange	What a chain keeps about the request the calling thread is serving, beyond the request itself: attributes filters hand one another, and headers for the response that is yet to come back.
SecurityFilter	One step of a SecurityFilterChain.
SecurityFilterChain	The filters that guard some of a server's requests.
SecuritySchema	The tables the security layer's database-backed stores keep, as a migration set of the layer's own.
ServiceBusyException	The server is doing as much of something expensive as it was told it may, and this request would have been one more: it is turned away at once, rather than queued behind work that is already late.
SessionCreationPolicy	Whether a chain may use the HTTP session.
SessionManagementConfigurer	Whether a chain uses the HTTP session, and what happens to it at sign-in.
SessionSignIn	How a chain signs a user in to a session, once some mechanism has established who they are.
SimpleGrantedAuthority	An authority that is its name and nothing else.
SimpleUrlAuthenticationFailureHandler	After a refused sign-in, sends the user to a page -- the login page with ?error, usually -- or, with no page set, answers 401.
SimpleUrlLogoutSuccessHandler	After sign-out, sends the user to a page.
UsernamePasswordAuthenticationFilter	Signs a user in from the login form: a POST to the login processing URL carrying username and password.
UsernamePasswordAuthenticationToken	A username and password: as a client presented them, or -- with authorities -- as an AuthenticationProvider accepted them.
WebAuthnAuthenticationFilter	Signs a user in with a passkey: hands out the options of a sign-in at POST /webauthn/authenticate/options, and takes the authenticator's answer at POST /login/webauthn.
WebAuthnConfigurer	Passkeys: a user who is signed in registers one, and from then on signs in with it.
WebAuthnRegistrationFilter	Lets a signed-in user register a passkey, and remove one of theirs: