MS Lesson 21: Spring Security
1. Authentication vs Authorization * Authentication - "Who are you?" Istifadecinin kimliyinin yoxlanilmasi. Esasen username ve passwordun yoxlanilmasi. Dogru olmadigi halda 401 Unauthorized xetasi verir. * Authorization - "What can you do?" Authentifikasiya olunmush istifadecinin hansi emeliyyatlara icazesi oldugunun yoxlanilmasi. Dogru olmadigi halda 403 (Forbidden) xetasi verir. 2. Spring Security internal flow Authentication - login melumatlarini dashiyan Java obyektidir. Authentication auth = new UsernamePasswordAuthenticationToken ( " admin ", // username (principal) " 12345 ", // password (credentials) null // authorities (hələ yoxdur) ); AuthenticationManager - Authentication prosesini idare eden koordinator. Default implementasiya ProviderManager. Filter-den Authentication obyektini alir, hansi AuthenticationProvider-in ishleyeceyini secir, Provider-e oturur. AuthenticationProvider - esl Authentication...