hello and welcome to Red Stapler channel in this tutorial we are back to spring
Boot and we are going to show you how to OAuth2 and Facebook social login in a
very simple spring boot application let's go check it out
so here is our spring boot project that's serving a static HTML page I
already have a button which when clicked it will navigates to /login URL
if you look at a code you will see that I have prepared another buttons and a
text span which currently hidden we use that later to display a username and
logout button once we have authenticated with Facebook the first step is to add
two dependencies a starter spring security and OAuth2 to pom.xml if you
refresh the page now you see that our site has been secured automatically by
HTTP basic login form but since we want to use Facebook login instead then
let's move on over the next step we will add EnableOAuth2Sso annotation to
our main class and then add application.yml to your project
and add the OAuth2 setting. This is Facebook specific setting what you only
need to provide is the client ID or app ID and the client secret or your app
secret key both of this can be found on Facebook developer page when you created
the app it should be noted that you need to add your endpoint URL that you've
used for authentication to do valid or art redirected URL setting on Facebook
because the OAuth will only work for a specific address in this case I'm going
to put localhost:8080 and localhost:8080/login now I'm going to restart the
server and refresh the page
you see that once i refresh the page it will automatically and instantly
redirected to OAuth this because everything on your site is restricted
right now for access and you must be authenticated first this is not good
because we should let the user click the login button by themselves and then
redirect it to OAuth we can fix this by adding security configuration by
extending our main class with web security configurator adapter and
override the configured method
now we will allow access to root URL and /login URL now we also want to
retrieve the username from Facebook so let's create another end point at
/user and return the principal object we received from the authentication and
finally on our HTML we will execute the get ajax call to /user endpoint and we
will show logout button and username and also hide a login button
okay that works fine if I refresh the page again the login button will not
show anymore you stay login to the site as long as you sign on to Facebook now
the last part the logout button Spring Boot already provides support for
/logout endpoint so all you have to do is to make the POST request to it so
I'm going to add a JavaScript to make the Ajax POST to logout endpoint and
clear your username and show login button instead the important note is
Spring Bood has a built-in CSRF or cross-site request forgery protection
which need you to provide CSRF token along with the post request to make it
work but to avoid complication in this
tutorial we will disable this feature by call csrf.disabled method in
security configuration now let's reboot the server and try again
This works almost perfectly but if you notice the weird characters at the end
of the URL this was added by Facebook to protect the security session exploit
Facebook said it's not a bug but it's the responsibility of the developer to
handle this well it does look ugly and confusing for the user so I'm going to
add a few JavaScript to remove this from the URL and refresh the page
so that's it I know that's a lot for those who knew to spring boot security
and I hope this should give you some ideas about it let me know if you have
any questions or feedback and please subscribe like if you love this video
thanks for watching bye