{"id":2164,"date":"2026-10-17T10:09:46","date_gmt":"2026-10-17T10:09:46","guid":{"rendered":"https:\/\/cabane.md\/?p=2164"},"modified":"2026-10-17T10:09:46","modified_gmt":"2026-10-17T10:09:46","slug":"zapomente-na-klasicke-prihlasovani-v-springu","status":"publish","type":"post","link":"https:\/\/cabane.md\/ru\/zapomente-na-klasicke-prihlasovani-v-springu\/","title":{"rendered":"Zapome\u0148te na klasick\u00e9 p\u0159ihla\u0161ov\u00e1n\u00ed v Springu"},"content":{"rendered":"<h1>Zapome\u0148te na klasick\u00e9 p\u0159ihla\u0161ov\u00e1n\u00ed v Springu<\/h1>\n<nav class=\"toc\" aria-label=\"Obsah\">\n<h2>Obsah<\/h2>\n<ul>\n<li><a href=\"#proc-stare-zpusoby-nefunguji\">Pro\u010d star\u00e9 zp\u016fsoby nefunguj\u00ed<\/a><\/li>\n<li><a href=\"#nova-era-bezstavove-a-deklarativni-prihlasovani\">Nov\u00e1 \u00e9ra: bezstavov\u00e9 a deklarativn\u00ed p\u0159ihla\u0161ov\u00e1n\u00ed<\/a><\/li>\n<li><a href=\"#jak-na-to-v-praxi\">Jak na to v praxi<\/a><\/li>\n<li><a href=\"#caste-otazky-faq\">\u010cast\u00e9 ot\u00e1zky (FAQ)<\/a><\/li>\n<\/ul>\n<\/nav>\n<p>Ka\u017ed\u00fd, kdo n\u011bkdy psal webovou aplikaci v Jav\u011b, v\u00ed, \u017ee <strong>spr\u00e1va p\u0159ihla\u0161ov\u00e1n\u00ed<\/strong> b\u00fdv\u00e1 no\u010dn\u00ed m\u016frou. Kdy\u017e p\u0159ijde \u0159e\u010d na Spring Security, v\u011bt\u0161ina v\u00fdvoj\u00e1\u0159\u016f si vybav\u00ed slo\u017eit\u00e9 XML konfigurace, nekone\u010dn\u00e9 \u0159et\u011bzce filtr\u016f a frustraci z lad\u011bn\u00ed autentiza\u010dn\u00edch endpoint\u016f. Ale co kdybych v\u00e1m \u0159ekl, \u017ee existuje zp\u016fsob, jak se s t\u00edm v\u0161\u00edm rozlou\u010dit a p\u0159itom m\u00edt <em>bezpe\u010dnost na prvn\u00edm m\u00edst\u011b<\/em>? \u0158e\u0161en\u00edm je modern\u00ed p\u0159\u00edstup k p\u0159ihla\u0161ov\u00e1n\u00ed, kter\u00fd ocen\u00edte hned od prvn\u00edho spu\u0161t\u011bn\u00ed. V\u00edce se dozv\u00edte na <a href=\"https:\/\/spingrannycz.net\" target=\"_blank\" rel=\"noopener\">https:\/\/spingrannycz.net<\/a>, kde najdete praktick\u00e9 uk\u00e1zky a n\u00e1stroje pro v\u00e1\u0161 projekt.<\/p>\n<p>Tradi\u010dn\u00ed cesta znamenala ps\u00e1t des\u00edtky \u0159\u00e1dk\u016f konfigurace, definovat role, opr\u00e1vn\u011bn\u00ed a \u010dasto i vlastn\u00ed filtry. V\u00fdsledek? K\u00f3d, kter\u00fd byl sice funk\u010dn\u00ed, ale <strong>t\u011b\u017eko udr\u017eovateln\u00fd<\/strong> a pln\u00fd skryt\u00fdch past\u00ed. Dnes u\u017e je mo\u017en\u00e9 se obej\u00edt bez zbyte\u010dn\u00e9 slo\u017eitosti a soust\u0159edit se na to podstatn\u00e9 \u2013 na samotnou aplikaci a jej\u00ed u\u017eivatele. Nov\u00e9 techniky a frameworky n\u00e1m umo\u017e\u0148uj\u00ed p\u0159ihla\u0161ov\u00e1n\u00ed zjednodu\u0161it na minimum, ani\u017e bychom slevili z bezpe\u010dnostn\u00edch standard\u016f.<\/p>\n<h2 id=\"proc-stare-zpusoby-nefunguji\">Pro\u010d star\u00e9 zp\u016fsoby nefunguj\u00ed<\/h2>\n<p>Klasick\u00fd Spring Security s <em>form loginem<\/em> a z\u00e1kladn\u00ed autentizac\u00ed je dnes pova\u017eov\u00e1n za p\u0159e\u017eitek. Nejen\u017ee je zraniteln\u00fd v\u016f\u010di \u00fatok\u016fm typu CSRF, pokud ho nechr\u00e1n\u00edte, ale tak\u00e9 nut\u00ed u\u017eivatele k neust\u00e1l\u00e9mu zad\u00e1v\u00e1n\u00ed hesel. U\u017eivatelsk\u00e1 zku\u0161enost trp\u00ed a v\u00fdvoj\u00e1\u0159 tr\u00e1v\u00ed hodiny lad\u011bn\u00edm relac\u00ed a token\u016f. Nav\u00edc ka\u017ed\u00e1 zm\u011bna v konfiguraci vy\u017eaduje restart serveru a testov\u00e1n\u00ed cel\u00e9 autentiza\u010dn\u00ed logiky \u2013 co\u017e je v agiln\u00edm prost\u0159ed\u00ed naprosto neakceptovateln\u00e9.<\/p>\n<p>Pod\u00edvejme se na hlavn\u00ed nev\u00fdhody tradi\u010dn\u00edho p\u0159\u00edstupu:<\/p>\n<ul>\n<li><strong>Nadm\u011brn\u00e1 konfigurace<\/strong> \u2013 des\u00edtky a\u017e stovky \u0159\u00e1dk\u016f XML nebo Java konfigurace, kter\u00e9 se snadno rozbij\u00ed<\/li>\n<li><strong>Slab\u00e1 podpora modern\u00edch standard\u016f<\/strong> \u2013 OAuth2, JWT a soci\u00e1ln\u00ed login vy\u017eaduj\u00ed spoustu vlastn\u00edho k\u00f3du<\/li>\n<li><strong>Probl\u00e9my s v\u00fdkonem<\/strong> \u2013 ka\u017ed\u00fd po\u017eadavek proch\u00e1z\u00ed \u0159et\u011bzcem filtr\u016f, co\u017e zpomaluje aplikaci<\/li>\n<li><strong>\u0160patn\u00e1 \u0161k\u00e1lovatelnost<\/strong> \u2013 session-based \u0159e\u0161en\u00ed nefunguje dob\u0159e v distribuovan\u00fdch syst\u00e9mech<\/li>\n<li><strong>N\u00e1ro\u010dn\u00e1 \u00fadr\u017eba<\/strong> \u2013 i mal\u00e1 zm\u011bna v bezpe\u010dnostn\u00ed politice znamen\u00e1 p\u0159episov\u00e1n\u00ed k\u00f3du<\/li>\n<\/ul>\n<h2 id=\"nova-era-bezstavove-a-deklarativni-prihlasovani\">Nov\u00e1 \u00e9ra: bezstavov\u00e9 a deklarativn\u00ed p\u0159ihla\u0161ov\u00e1n\u00ed<\/h2>\n<p>\u0158e\u0161en\u00edm je p\u0159ej\u00edt na <strong>bezstavovou autentizaci<\/strong> s vyu\u017eit\u00edm JWT token\u016f a modern\u00edch knihoven, kter\u00e9 zvl\u00e1dnou v\u011bt\u0161inu pr\u00e1ce za v\u00e1s. M\u00edsto psan\u00ed vlastn\u00edch filtr\u016f sta\u010d\u00ed definovat n\u011bkolik pravidel a framework se postar\u00e1 o zbytek. Va\u0161e aplikace je pak nejen bezpe\u010dn\u011bj\u0161\u00ed, ale tak\u00e9 <em>mnohem jednodu\u0161\u0161\u00ed na \u00fadr\u017ebu<\/em>. Nov\u00e1 generace n\u00e1stroj\u016f umo\u017e\u0148uje deklarativn\u011b nastavit, kdo m\u00e1 p\u0159\u00edstup k jak\u00fdm endpoint\u016fm, ani\u017e byste museli sahat do hlubin konfigurace.<\/p>\n<p>Porovnejme star\u00fd a nov\u00fd p\u0159\u00edstup v p\u0159ehledn\u00e9 tabulce:<\/p>\n<table>\n<thead>\n<tr>\n<th>Vlastnost<\/th>\n<th>Klasick\u00e9 p\u0159ihla\u0161ov\u00e1n\u00ed<\/th>\n<th>Modern\u00ed p\u0159\u00edstup<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Konfigurace<\/td>\n<td>Slo\u017eit\u00e1, mnoho \u0159\u00e1dk\u016f<\/td>\n<td>Minim\u00e1ln\u00ed, deklarativn\u00ed<\/td>\n<\/tr>\n<tr>\n<td>Spr\u00e1va relac\u00ed<\/td>\n<td>Session na serveru<\/td>\n<td>Bezstavov\u00e9 JWT tokeny<\/td>\n<\/tr>\n<tr>\n<td>Podpora OAuth2<\/td>\n<td>Vlastn\u00ed implementace<\/td>\n<td>Integrovan\u00e1 podpora<\/td>\n<\/tr>\n<tr>\n<td>\u0160k\u00e1lovatelnost<\/td>\n<td>Omezen\u00e1<\/td>\n<td>Vysok\u00e1 (stateless)<\/td>\n<\/tr>\n<tr>\n<td>Bezpe\u010dnost<\/td>\n<td>Z\u00e1vis\u00ed na v\u00fdvoj\u00e1\u0159i<\/td>\n<td>Standardizovan\u00e1 ochrana<\/td>\n<\/tr>\n<tr>\n<td>\u00dadr\u017eba<\/td>\n<td>N\u00e1ro\u010dn\u00e1<\/td>\n<td>Jednoduch\u00e1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<div style=\"text-align:center\"><iframe loading=\"lazy\" width=\"564\" height=\"313\" src=\"https:\/\/www.youtube.com\/embed\/qcWVNJs4Nbs\" alt=\"spingranny login login\"><\/iframe><\/div>\n<h2 id=\"jak-na-to-v-praxi\">Jak na to v praxi<\/h2>\n<p>Zm\u011bna my\u0161len\u00ed je prvn\u00edm krokem. M\u00edsto toho, abyste bojovali s nastaven\u00edm ka\u017ed\u00e9ho filtru, si osvojte princip <strong>security by configuration<\/strong>. Pou\u017eijte modern\u00ed anotace jako <code>@PreAuthorize<\/code> a <code>@PostAuthorize<\/code> a nechte Spring, a\u0165 si s\u00e1m porad\u00ed s valida\u010dn\u00edmi mechanismy. Druh\u00fdm krokem je p\u0159echod na <em>JWT autentizaci<\/em>, kter\u00e1 je dnes standardem pro REST API. Token obsahuje v\u0161echny pot\u0159ebn\u00e9 informace o u\u017eivateli a nen\u00ed t\u0159eba ukl\u00e1dat relaci na serveru.<\/p>\n<p>Nebojte se tak\u00e9 vyu\u017e\u00edt hotov\u00e1 \u0159e\u0161en\u00ed jako je <strong>Spring Security OAuth2 Client<\/strong>, kter\u00e9 zvl\u00e1dne p\u0159ihla\u0161ov\u00e1n\u00ed p\u0159es Google, Facebook nebo GitHub b\u011bhem n\u011bkolika minut. Sta\u010d\u00ed p\u0159idat z\u00e1vislost a nakonfigurovat kl\u00ed\u010de. V\u00fdsledkem je aplikace, kter\u00e1 je p\u0159ipraven\u00e1 na modern\u00ed sv\u011bt, ani\u017e byste museli ob\u011btovat \u010das na zbyte\u010dn\u00e9 detaily.<\/p>\n<h2 id=\"caste-otazky-faq\">\u010cast\u00e9 ot\u00e1zky (FAQ)<\/h2>\n<h3 id=\"je-bezpecne-pouzivat-jwt-tokeny-bez-session\">Je bezpe\u010dn\u00e9 pou\u017e\u00edvat JWT tokeny bez session?<\/h3>\n<p>Ano, pokud token podep\u00ed\u0161ete soukrom\u00fdm kl\u00ed\u010dem a nastav\u00edte kr\u00e1tkou dobu platnosti. Pro je\u0161t\u011b vy\u0161\u0161\u00ed bezpe\u010dnost kombinujte JWT s <strong>refresh tokeny<\/strong> a blacklistem.<\/p>\n<h3 id=\"musim-prepsat-celou-aplikaci-abych-mohl-pouzit-nove-prihlasovani\">Mus\u00edm p\u0159epsat celou aplikaci, abych mohl pou\u017e\u00edt nov\u00e9 p\u0159ihla\u0161ov\u00e1n\u00ed?<\/h3>\n<p>Ne. V\u011bt\u0161ina modern\u00edch p\u0159\u00edstup\u016f je navr\u017eena tak, aby se dala integrovat postupn\u011b. M\u016f\u017eete za\u010d\u00edt u jednoho endpointu a postupn\u011b migrovat.<\/p>\n<h3 id=\"co-kdyz-potrebuji-podporovat-starsi-klienty-kteri-neumi-jwt\">Co kdy\u017e pot\u0159ebuji podporovat star\u0161\u00ed klienty, kte\u0159\u00ed neum\u00ed JWT?<\/h3>\n<p>M\u016f\u017eete pou\u017e\u00edt hybridn\u00ed \u0159e\u0161en\u00ed \u2013 zachovat klasick\u00e9 session pro star\u00e9 klienty a JWT pro nov\u00e9. Spring Security to umo\u017e\u0148uje bez v\u011bt\u0161\u00edch z\u00e1sah\u016f.<\/p>\n<h3 id=\"jake-jsou-nejcastejsi-chyby-pri-prechodu-na-bezstavove-prihlasovani\">Jak\u00e9 jsou nej\u010dast\u011bj\u0161\u00ed chyby p\u0159i p\u0159echodu na bezstavov\u00e9 p\u0159ihla\u0161ov\u00e1n\u00ed?<\/h3>\n<p>Zapomenut\u00ed na <strong>ochranu proti CSRF<\/strong> u API endpoint\u016f, nespr\u00e1vn\u00e9 ukl\u00e1d\u00e1n\u00ed token\u016f na klientovi a absence mechanismu pro odvol\u00e1n\u00ed token\u016f.<\/p>\n<h3 id=\"zmeni-se-zpusob-testovani-aplikace\">Zm\u011bn\u00ed se zp\u016fsob testov\u00e1n\u00ed aplikace?<\/h3>\n<p>Ano, testov\u00e1n\u00ed se zjednodu\u0161\u00ed. Nemus\u00edte simulovat session, sta\u010d\u00ed poslat validn\u00ed token a otestovat, zda m\u00e1 spr\u00e1vn\u011b nastaven\u00e9 role a opr\u00e1vn\u011bn\u00ed.<\/p>\n<h3 id=\"je-mozne-kombinovat-vice-poskytovatelu-identity-napr-vlastni-databaze-socialni-s\">Je mo\u017en\u00e9 kombinovat v\u00edce poskytovatel\u016f identity (nap\u0159. vlastn\u00ed datab\u00e1ze + soci\u00e1ln\u00ed s\u00edt\u011b)?<\/h3>\n<p>Rozhodn\u011b. Spring Security podporuje <strong>v\u00edce autentiza\u010dn\u00edch provider\u016f<\/strong> najednou. M\u016f\u017eete m\u00edt jeden pro lok\u00e1ln\u00ed u\u017eivatele a druh\u00fd pro OAuth2.<\/p>\n<p>Zapome\u0148te na slo\u017eit\u00e9 konfigurace a zbyte\u010dn\u00e9 starosti. Modern\u00ed p\u0159ihla\u0161ov\u00e1n\u00ed v Springu je jednoduch\u00e9, bezpe\u010dn\u00e9 a hlavn\u011b <em>p\u0159izp\u016fsoben\u00e9 dne\u0161n\u00edm po\u017eadavk\u016fm<\/em>. Vyzkou\u0161ejte nov\u00fd p\u0159\u00edstup a uvid\u00edte, \u017ee se k tomu star\u00e9mu u\u017e nikdy nebudete cht\u00edt vracet.<\/p>","protected":false},"excerpt":{"rendered":"<p>Auto-generated post_excerpt<\/p>","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2164","post","type-post","status-publish","format-standard","hentry","category-uncategorized-ro"],"acf":[],"_links":{"self":[{"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/posts\/2164","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/comments?post=2164"}],"version-history":[{"count":1,"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/posts\/2164\/revisions"}],"predecessor-version":[{"id":2165,"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/posts\/2164\/revisions\/2165"}],"wp:attachment":[{"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/media?parent=2164"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/categories?post=2164"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cabane.md\/ru\/wp-json\/wp\/v2\/tags?post=2164"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}