星期二, 3月 28, 2023

Spring HTTP Strict Transport Security Guide

 1. demo site

    1.


    2. generate, download, unzip, cd

    3. docker run -it --rm --name my-maven-project -v "$(pwd)":/usr/src/mymaven -w /usr/src/mymaven maven:3.9.0-eclipse-temurin-17 mvn clean install

    4. java -jar target/demo-0.0.1-SNAPSHOT.jar

    5. get generated security password

    6. visit http://localhost:8080 with username user and generated password

    7. 


2. index page

    1. create src/main/java/com/example/demo/controller/WebController.java

package com.example.demo.controller;

import org.springframework.stereotype.Controller;

import org.springframework.web.bind.annotation.RequestMapping;

@Controller

public class WebController {

    @RequestMapping(value = "/index")

    public String index() {

        return "index";

    }

}

    2. create src/main/resources/templates/index.html

<!DOCTYPE html>

<html>

    <head>

        <meta charset = "ISO-8859-1" />

        <title>Spring Boot Application</title>

    </head>

    <body>

        <h4>Welcome to Thymeleaf Spring Boot web application</h4>

    </body>

</html>

    3. repeat 1.3 ~ 1.6

    4. 


3. https

    1. create self-signed keystore: demo.keystore

keytool -genkeypair -alias demo -keyalg RSA -keystore demo.keystore -storetype JKS -dname "CN=localhost" -keypass keyPass -storepass storePass

    2. create spring config: demo.yml

server:

  port: 8443

  ssl:

    enabled: true

    key-alias: demo

    key-store: "/your/path/to/demo.keystore"

    key-store-type: jks

    key-store-password: storePass

    key-password: keyPass

    3. java -jar demo-0.0.1-SNAPSHOT.jar --spring.config.location=demo.yml

    4. repeat 1.5

    5. visit https://localhost:8443 with username user and generated password, ignore self-signed certificate warning.

    6.