I'm wondering how do I properly secure this example app (https://github.com/brunodrugowick/spring-thymeleaf-vue-crud-example).

The app is:

  • A Spring (Boot) app with server-rendered pages via Thymeleaf.
  • And it serves, also, an API providing data for the pages.

I serve the pages via Thymeleaf (for example, Users, Roles etc.) and perform operations (CRUD) with Vue.js using the API.

What's the proper way to secure this stack and its underlying limitations considering this architecture?

Some questions that pop on my mind, to help you understand why I'm asking:

  • Can I go with Spring Security defaults (adding csrf token on my forms that POST/PUT with Vue.js)?
  • How do I integrate this with my DELETE via API, for example?
  • Should I disable csrf?
  • Does session even makes sense? Maybe I should give access to all the pages and control the access to the API. In this case wouldn't the way I developed (Vue scripts for every page) wrongly repetitive?

Does this architecture makes sense? What are the caveats?

New contributor
Bruno Drugowick is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.

Your Answer

Bruno Drugowick is a new contributor. Be nice, and check out our Code of Conduct.

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.