I'm wondering how do I properly secure this example app (https://github.com/brunodrugowick/spring-thymeleaf-vue-crud-example).
The app is:
- A Spring (Boot) app with server-rendered pages via Thymeleaf.
- And it serves, also, an API providing data for the pages.
I serve the pages via Thymeleaf (for example, Users, Roles etc.) and perform operations (CRUD) with Vue.js using the API.
What's the proper way to secure this stack and its underlying limitations considering this architecture?
Some questions that pop on my mind, to help you understand why I'm asking:
- Can I go with Spring Security defaults (adding csrf token on my forms that POST/PUT with Vue.js)?
- How do I integrate this with my DELETE via API, for example?
- Should I disable csrf?
- Does session even makes sense? Maybe I should give access to all the pages and control the access to the API. In this case wouldn't the way I developed (Vue scripts for every page) wrongly repetitive?
Does this architecture makes sense? What are the caveats?