You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
@@ -185,7 +185,7 @@ However, opaque, also known as binary tokens, can only be introspected remotely.
185
185
186
186
[NOTE]
187
187
====
188
-
Using the Quarkus OIDC extension, both the Bearer token and Authorization Code Flow authentication mechanisms use xref:smallrye-jwt-authentication[SmallRye JWT authentication] to represent JWT tokens as MicroProfile JWT `org.eclipse.microprofile.jwt.JsonWebToken`.
188
+
Using the Quarkus OIDC extension, both the Bearer token and Authorization Code Flow authentication mechanisms use <<smallrye-jwt-authentication>> to represent JWT tokens as MicroProfile JWT `org.eclipse.microprofile.jwt.JsonWebToken`.
189
189
====
190
190
191
191
==== Additional Quarkus resources for OIDC authentication
Copy file name to clipboardExpand all lines: docs/src/main/asciidoc/security-overview-concept.adoc
+21-23Lines changed: 21 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,17 +6,17 @@ include::_attributes.adoc[]
6
6
7
7
Quarkus Security is a framework that provides the architecture, multiple authentication and authorization mechanisms, and other tools for you to build secure and production-quality Java applications.
8
8
9
-
Before you start building security into your Quarkus applications, learn about the xref:security-architecture-concept.adoc[Quarkus Security architecture] and the different authentication mechanisms and features that you can use.
9
+
Before building security into your Quarkus applications, learn about the xref:security-architecture-concept.adoc[Quarkus Security architecture] and the different authentication mechanisms and features that you can use.
10
10
11
11
== Key features of Quarkus Security
12
12
13
-
The Quarkus Security framework provides built-in security authentication mechanisms for Basic, Form-based, and mutual TLS (mTLS) authentication.
14
-
You can also use other well-known xref:security-authentication-mechanisms-concept.adoc#other-supported-authentication-mechanisms[authentication mechanisms], such as OpenId Connect (OIDC) and WebAuthn.
13
+
The Quarkus Security framework provides built-in security authentication mechanisms for Basic, Form-based, and mutual TLS (mTLS) authentication.
14
+
You can also use other well-known xref:security-authentication-mechanisms-concept.adoc#other-supported-authentication-mechanisms[authentication mechanisms], such as OpenID Connect (OIDC) and WebAuthn.
15
15
16
16
Authentication mechanisms depend on xref:security-identity-providers-concept.adoc[Identity providers] to verify the authentication credentials and map them to a `SecurityIdentity` instance, which has the username, roles, original authentication credentials, and other attributes.
17
17
18
-
{project-name} also includes built-in security to allow for role-based access control (RBAC) based on the common security annotations @RolesAllowed, @DenyAll, @PermitAll on REST endpoints, and CDI beans.
19
-
For more information, see xref:security-authorize-web-endpoints-reference.adoc[Authorization of web endpoints].
18
+
{project-name} also includes built-in security to allow for role-based access control (RBAC) based on the common security annotations @RolesAllowed, @DenyAll, @PermitAll on REST endpoints, and CDI beans.
19
+
For more information, see the Quarkus xref:security-authorize-web-endpoints-reference.adoc[Authorization of web endpoints] guide.
20
20
21
21
Quarkus Security also supports the following features:
22
22
@@ -26,44 +26,43 @@ Quarkus Security also supports the following features:
26
26
* <<csrf-prevention>>
27
27
* <<samesite-cookies>>
28
28
* <<secrets-engines>>
29
-
* <<secure-serialization>>
30
29
* <<rest-data-panache>>
30
+
* <<secure-serialization>>
31
31
* xref:security-vulnerability-detection-concept.adoc[Security vulnerability detection and National Vulnerability Database (NVD) registration]
32
32
33
-
Quarkus Security is also highly customizable. For more information, see xref:security-customization.adoc[Security customization].
33
+
Quarkus Security is also highly customizable.
34
+
For more information, see the Quarkus xref:security-customization.adoc[Security tips and tricks] guide.
34
35
35
36
== Getting started with Quarkus Security
36
37
37
-
To get started with security in Quarkus, we recommend you combine the Quarkus built-in xref:security-basic-authentication-concept.adoc[Basic authentication] with the Jakarta Persistence identity provider to enable role-based access control (RBAC).
38
+
To get started with security in Quarkus, consider combining the Quarkus built-in xref:security-basic-authentication-concept.adoc[Basic authentication] with the Jakarta Persistence identity provider to enable role-based access control (RBAC).
38
39
Complete the steps in the xref:security-basic-authentication-tutorial.adoc[Secure a Quarkus application with Basic authentication] tutorial.
39
40
40
-
After you have successfully secured your Quarkus application with Basic authentication, you can increase the security further by adding more advanced authentication mechanisms, for example, OpenID Connect (OIDC) authentication.
41
-
42
-
//Add a link to the recomposed OIDC intro concept here.
41
+
After successfully securing your Quarkus application with Basic authentication, you can increase the security further by adding more advanced authentication mechanisms, for example, the xref:security-oidc-code-flow-authentication-concept.adoc[OpenID Connect (OIDC) authorization code flow mechanism].
43
42
44
43
== Quarkus Security testing
45
44
46
-
Guidance for testing Quarkus Security features and ensuring that your Quarkus applications are securely protected is provided in xref:security-testing.adoc[Security Testing].
45
+
Guidance for testing Quarkus Security features and ensuring that your Quarkus applications are securely protected is provided in the Quarkus xref:security-testing.adoc[Security testing] guide.
47
46
48
47
== More about security features in Quarkus
49
48
50
49
[[cross-origin-resource-sharing]]
51
50
=== Cross-origin resource sharing
52
51
53
52
To make your Quarkus application accessible to another application running on a different domain, you need to configure cross-origin resource sharing (CORS).
54
-
For more information about the CORS filter that is provided by Quarkus, see the xref:http-reference.adoc#cors-filter[HTTP reference] information.
53
+
For more information about the CORS filter that Quarkus provides, see the Quarkus xref:http-reference.adoc#cors-filter[CORS filter] section of the "HTTP reference" guide.
55
54
56
55
[[csrf-prevention]]
57
-
=== Cross-site Request Forgery (CSRF) prevention
56
+
=== Cross-Site Request Forgery (CSRF) prevention
58
57
59
58
Quarkus Security provides a RESTEasy Reactive filter that can protect your applications against a https://owasp.org/www-community/attacks/csrf[Cross-Site Request Forgery] attack.
60
-
For more information, see xref:security-csrf-prevention.adoc[Cross-Site Request Forgery Prevention].
59
+
For more information, see the Quarkus xref:security-csrf-prevention.adoc[Cross-Site Request Forgery Prevention] guide.
61
60
62
61
[[samesite-cookies]]
63
62
=== SameSite cookies
64
63
65
64
You can add a link:https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite[SameSite] cookie property to any of the cookies set by a Quarkus endpoint.
66
-
For more information, see xref:http-reference.adoc#same-site-cookie[SameSite cookies].
65
+
For more information, see the Quarkus xref:http-reference.adoc#same-site-cookie[SameSite cookies] guide.
67
66
68
67
[[secrets-engines]]
69
68
=== Secrets engines
@@ -76,19 +75,18 @@ For more information, see the link:{vault-guide}[Quarkus and HashiCorp Vault] do
76
75
=== Secure serialization
77
76
78
77
If your Quarkus Security architecture includes RESTEasy Reactive and Jackson, Quarkus can limit the fields that are included in JSON serialization based on the configured security.
79
-
For more information, see xref:resteasy-reactive.adoc#secure-serialization[Writing REST services with RESTEasy Reactive].
78
+
For more information, see the Quarkus xref:resteasy-reactive.adoc#secure-serialization[Writing REST services with RESTEasy Reactive] guide.
80
79
81
80
[[rest-data-panache]]
82
81
=== Secure auto-generated resources by REST Data with Panache
83
82
84
-
If you are using the REST Data with Panache extension to auto-generate your resources, you can still use the Security annotations within the package `jakarta.annotation.security`.
85
-
For more information, see xref:rest-data-panache.adoc#securing-endpoints[Securing auto-generated resources].
86
-
87
-
== Security vulnerability detection
83
+
If you use the REST Data with Panache extension to auto-generate your resources, you can still use security annotations within the package `jakarta.annotation.security`.
84
+
For more information, see the xref:rest-data-panache.adoc#securing-endpoints[Securing auto-generated resources] section of the Quarkus "Generating Jakarta REST resources with Panache" guide.
88
85
89
-
Most of the Quarkus tags are reported in the US link:https://nvd.nist.gov[National Vulnerability Database (NVD)].
90
-
For information about security vulnerabilities, see xref:security-vulnerability-detection-concept.adoc[Security vulnerability detection and reporting in Quarkus].
86
+
== Security vulnerability detection
91
87
88
+
Most Quarkus tags get reported in the US link:https://nvd.nist.gov[National Vulnerability Database (NVD)].
89
+
For information about security vulnerabilities, see the xref:security-vulnerability-detection-concept.adoc[Security vulnerability detection and reporting in Quarkus] guide.
0 commit comments