In the previous lecture, we have Belarus' service with the name Slash Welcome, and we made changes
by adding spring security to our project.
Now our welcome is protected EPA.
So now in this lecture, I want to show one more feature of spring security, which will make our life
easy with the help of tokens and cookies that it is going to use internally.
As you can see, I got a response and if I try to refresh any number of times, it is not asking me
the credentials.
And again and again, it will only ask me very first time whenever I start accessing through a new browser
and my spring security framework is smart enough to send a token to my UAI are any application that
I'm invoking the Secret Service and my browsers are even more smart to send that same value for every
request that they are going to make subsequently.
So with that token, I'm not forcing my user to enter his credentials again and again so he can call
any number of times like any number of times I can refresh.
It's not asking me the credentials.
That's because with the power of tokenized that is used by Sprint security framework in the backend.
So in order to really show you how it's going to work, let me go to a postman application here.
I will select the history department that I get because our welcome API supports get.
So now I'll try to access my welcome API and this should fail the authentication.
The reason is we are accessing through Posman very first time and there is no session before.
So I'm just clicking send.
You can see I got a response saying that four zero one, which is unauthorized.
Now what I will do is I will go to the authorization tab and select basic what the user name that I
will give is easy bytes.
And the password is one, two, three, four, five.
With these values, if I tried to send the request to the welcome.
But you can see now I successfully got welcome from spring application with security response from the
application that I have written.
Now, what I will do is I will try to make another request by removing the authentication.
So now I said there is no authentication.
I'm sending in the request and if I try to click, send it.
Still giving me a valid response without for Xeroform.
And this is due to the power of a cookie present inside your head.
Like you can see, there is a cookie with the name Jaisha Ninety, and this is the value generated by
your backend springboard application with the help of spring security.
Very first time the user tried to login and we get the same from the server in the response and you
can see the same cookie file we do in the cookies of our response, which is being sent by my postman
every time I make subsequent calls.
So with this help of discussion, I am getting a proper response without passing the credentials to
make it even more clear.
What I will do is from the request I'll remove this token and now I do not have any alteration details
and I do not have a cookie with the discussion.
Only in my request, if I try to make a request, I will get a response saying that four zero one and
addressed.
And even in this scenario also I'll get a cookie with different value and this cookie in my back and
is maintained as a unauthorized user.
So if someone tried to access my application with this value, they will keep getting unauthorized like
you can see now inside my head.
That's how the cookie with the name to mine, too.
If I try to keep accessing the same cookie, I'll keep getting the unauthorized.
But the moment that I tried to add my user details to my basic authentication, I will try to invoke
my API again and you can see my cookie will change.
So right now it is with two nine two after making a request.
Now my magician only value change to seven for six on top.
And if I try to keep making the request at the same jaishankar ninety seven four six, my backend will
keep accepting even without credentials like I can show you by removing the authentication details from
the request and then keep sending and I'll get the same proper response without credentials.
So that's the one more good feature supported by Spring Security Framework.
Of course, Jason generally is the default one generated by spring security.
You can even more optimized to your production great application by using data tokens or tokens that
will be discussing a lot in the coming lectures.
So I hope this is.
Very clear on how spring security framework handles multiple requests without login and credentials,
it will only ask very first time if the same situation and the same user try to make another call.
It wants the credentials.
It's only expected to talk only as long as it is valid.
It will keep sending the proper response to the user.
So thank you and I'll see you in the next lecture by.