{"id":29,"date":"2026-10-08T16:30:50","date_gmt":"2026-10-08T16:30:50","guid":{"rendered":"https:\/\/boot-code.com\/?p=29"},"modified":"2026-10-08T16:30:52","modified_gmt":"2026-10-08T16:30:52","slug":"spring-todo-web-application-login-security-tutorial-extension","status":"publish","type":"post","link":"https:\/\/boot-code.com\/?p=29","title":{"rendered":"Spring Todo Web Application Login Security Tutorial Extension"},"content":{"rendered":"\n

Yes. The next extension should add user registration + login\/logout + Spring Security + per-user Todo lists<\/strong>.<\/p>\n\n\n\n

The architecture becomes:<\/p>\n\n\n\n

Browser\n   \u2502\n   \u25bc\nSpring Security\n   \u2502\n   \u251c\u2500\u2500 Login\n   \u251c\u2500\u2500 Logout\n   \u2514\u2500\u2500 Authentication\n   \u2502\n   \u25bc\nTodo Controller\n   \u2502\n   \u25bc\nTodo Service\n   \u2502\n   \u251c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n   \u25bc              \u25bc\nUserRepository  TodoRepository\n   \u2502              \u2502\n   \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n          \u25bc\n        MySQL<\/code><\/pre>\n\n\n\n
I recommend using Spring Security 6 \/ Spring Boot 3.x<\/strong>, with passwords stored using BCrypt<\/strong>, never as plain text.<\/p>\n\n\n\n
I can give you the complete extension code<\/strong>, replacing the previous project with:<\/p>\n\n\n\n
    \n
  • User<\/code> entity<\/li>\n\n\n\n
  • Todo<\/code> \u2192 User<\/code> relationship<\/li>\n\n\n\n
  • Registration page<\/li>\n\n\n\n
  • Login page<\/li>\n\n\n\n
  • Logout<\/li>\n\n\n\n
  • BCrypt password hashing<\/li>\n\n\n\n
  • Spring Security configuration<\/li>\n\n\n\n
  • User-specific todos<\/li>\n\n\n\n
  • Protected \/todos\/**<\/code> pages<\/li>\n\n\n\n
  • REST API authentication<\/li>\n\n\n\n
  • MySQL database changes<\/li>\n\n\n\n
  • Bootstrap UI<\/li>\n\n\n\n
  • Complete Eclipse project structure<\/li>\n<\/ul>\n\n\n\n
    The important database design will become:<\/p>\n\n\n\n
    users\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nid\nusername\npassword\nrole\n\n\ntodos\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\nid\ntitle\ncompleted\nuser_id  \u2192 users.id<\/code><\/pre>\n\n\n\n
    So, for example:<\/p>\n\n\n\n
    User: devesh\n   \u2502\n   \u251c\u2500\u2500 Learn Java\n   \u251c\u2500\u2500 Learn Spring\n   \u2514\u2500\u2500 Learn MySQL\n\nUser: rahul\n   \u2502\n   \u251c\u2500\u2500 Learn Python\n   \u2514\u2500\u2500 Learn Django<\/code><\/pre>\n\n\n\n
    Each logged-in user will see only their own todos<\/strong>.<\/p>\n\n\n\n
    If you want, I can provide the full copy-paste code for every Java, HTML, pom.xml<\/code>, and application.properties<\/code> file<\/strong> as the next step.<\/p>\n\n\n\n
    Yes. Below is the complete upgraded Spring Todo Web Application with Login\/Security<\/strong>.<\/p>\n\n\n\n
    It extends the previous project with:<\/p>\n\n\n\n
      \n
    • Spring Security<\/li>\n\n\n\n
    • Registration<\/li>\n\n\n\n
    • Login\/logout<\/li>\n\n\n\n
    • BCrypt password hashing<\/li>\n\n\n\n
    • User roles<\/li>\n\n\n\n
    • MySQL<\/li>\n\n\n\n
    • User-specific Todo lists<\/li>\n\n\n\n
    • Add\/edit\/delete\/toggle Todo<\/li>\n\n\n\n
    • Thymeleaf + Bootstrap<\/li>\n\n\n\n
    • REST API<\/li>\n\n\n\n
    • Validation<\/li>\n<\/ul>\n\n\n\n
      \n\n\n\n
      1. Final project structure<\/h1>\n\n\n\n
      todo\/\n\u251c\u2500\u2500 pom.xml\n\u2502\n\u2514\u2500\u2500 src\/main\/\n    \u251c\u2500\u2500 java\/com\/example\/todo\/\n    \u2502\n    \u2502   \u251c\u2500\u2500 TodoApplication.java\n    \u2502   \u2502\n    \u2502   \u251c\u2500\u2500 config\/\n    \u2502   \u2502   \u2514\u2500\u2500 SecurityConfig.java\n    \u2502   \u2502\n    \u2502   \u251c\u2500\u2500 controller\/\n    \u2502   \u2502   \u251c\u2500\u2500 AuthController.java\n    \u2502   \u2502   \u251c\u2500\u2500 TodoController.java\n    \u2502   \u2502   \u2514\u2500\u2500 TodoRestController.java\n    \u2502   \u2502\n    \u2502   \u251c\u2500\u2500 model\/\n    \u2502   \u2502   \u251c\u2500\u2500 User.java\n    \u2502   \u2502   \u2514\u2500\u2500 Todo.java\n    \u2502   \u2502\n    \u2502   \u251c\u2500\u2500 repository\/\n    \u2502   \u2502   \u251c\u2500\u2500 UserRepository.java\n    \u2502   \u2502   \u2514\u2500\u2500 TodoRepository.java\n    \u2502   \u2502\n    \u2502   \u2514\u2500\u2500 service\/\n    \u2502       \u251c\u2500\u2500 UserService.java\n    \u2502       \u2514\u2500\u2500 TodoService.java\n    \u2502\n    \u2514\u2500\u2500 resources\/\n        \u251c\u2500\u2500 templates\/\n        \u2502   \u251c\u2500\u2500 login.html\n        \u2502   \u251c\u2500\u2500 register.html\n        \u2502   \u251c\u2500\u2500 index.html\n        \u2502   \u2514\u2500\u2500 edit.html\n        \u2502\n        \u2514\u2500\u2500 application.properties<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      2. MySQL database<\/h1>\n\n\n\n
      Start MySQL:<\/p>\n\n\n\n
      sudo systemctl start mysql<\/code><\/pre>\n\n\n\n
      Open MySQL:<\/p>\n\n\n\n
      sudo mysql<\/code><\/pre>\n\n\n\n
      Create database and user:<\/p>\n\n\n\n
      CREATE DATABASE todo_db;\n\nCREATE USER 'todo_user'@'localhost'\nIDENTIFIED BY 'todo_password';\n\nGRANT ALL PRIVILEGES ON todo_db.*\nTO 'todo_user'@'localhost';\n\nFLUSH PRIVILEGES;\n\nEXIT;<\/code><\/pre>\n\n\n\n
      You don’t need to manually create the users<\/code> or todo<\/code> tables.<\/p>\n\n\n\n
      JPA\/Hibernate will create them.<\/p>\n\n\n\n
      \n\n\n\n
      3. pom.xml<\/code><\/h1>\n\n\n\n
      Replace your existing pom.xml<\/code>:<\/p>\n\n\n\n
      <?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\n<project xmlns=\"http:\/\/maven.apache.org\/POM\/4.0.0\"\n         xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\n         xsi:schemaLocation=\"\n         http://maven.apache.org\/POM\/4.0.0\n         https:\/\/maven.apache.org\/xsd\/maven-4.0.0.xsd\">\n\n    <modelVersion>4.0.0<\/modelVersion>\n\n    <parent>\n        <groupId>org.springframework.boot<\/groupId>\n        <artifactId>spring-boot-starter-parent<\/artifactId>\n        <version>3.5.6<\/version>\n        <relativePath\/>\n    <\/parent>\n\n    <groupId>com.example<\/groupId>\n\n    <artifactId>todo<\/artifactId>\n\n    <version>0.0.1-SNAPSHOT<\/version>\n\n    <name>todo<\/name>\n\n    <description>\n        Spring Boot Todo Application with Security\n    <\/description>\n\n    <properties>\n        <java.version>17<\/java.version>\n    <\/properties>\n\n    <dependencies>\n\n        <!-- Spring Web -->\n        <dependency>\n            <groupId>org.springframework.boot<\/groupId>\n            <artifactId>spring-boot-starter-web<\/artifactId>\n        <\/dependency>\n\n        <!-- Thymeleaf -->\n        <dependency>\n            <groupId>org.springframework.boot<\/groupId>\n            <artifactId>spring-boot-starter-thymeleaf<\/artifactId>\n        <\/dependency>\n\n        <!-- Thymeleaf Spring Security -->\n        <dependency>\n            <groupId>org.thymeleaf.extras<\/groupId>\n            <artifactId>thymeleaf-extras-springsecurity6<\/artifactId>\n        <\/dependency>\n\n        <!-- JPA -->\n        <dependency>\n            <groupId>org.springframework.boot<\/groupId>\n            <artifactId>spring-boot-starter-data-jpa<\/artifactId>\n        <\/dependency>\n\n        <!-- Spring Security -->\n        <dependency>\n            <groupId>org.springframework.boot<\/groupId>\n            <artifactId>spring-boot-starter-security<\/artifactId>\n        <\/dependency>\n\n        <!-- Validation -->\n        <dependency>\n            <groupId>org.springframework.boot<\/groupId>\n            <artifactId>spring-boot-starter-validation<\/artifactId>\n        <\/dependency>\n\n        <!-- MySQL -->\n        <dependency>\n            <groupId>com.mysql<\/groupId>\n            <artifactId>mysql-connector-j<\/artifactId>\n            <scope>runtime<\/scope>\n        <\/dependency>\n\n        <!-- DevTools -->\n        <dependency>\n            <groupId>org.springframework.boot<\/groupId>\n            <artifactId>spring-boot-devtools<\/artifactId>\n            <optional>true<\/optional>\n        <\/dependency>\n\n        <!-- Testing -->\n        <dependency>\n            <groupId>org.springframework.boot<\/groupId>\n            <artifactId>spring-boot-starter-test<\/artifactId>\n            <scope>test<\/scope>\n        <\/dependency>\n\n        <!-- Security Testing -->\n        <dependency>\n            <groupId>org.springframework.security<\/groupId>\n            <artifactId>spring-security-test<\/artifactId>\n            <scope>test<\/scope>\n        <\/dependency>\n\n    <\/dependencies>\n\n    <build>\n\n        <plugins>\n\n            <plugin>\n                <groupId>org.springframework.boot<\/groupId>\n                <artifactId>spring-boot-maven-plugin<\/artifactId>\n            <\/plugin>\n\n        <\/plugins>\n\n    <\/build>\n\n<\/project><\/code><\/pre>\n\n\n\n
      \n\n\n\n
      4. Main application<\/h1>\n\n\n\n
      TodoApplication.java<\/code><\/p>\n\n\n\n
      package com.example.todo;\n\nimport org.springframework.boot.SpringApplication;\nimport org.springframework.boot.autoconfigure.SpringBootApplication;\n\n@SpringBootApplication\npublic class TodoApplication {\n\n    public static void main(String[] args) {\n\n        SpringApplication.run(\n            TodoApplication.class,\n            args\n        );\n\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      5. User entity<\/h1>\n\n\n\n
      Create:<\/p>\n\n\n\n
      model\/User.java<\/code><\/pre>\n\n\n\n
      package com.example.todo.model;\n\nimport jakarta.persistence.*;\n\nimport java.util.ArrayList;\nimport java.util.List;\n\n@Entity\n@Table(name = \"users\")\npublic class User {\n\n    @Id\n    @GeneratedValue(strategy = GenerationType.IDENTITY)\n    private Long id;\n\n    @Column(nullable = false, unique = true)\n    private String username;\n\n    @Column(nullable = false)\n    private String password;\n\n    @Column(nullable = false)\n    private String role = \"USER\";\n\n    @OneToMany(\n        mappedBy = \"user\",\n        cascade = CascadeType.ALL,\n        orphanRemoval = true\n    )\n    private List<Todo> todos = new ArrayList<>();\n\n    public User() {\n    }\n\n    public User(\n            String username,\n            String password,\n            String role) {\n\n        this.username = username;\n        this.password = password;\n        this.role = role;\n    }\n\n    public Long getId() {\n        return id;\n    }\n\n    public String getUsername() {\n        return username;\n    }\n\n    public void setUsername(String username) {\n        this.username = username;\n    }\n\n    public String getPassword() {\n        return password;\n    }\n\n    public void setPassword(String password) {\n        this.password = password;\n    }\n\n    public String getRole() {\n        return role;\n    }\n\n    public void setRole(String role) {\n        this.role = role;\n    }\n\n    public List<Todo> getTodos() {\n        return todos;\n    }\n\n    public void setTodos(List<Todo> todos) {\n        this.todos = todos;\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      6. Todo entity<\/h1>\n\n\n\n
      Replace the previous Todo.java<\/code> with:<\/p>\n\n\n\n
      package com.example.todo.model;\n\nimport jakarta.persistence.*;\nimport jakarta.validation.constraints.NotBlank;\nimport jakarta.validation.constraints.Size;\n\n@Entity\n@Table(name = \"todos\")\npublic class Todo {\n\n    @Id\n    @GeneratedValue(strategy = GenerationType.IDENTITY)\n    private Long id;\n\n    @NotBlank(message = \"Title is required\")\n    @Size(\n        min = 3,\n        max = 100,\n        message = \"Title must be between 3 and 100 characters\"\n    )\n    private String title;\n\n    private boolean completed;\n\n    @ManyToOne(fetch = FetchType.LAZY)\n    @JoinColumn(name = \"user_id\", nullable = false)\n    private User user;\n\n    public Todo() {\n    }\n\n    public Todo(String title) {\n\n        this.title = title;\n\n        this.completed = false;\n    }\n\n    public Long getId() {\n        return id;\n    }\n\n    public String getTitle() {\n        return title;\n    }\n\n    public void setTitle(String title) {\n        this.title = title;\n    }\n\n    public boolean isCompleted() {\n        return completed;\n    }\n\n    public void setCompleted(boolean completed) {\n        this.completed = completed;\n    }\n\n    public User getUser() {\n        return user;\n    }\n\n    public void setUser(User user) {\n        this.user = user;\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      7. User repository<\/h1>\n\n\n\n
      repository\/UserRepository.java<\/code><\/p>\n\n\n\n
      package com.example.todo.repository;\n\nimport java.util.Optional;\n\nimport org.springframework.data.jpa.repository.JpaRepository;\n\nimport com.example.todo.model.User;\n\npublic interface UserRepository\n        extends JpaRepository<User, Long> {\n\n    Optional<User> findByUsername(String username);\n\n    boolean existsByUsername(String username);\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      8. Todo repository<\/h1>\n\n\n\n
      repository\/TodoRepository.java<\/code><\/p>\n\n\n\n
      package com.example.todo.repository;\n\nimport java.util.List;\n\nimport org.springframework.data.jpa.repository.JpaRepository;\n\nimport com.example.todo.model.Todo;\nimport com.example.todo.model.User;\n\npublic interface TodoRepository\n        extends JpaRepository<Todo, Long> {\n\n    List<Todo> findByUser(User user);\n\n    java.util.Optional<Todo>\n    findByIdAndUser(Long id, User user);\n}<\/code><\/pre>\n\n\n\n
      This is important.<\/p>\n\n\n\n
      Instead of:<\/p>\n\n\n\n
      findAll()<\/code><\/pre>\n\n\n\n
      we use:<\/p>\n\n\n\n
      findByUser(user)<\/code><\/pre>\n\n\n\n
      Therefore one user cannot see another user’s todos.<\/p>\n\n\n\n
      \n\n\n\n
      9. User service<\/h1>\n\n\n\n
      Create:<\/p>\n\n\n\n
      service\/UserService.java<\/code><\/pre>\n\n\n\n
      package com.example.todo.service;\n\nimport org.springframework.security.crypto.password.PasswordEncoder;\nimport org.springframework.stereotype.Service;\n\nimport com.example.todo.model.User;\nimport com.example.todo.repository.UserRepository;\n\n@Service\npublic class UserService {\n\n    private final UserRepository userRepository;\n\n    private final PasswordEncoder passwordEncoder;\n\n    public UserService(\n            UserRepository userRepository,\n            PasswordEncoder passwordEncoder) {\n\n        this.userRepository = userRepository;\n\n        this.passwordEncoder = passwordEncoder;\n    }\n\n    public User registerUser(\n            String username,\n            String password) {\n\n        if (userRepository.existsByUsername(username)) {\n\n            throw new RuntimeException(\n                \"Username already exists\"\n            );\n\n        }\n\n        String encodedPassword =\n                passwordEncoder.encode(password);\n\n        User user = new User(\n            username,\n            encodedPassword,\n            \"USER\"\n        );\n\n        return userRepository.save(user);\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      10. Todo service<\/h1>\n\n\n\n
      Replace the previous service:<\/p>\n\n\n\n
      service\/TodoService.java<\/code><\/pre>\n\n\n\n
      with:<\/p>\n\n\n\n
      package com.example.todo.service;\n\nimport java.util.List;\n\nimport org.springframework.stereotype.Service;\n\nimport com.example.todo.model.Todo;\nimport com.example.todo.model.User;\nimport com.example.todo.repository.TodoRepository;\n\n@Service\npublic class TodoService {\n\n    private final TodoRepository todoRepository;\n\n    public TodoService(\n            TodoRepository todoRepository) {\n\n        this.todoRepository = todoRepository;\n    }\n\n    public List<Todo> getTodosForUser(User user) {\n\n        return todoRepository.findByUser(user);\n    }\n\n    public Todo getTodo(\n            Long id,\n            User user) {\n\n        return todoRepository\n                .findByIdAndUser(id, user)\n                .orElseThrow(() ->\n                    new RuntimeException(\n                        \"Todo not found\"\n                    )\n                );\n    }\n\n    public Todo saveTodo(\n            Todo todo,\n            User user) {\n\n        todo.setUser(user);\n\n        return todoRepository.save(todo);\n    }\n\n    public void updateTodo(\n            Long id,\n            Todo details,\n            User user) {\n\n        Todo todo = getTodo(id, user);\n\n        todo.setTitle(details.getTitle());\n\n        todo.setCompleted(\n            details.isCompleted()\n        );\n\n        todoRepository.save(todo);\n    }\n\n    public void deleteTodo(\n            Long id,\n            User user) {\n\n        Todo todo = getTodo(id, user);\n\n        todoRepository.delete(todo);\n    }\n\n    public void toggleTodo(\n            Long id,\n            User user) {\n\n        Todo todo = getTodo(id, user);\n\n        todo.setCompleted(\n            !todo.isCompleted()\n        );\n\n        todoRepository.save(todo);\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      11. Spring Security configuration<\/h1>\n\n\n\n
      This is the most important new class.<\/p>\n\n\n\n
      Create:<\/p>\n\n\n\n
      config\/SecurityConfig.java<\/code><\/pre>\n\n\n\n
      package com.example.todo.config;\n\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.security.config.annotation.web.builders.HttpSecurity;\nimport org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\nimport org.springframework.security.crypto.password.PasswordEncoder;\nimport org.springframework.security.web.SecurityFilterChain;\n\n@Configuration\npublic class SecurityConfig {\n\n    @Bean\n    public PasswordEncoder passwordEncoder() {\n\n        return new BCryptPasswordEncoder();\n    }\n\n    @Bean\n    public SecurityFilterChain securityFilterChain(\n            HttpSecurity http) throws Exception {\n\n        http\n\n            .authorizeHttpRequests(auth -> auth\n\n                .requestMatchers(\n                    \"\/login\",\n                    \"\/register\",\n                    \"\/css\/**\",\n                    \"\/js\/**\"\n                ).permitAll()\n\n                .requestMatchers(\"\/api\/**\")\n                .authenticated()\n\n                .anyRequest()\n                .authenticated()\n            )\n\n            .formLogin(form -> form\n\n                .loginPage(\"\/login\")\n\n                .defaultSuccessUrl(\n                    \"\/\",\n                    true\n                )\n\n                .permitAll()\n            )\n\n            .logout(logout -> logout\n\n                .logoutSuccessUrl(\n                    \"\/login?logout\"\n                )\n\n                .permitAll()\n            );\n\n        return http.build();\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      12. Custom UserDetailsService<\/h1>\n\n\n\n
      Spring Security needs to know how to load users from MySQL.<\/p>\n\n\n\n
      Create:<\/p>\n\n\n\n
      service\/CustomUserDetailsService.java<\/code><\/pre>\n\n\n\n
      package com.example.todo.service;\n\nimport org.springframework.security.core.userdetails.*;\nimport org.springframework.stereotype.Service;\n\nimport com.example.todo.model.User;\nimport com.example.todo.repository.UserRepository;\n\n@Service\npublic class CustomUserDetailsService\n        implements UserDetailsService {\n\n    private final UserRepository userRepository;\n\n    public CustomUserDetailsService(\n            UserRepository userRepository) {\n\n        this.userRepository = userRepository;\n    }\n\n    @Override\n    public UserDetails loadUserByUsername(\n            String username)\n            throws UsernameNotFoundException {\n\n        User user =\n            userRepository\n                .findByUsername(username)\n                .orElseThrow(() ->\n                    new UsernameNotFoundException(\n                        \"User not found\"\n                    )\n                );\n\n        return User.withUsername(\n                user.getUsername()\n            )\n            .password(user.getPassword())\n            .roles(user.getRole())\n            .build();\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      13. Authentication controller<\/h1>\n\n\n\n
      Create:<\/p>\n\n\n\n
      controller\/AuthController.java<\/code><\/pre>\n\n\n\n
      package com.example.todo.controller;\n\nimport org.springframework.stereotype.Controller;\nimport org.springframework.ui.Model;\nimport org.springframework.web.bind.annotation.*;\n\nimport com.example.todo.service.UserService;\n\n@Controller\npublic class AuthController {\n\n    private final UserService userService;\n\n    public AuthController(\n            UserService userService) {\n\n        this.userService = userService;\n    }\n\n    @GetMapping(\"\/login\")\n    public String login(\n            @RequestParam(\n                value = \"error\",\n                required = false\n            )\n            String error,\n\n            @RequestParam(\n                value = \"logout\",\n                required = false\n            )\n            String logout,\n\n            Model model) {\n\n        if (error != null) {\n\n            model.addAttribute(\n                \"error\",\n                \"Invalid username or password\"\n            );\n        }\n\n        if (logout != null) {\n\n            model.addAttribute(\n                \"message\",\n                \"You have been logged out\"\n            );\n        }\n\n        return \"login\";\n    }\n\n    @GetMapping(\"\/register\")\n    public String registerPage(\n            Model model) {\n\n        model.addAttribute(\n            \"username\",\n            \"\"\n        );\n\n        return \"register\";\n    }\n\n    @PostMapping(\"\/register\")\n    public String register(\n            @RequestParam String username,\n            @RequestParam String password,\n            Model model) {\n\n        if (username == null ||\n            username.trim().isEmpty()) {\n\n            model.addAttribute(\n                \"error\",\n                \"Username is required\"\n            );\n\n            return \"register\";\n        }\n\n        if (password == null ||\n            password.length() < 6) {\n\n            model.addAttribute(\n                \"error\",\n                \"Password must contain at least 6 characters\"\n            );\n\n            return \"register\";\n        }\n\n        try {\n\n            userService.registerUser(\n                username.trim(),\n                password\n            );\n\n            return \"redirect:\/login?registered\";\n\n        } catch (RuntimeException e) {\n\n            model.addAttribute(\n                \"error\",\n                e.getMessage()\n            );\n\n            return \"register\";\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      14. Todo web controller<\/h1>\n\n\n\n
      Replace your previous TodoController.java<\/code> with:<\/p>\n\n\n\n
      package com.example.todo.controller;\n\nimport org.springframework.security.core.Authentication;\nimport org.springframework.stereotype.Controller;\nimport org.springframework.ui.Model;\nimport org.springframework.validation.BindingResult;\nimport org.springframework.web.bind.annotation.*;\n\nimport com.example.todo.model.Todo;\nimport com.example.todo.model.User;\nimport com.example.todo.repository.UserRepository;\nimport com.example.todo.service.TodoService;\n\nimport jakarta.validation.Valid;\n\n@Controller\npublic class TodoController {\n\n    private final TodoService todoService;\n\n    private final UserRepository userRepository;\n\n    public TodoController(\n            TodoService todoService,\n            UserRepository userRepository) {\n\n        this.todoService = todoService;\n\n        this.userRepository = userRepository;\n    }\n\n    private User getCurrentUser(\n            Authentication authentication) {\n\n        return userRepository\n                .findByUsername(\n                    authentication.getName()\n                )\n                .orElseThrow();\n    }\n\n    @GetMapping(\"\/\")\n    public String home(\n            Model model,\n            Authentication authentication) {\n\n        User user =\n            getCurrentUser(authentication);\n\n        model.addAttribute(\n            \"todos\",\n            todoService.getTodosForUser(user)\n        );\n\n        model.addAttribute(\n            \"todo\",\n            new Todo()\n        );\n\n        model.addAttribute(\n            \"username\",\n            user.getUsername()\n        );\n\n        return \"index\";\n    }\n\n    @PostMapping(\"\/todos\")\n    public String addTodo(\n            @Valid @ModelAttribute(\"todo\")\n            Todo todo,\n\n            BindingResult result,\n\n            Authentication authentication,\n\n            Model model) {\n\n        User user =\n            getCurrentUser(authentication);\n\n        if (result.hasErrors()) {\n\n            model.addAttribute(\n                \"todos\",\n                todoService.getTodosForUser(user)\n            );\n\n            model.addAttribute(\n                \"username\",\n                user.getUsername()\n            );\n\n            return \"index\";\n        }\n\n        todoService.saveTodo(\n            todo,\n            user\n        );\n\n        return \"redirect:\/\";\n    }\n\n    @GetMapping(\"\/todos\/edit\/{id}\")\n    public String editTodo(\n            @PathVariable Long id,\n            Authentication authentication,\n            Model model) {\n\n        User user =\n            getCurrentUser(authentication);\n\n        Todo todo =\n            todoService.getTodo(id, user);\n\n        model.addAttribute(\n            \"todo\",\n            todo\n        );\n\n        return \"edit\";\n    }\n\n    @PostMapping(\"\/todos\/update\/{id}\")\n    public String updateTodo(\n            @PathVariable Long id,\n\n            @Valid @ModelAttribute(\"todo\")\n            Todo todo,\n\n            BindingResult result,\n\n            Authentication authentication) {\n\n        if (result.hasErrors()) {\n\n            return \"edit\";\n        }\n\n        User user =\n            getCurrentUser(authentication);\n\n        todoService.updateTodo(\n            id,\n            todo,\n            user\n        );\n\n        return \"redirect:\/\";\n    }\n\n    @GetMapping(\"\/todos\/delete\/{id}\")\n    public String deleteTodo(\n            @PathVariable Long id,\n            Authentication authentication) {\n\n        User user =\n            getCurrentUser(authentication);\n\n        todoService.deleteTodo(\n            id,\n            user\n        );\n\n        return \"redirect:\/\";\n    }\n\n    @GetMapping(\"\/todos\/toggle\/{id}\")\n    public String toggleTodo(\n            @PathVariable Long id,\n            Authentication authentication) {\n\n        User user =\n            getCurrentUser(authentication);\n\n        todoService.toggleTodo(\n            id,\n            user\n        );\n\n        return \"redirect:\/\";\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      15. REST controller<\/h1>\n\n\n\n
      Create:<\/p>\n\n\n\n
      controller\/TodoRestController.java<\/code><\/pre>\n\n\n\n
      package com.example.todo.controller;\n\nimport java.util.List;\n\nimport org.springframework.http.*;\nimport org.springframework.security.core.Authentication;\nimport org.springframework.web.bind.annotation.*;\n\nimport com.example.todo.model.Todo;\nimport com.example.todo.model.User;\nimport com.example.todo.repository.UserRepository;\nimport com.example.todo.service.TodoService;\n\n@RestController\n@RequestMapping(\"\/api\/todos\")\npublic class TodoRestController {\n\n    private final TodoService todoService;\n\n    private final UserRepository userRepository;\n\n    public TodoRestController(\n            TodoService todoService,\n            UserRepository userRepository) {\n\n        this.todoService = todoService;\n\n        this.userRepository = userRepository;\n    }\n\n    private User currentUser(\n            Authentication authentication) {\n\n        return userRepository\n                .findByUsername(\n                    authentication.getName()\n                )\n                .orElseThrow();\n    }\n\n    @GetMapping\n    public List<Todo> getTodos(\n            Authentication authentication) {\n\n        User user =\n            currentUser(authentication);\n\n        return todoService.getTodosForUser(user);\n    }\n\n    @GetMapping(\"\/{id}\")\n    public ResponseEntity<Todo> getTodo(\n            @PathVariable Long id,\n            Authentication authentication) {\n\n        try {\n\n            User user =\n                currentUser(authentication);\n\n            return ResponseEntity.ok(\n                todoService.getTodo(id, user)\n            );\n\n        } catch (RuntimeException e) {\n\n            return ResponseEntity\n                    .notFound()\n                    .build();\n        }\n    }\n\n    @PostMapping\n    public ResponseEntity<Todo> createTodo(\n            @RequestBody Todo todo,\n            Authentication authentication) {\n\n        User user =\n            currentUser(authentication);\n\n        Todo saved =\n            todoService.saveTodo(\n                todo,\n                user\n            );\n\n        return ResponseEntity\n                .status(HttpStatus.CREATED)\n                .body(saved);\n    }\n\n    @PutMapping(\"\/{id}\")\n    public ResponseEntity<Todo> updateTodo(\n            @PathVariable Long id,\n            @RequestBody Todo todo,\n            Authentication authentication) {\n\n        try {\n\n            User user =\n                currentUser(authentication);\n\n            todoService.updateTodo(\n                id,\n                todo,\n                user\n            );\n\n            return ResponseEntity.ok(\n                todoService.getTodo(id, user)\n            );\n\n        } catch (RuntimeException e) {\n\n            return ResponseEntity\n                    .notFound()\n                    .build();\n        }\n    }\n\n    @DeleteMapping(\"\/{id}\")\n    public ResponseEntity<Void> deleteTodo(\n            @PathVariable Long id,\n            Authentication authentication) {\n\n        try {\n\n            User user =\n                currentUser(authentication);\n\n            todoService.deleteTodo(\n                id,\n                user\n            );\n\n            return ResponseEntity\n                    .noContent()\n                    .build();\n\n        } catch (RuntimeException e) {\n\n            return ResponseEntity\n                    .notFound()\n                    .build();\n        }\n    }\n\n    @PatchMapping(\"\/{id}\/toggle\")\n    public ResponseEntity<Todo> toggleTodo(\n            @PathVariable Long id,\n            Authentication authentication) {\n\n        try {\n\n            User user =\n                currentUser(authentication);\n\n            todoService.toggleTodo(\n                id,\n                user\n            );\n\n            return ResponseEntity.ok(\n                todoService.getTodo(id, user)\n            );\n\n        } catch (RuntimeException e) {\n\n            return ResponseEntity\n                    .notFound()\n                    .build();\n        }\n    }\n}<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      16. Login page<\/h1>\n\n\n\n
      Create:<\/p>\n\n\n\n
      src\/main\/resources\/templates\/login.html<\/code><\/pre>\n\n\n\n
      <!DOCTYPE html>\n<html lang=\"en\">\n\n<head>\n\n    <meta charset=\"UTF-8\">\n\n    <meta name=\"viewport\"\n          content=\"width=device-width, initial-scale=1\">\n\n    <title>Login - Todo<\/title>\n\n    <link\n        href=\"https:\/\/cdn.jsdelivr.net\/npm\/bootstrap@5.3.3\/dist\/css\/bootstrap.min.css\"\n        rel=\"stylesheet\">\n\n<\/head>\n\n<body class=\"bg-light\">\n\n<div class=\"container mt-5\">\n\n    <div class=\"row justify-content-center\">\n\n        <div class=\"col-md-5\">\n\n            <div class=\"card shadow\">\n\n                <div class=\"card-header\n                            bg-primary\n                            text-white\">\n\n                    <h3 class=\"text-center\">\n                        Todo Login\n                    <\/h3>\n\n                <\/div>\n\n                <div class=\"card-body\">\n\n                    <div\n                        th:if=\"${error}\"\n                        class=\"alert alert-danger\"\n                        th:text=\"${error}\">\n                    <\/div>\n\n                    <div\n                        th:if=\"${message}\"\n                        class=\"alert alert-success\"\n                        th:text=\"${message}\">\n                    <\/div>\n\n                    <div\n                        th:if=\"${param.registered}\"\n                        class=\"alert alert-success\">\n\n                        Registration successful.\n                        Please login.\n\n                    <\/div>\n\n                    <form\n                        action=\"\/login\"\n                        method=\"post\">\n\n                        <div class=\"mb-3\">\n\n                            <label class=\"form-label\">\n                                Username\n                            <\/label>\n\n                            <input\n                                type=\"text\"\n                                name=\"username\"\n                                class=\"form-control\"\n                                required>\n\n                        <\/div>\n\n                        <div class=\"mb-3\">\n\n                            <label class=\"form-label\">\n                                Password\n                            <\/label>\n\n                            <input\n                                type=\"password\"\n                                name=\"password\"\n                                class=\"form-control\"\n                                required>\n\n                        <\/div>\n\n                        <button\n                            type=\"submit\"\n                            class=\"btn btn-primary w-100\">\n\n                            Login\n\n                        <\/button>\n\n                    <\/form>\n\n                    <hr>\n\n                    <div class=\"text-center\">\n\n                        <span>\n                            Don't have an account?\n                        <\/span>\n\n                        <a href=\"\/register\">\n                            Register\n                        <\/a>\n\n                    <\/div>\n\n                <\/div>\n\n            <\/div>\n\n        <\/div>\n\n    <\/div>\n\n<\/div>\n\n<\/body>\n\n<\/html><\/code><\/pre>\n\n\n\n
      \n\n\n\n
      17. Registration page<\/h1>\n\n\n\n
      Create:<\/p>\n\n\n\n
      src\/main\/resources\/templates\/register.html<\/code><\/pre>\n\n\n\n
      <!DOCTYPE html>\n<html lang=\"en\">\n\n<head>\n\n    <meta charset=\"UTF-8\">\n\n    <meta name=\"viewport\"\n          content=\"width=device-width, initial-scale=1\">\n\n    <title>Register - Todo<\/title>\n\n    <link\n        href=\"https:\/\/cdn.jsdelivr.net\/npm\/bootstrap@5.3.3\/dist\/css\/bootstrap.min.css\"\n        rel=\"stylesheet\">\n\n<\/head>\n\n<body class=\"bg-light\">\n\n<div class=\"container mt-5\">\n\n    <div class=\"row justify-content-center\">\n\n        <div class=\"col-md-5\">\n\n            <div class=\"card shadow\">\n\n                <div class=\"card-header\n                            bg-success\n                            text-white\">\n\n                    <h3 class=\"text-center\">\n                        Create Account\n                    <\/h3>\n\n                <\/div>\n\n                <div class=\"card-body\">\n\n                    <div\n                        th:if=\"${error}\"\n                        class=\"alert alert-danger\"\n                        th:text=\"${error}\">\n                    <\/div>\n\n                    <form\n                        action=\"\/register\"\n                        method=\"post\">\n\n                        <div class=\"mb-3\">\n\n                            <label class=\"form-label\">\n                                Username\n                            <\/label>\n\n                            <input\n                                type=\"text\"\n                                name=\"username\"\n                                class=\"form-control\"\n                                minlength=\"3\"\n                                required>\n\n                        <\/div>\n\n                        <div class=\"mb-3\">\n\n                            <label class=\"form-label\">\n                                Password\n                            <\/label>\n\n                            <input\n                                type=\"password\"\n                                name=\"password\"\n                                class=\"form-control\"\n                                minlength=\"6\"\n                                required>\n\n                            <small class=\"text-muted\">\n                                Minimum 6 characters\n                            <\/small>\n\n                        <\/div>\n\n                        <button\n                            type=\"submit\"\n                            class=\"btn btn-success w-100\">\n\n                            Register\n\n                        <\/button>\n\n                    <\/form>\n\n                    <hr>\n\n                    <div class=\"text-center\">\n\n                        Already have an account?\n\n                        <a href=\"\/login\">\n                            Login\n                        <\/a>\n\n                    <\/div>\n\n                <\/div>\n\n            <\/div>\n\n        <\/div>\n\n    <\/div>\n\n<\/div>\n\n<\/body>\n\n<\/html><\/code><\/pre>\n\n\n\n
      \n\n\n\n
      18. Todo home page<\/h1>\n\n\n\n
      Create\/replace:<\/p>\n\n\n\n
      src\/main\/resources\/templates\/index.html<\/code><\/pre>\n\n\n\n
      <!DOCTYPE html>\n<html lang=\"en\"\n      xmlns:th=\"http:\/\/www.thymeleaf.org\">\n\n<head>\n\n    <meta charset=\"UTF-8\">\n\n    <meta name=\"viewport\"\n          content=\"width=device-width, initial-scale=1\">\n\n    <title>My Todos<\/title>\n\n    <link\n        href=\"https:\/\/cdn.jsdelivr.net\/npm\/bootstrap@5.3.3\/dist\/css\/bootstrap.min.css\"\n        rel=\"stylesheet\">\n\n<\/head>\n\n<body class=\"bg-light\">\n\n<nav class=\"navbar navbar-dark bg-primary\">\n\n    <div class=\"container\">\n\n        <span class=\"navbar-brand\">\n            Todo Application\n        <\/span>\n\n        <div class=\"d-flex align-items-center\">\n\n            <span class=\"text-white me-3\">\n\n                Welcome,\n                <strong th:text=\"${username}\">\n                    user\n                <\/strong>\n\n            <\/span>\n\n            <form\n                action=\"\/logout\"\n                method=\"post\">\n\n                <button\n                    type=\"submit\"\n                    class=\"btn btn-light btn-sm\">\n\n                    Logout\n\n                <\/button>\n\n            <\/form>\n\n        <\/div>\n\n    <\/div>\n\n<\/nav>\n\n\n<div class=\"container mt-5\">\n\n    <div class=\"row justify-content-center\">\n\n        <div class=\"col-md-10\">\n\n            <div class=\"card shadow\">\n\n                <div class=\"card-header\">\n\n                    <h3 class=\"mb-0\">\n                        My Todo List\n                    <\/h3>\n\n                <\/div>\n\n                <div class=\"card-body\">\n\n\n                    <!-- ADD TODO -->\n\n                    <form\n                        th:action=\"@{\/todos}\"\n                        th:object=\"${todo}\"\n                        method=\"post\"\n                        class=\"mb-4\">\n\n                        <div class=\"input-group\">\n\n                            <input\n                                type=\"text\"\n                                th:field=\"*{title}\"\n                                class=\"form-control\"\n                                placeholder=\"Enter a new todo\">\n\n                            <button\n                                type=\"submit\"\n                                class=\"btn btn-primary\">\n\n                                Add Todo\n\n                            <\/button>\n\n                        <\/div>\n\n                        <div\n                            th:if=\"${#fields.hasErrors('title')}\"\n                            th:errors=\"*{title}\"\n                            class=\"text-danger mt-2\">\n\n                        <\/div>\n\n                    <\/form>\n\n\n                    <!-- TODO TABLE -->\n\n                    <table class=\"table table-hover\">\n\n                        <thead class=\"table-dark\">\n\n                        <tr>\n\n                            <th>ID<\/th>\n\n                            <th>Todo<\/th>\n\n                            <th>Status<\/th>\n\n                            <th>Actions<\/th>\n\n                        <\/tr>\n\n                        <\/thead>\n\n                        <tbody>\n\n                        <tr th:each=\"todo : ${todos}\">\n\n                            <td th:text=\"${todo.id}\">\n                                1\n                            <\/td>\n\n                            <td>\n\n                                <span\n                                    th:text=\"${todo.title}\"\n                                    th:classappend=\"${todo.completed}\n                                    ? 'text-decoration-line-through text-muted'\n                                    : ''\">\n\n                                    Todo\n\n                                <\/span>\n\n                            <\/td>\n\n                            <td>\n\n                                <span\n                                    th:if=\"${todo.completed}\"\n                                    class=\"badge bg-success\">\n\n                                    Completed\n\n                                <\/span>\n\n                                <span\n                                    th:unless=\"${todo.completed}\"\n                                    class=\"badge bg-warning text-dark\">\n\n                                    Pending\n\n                                <\/span>\n\n                            <\/td>\n\n                            <td>\n\n                                <a\n                                    th:href=\"@{\/todos\/toggle\/{id}(id=${todo.id})}\"\n                                    class=\"btn btn-sm btn-success\">\n\n                                    Toggle\n\n                                <\/a>\n\n                                <a\n                                    th:href=\"@{\/todos\/edit\/{id}(id=${todo.id})}\"\n                                    class=\"btn btn-sm btn-primary\">\n\n                                    Edit\n\n                                <\/a>\n\n                                <a\n                                    th:href=\"@{\/todos\/delete\/{id}(id=${todo.id})}\"\n                                    class=\"btn btn-sm btn-danger\"\n                                    onclick=\"return confirm('Delete this todo?');\">\n\n                                    Delete\n\n                                <\/a>\n\n                            <\/td>\n\n                        <\/tr>\n\n\n                        <tr\n                            th:if=\"${#lists.isEmpty(todos)}\">\n\n                            <td\n                                colspan=\"4\"\n                                class=\"text-center text-muted\">\n\n                                You don't have any todos yet.\n\n                            <\/td>\n\n                        <\/tr>\n\n                        <\/tbody>\n\n                    <\/table>\n\n                <\/div>\n\n            <\/div>\n\n        <\/div>\n\n    <\/div>\n\n<\/div>\n\n<\/body>\n\n<\/html><\/code><\/pre>\n\n\n\n
      \n\n\n\n
      19. Edit page<\/h1>\n\n\n\n
      Create:<\/p>\n\n\n\n
      src\/main\/resources\/templates\/edit.html<\/code><\/pre>\n\n\n\n
      <!DOCTYPE html>\n<html lang=\"en\"\n      xmlns:th=\"http:\/\/www.thymeleaf.org\">\n\n<head>\n\n    <meta charset=\"UTF-8\">\n\n    <meta name=\"viewport\"\n          content=\"width=device-width, initial-scale=1\">\n\n    <title>Edit Todo<\/title>\n\n    <link\n        href=\"https:\/\/cdn.jsdelivr.net\/npm\/bootstrap@5.3.3\/dist\/css\/bootstrap.min.css\"\n        rel=\"stylesheet\">\n\n<\/head>\n\n<body class=\"bg-light\">\n\n<div class=\"container mt-5\">\n\n    <div class=\"row justify-content-center\">\n\n        <div class=\"col-md-6\">\n\n            <div class=\"card shadow\">\n\n                <div class=\"card-header bg-primary text-white\">\n\n                    <h3 class=\"mb-0\">\n                        Edit Todo\n                    <\/h3>\n\n                <\/div>\n\n                <div class=\"card-body\">\n\n                    <form\n                        th:action=\"@{\/todos\/update\/{id}(id=${todo.id})}\"\n                        th:object=\"${todo}\"\n                        method=\"post\">\n\n                        <div class=\"mb-3\">\n\n                            <label class=\"form-label\">\n                                Todo\n                            <\/label>\n\n                            <input\n                                type=\"text\"\n                                th:field=\"*{title}\"\n                                class=\"form-control\">\n\n                            <div\n                                th:if=\"${#fields.hasErrors('title')}\"\n                                th:errors=\"*{title}\"\n                                class=\"text-danger\">\n\n                            <\/div>\n\n                        <\/div>\n\n                        <div class=\"form-check mb-3\">\n\n                            <input\n                                type=\"checkbox\"\n                                th:field=\"*{completed}\"\n                                class=\"form-check-input\">\n\n                            <label class=\"form-check-label\">\n                                Completed\n                            <\/label>\n\n                        <\/div>\n\n                        <button\n                            type=\"submit\"\n                            class=\"btn btn-primary\">\n\n                            Update\n\n                        <\/button>\n\n                        <a\n                            href=\"\/\"\n                            class=\"btn btn-secondary\">\n\n                            Cancel\n\n                        <\/a>\n\n                    <\/form>\n\n                <\/div>\n\n            <\/div>\n\n        <\/div>\n\n    <\/div>\n\n<\/div>\n\n<\/body>\n\n<\/html><\/code><\/pre>\n\n\n\n
      \n\n\n\n
      20. application.properties<\/code><\/h1>\n\n\n\n
      Use:<\/p>\n\n\n\n
      spring.application.name=todo\n\n# ==========================================\n# MySQL\n# ==========================================\n\nspring.datasource.url=jdbc:mysql:\/\/localhost:3306\/todo_db\n\nspring.datasource.username=todo_user\n\nspring.datasource.password=todo_password\n\n\n# ==========================================\n# JPA \/ Hibernate\n# ==========================================\n\nspring.jpa.hibernate.ddl-auto=update\n\nspring.jpa.show-sql=true\n\nspring.jpa.properties.hibernate.format_sql=true\n\n\n# ==========================================\n# Thymeleaf\n# ==========================================\n\nspring.thymeleaf.cache=false\n\n\n# ==========================================\n# Server\n# ==========================================\n\nserver.port=8080<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      21. Update Maven project in Eclipse<\/h1>\n\n\n\n
      After changing pom.xml<\/code>:<\/p>\n\n\n\n
      Right click project\n       \u2193\nMaven\n       \u2193\nUpdate Project\n       \u2193\nCheck your project\n       \u2193\nOK<\/code><\/pre>\n\n\n\n
      Or from terminal:<\/p>\n\n\n\n
      .\/mvnw clean install<\/code><\/pre>\n\n\n\n
      Then:<\/p>\n\n\n\n
      .\/mvnw spring-boot:run<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      22. Start the application<\/h1>\n\n\n\n
      Make sure MySQL is running:<\/p>\n\n\n\n
      sudo systemctl status mysql<\/code><\/pre>\n\n\n\n
      Then:<\/p>\n\n\n\n
      .\/mvnw spring-boot:run<\/code><\/pre>\n\n\n\n
      Open:<\/p>\n\n\n\n
      http://localhost:8080<\/code><\/pre>\n\n\n\n
      Because the application is secured, you’ll be redirected to:<\/p>\n\n\n\n
      \/login<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      23. Register a user<\/h1>\n\n\n\n
      Open:<\/p>\n\n\n\n
      http://localhost:8080\/register<\/code><\/pre>\n\n\n\n
      Create:<\/p>\n\n\n\n
      Username: devesh\nPassword: password123<\/code><\/pre>\n\n\n\n
      Click Register<\/strong>.<\/p>\n\n\n\n
      You’ll be redirected to login.<\/p>\n\n\n\n
      \n\n\n\n
      24. Login<\/h1>\n\n\n\n
      Enter:<\/p>\n\n\n\n
      Username: devesh\nPassword: password123<\/code><\/pre>\n\n\n\n
      After successful authentication:<\/p>\n\n\n\n
      \/login\n   \u2193\nSpring Security\n   \u2193\n\/\n   \u2193\nTodo Application<\/code><\/pre>\n\n\n\n
      You should see:<\/p>\n\n\n\n
      +------------------------------------------------+\n| Todo Application              Welcome, devesh |\n|                                  [ Logout ]    |\n+------------------------------------------------+\n| My Todo List                                   |\n|                                                |\n| [ Learn Spring Boot             ] [Add Todo]   |\n|                                                |\n| ID | Todo              | Status | Actions      |\n|----|-------------------|--------|--------------|\n| 1  | Learn Java        | Pending| Toggle Edit  |\n| 2  | Learn Spring Boot | Done   | Toggle Edit  |\n+------------------------------------------------+<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      25. Test multi-user security<\/h1>\n\n\n\n
      This is an important part of the project.<\/p>\n\n\n\n
      Create:<\/p>\n\n\n\n
      User 1:\nusername = devesh\npassword = password123<\/code><\/pre>\n\n\n\n
      Add:<\/p>\n\n\n\n
      Learn Java\nLearn Spring Boot\nLearn MySQL<\/code><\/pre>\n\n\n\n
      Logout.<\/p>\n\n\n\n
      Register:<\/p>\n\n\n\n
      User 2:\nusername = rahul\npassword = password123<\/code><\/pre>\n\n\n\n
      Login as rahul<\/code>.<\/p>\n\n\n\n
      You should see:<\/p>\n\n\n\n
      My Todo List\n\nNo todos yet.<\/code><\/pre>\n\n\n\n
      Rahul cannot see Devesh’s todos<\/strong>.<\/p>\n\n\n\n
      The reason is this repository method:<\/p>\n\n\n\n
      findByIdAndUser(id, user)<\/code><\/pre>\n\n\n\n
      and:<\/p>\n\n\n\n
      findByUser(user)<\/code><\/pre>\n\n\n\n
      This is much safer than simply doing:<\/p>\n\n\n\n
      findAll()<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      26. What happens to the password?<\/h1>\n\n\n\n
      Suppose the user registers:<\/p>\n\n\n\n
      password123<\/code><\/pre>\n\n\n\n
      We do:<\/p>\n\n\n\n
      passwordEncoder.encode(password);<\/code><\/pre>\n\n\n\n
      The database does not<\/strong> store:<\/p>\n\n\n\n
      password123<\/code><\/pre>\n\n\n\n
      Instead, it stores a BCrypt hash similar to:<\/p>\n\n\n\n
      $2a$10$...<\/code><\/pre>\n\n\n\n
      You can inspect it:<\/p>\n\n\n\n
      USE todo_db;\n\nSELECT id, username, password, role\nFROM users;<\/code><\/pre>\n\n\n\n
      You’ll see something like:<\/p>\n\n\n\n
      +----+----------+----------------------+------+\n| id | username | password             | role |\n+----+----------+----------------------+------+\n|  1 | devesh   | $2a$10$.............. | USER |\n+----+----------+----------------------+------+<\/code><\/pre>\n\n\n\n
      Never store real passwords directly in your database.<\/p>\n\n\n\n
      \n\n\n\n
      27. Database relationship<\/h1>\n\n\n\n
      Hibernate creates approximately:<\/p>\n\n\n\n
      users\n--------------------------------\nid          BIGINT PRIMARY KEY\nusername    VARCHAR\npassword    VARCHAR\nrole        VARCHAR<\/code><\/pre>\n\n\n\n
      and:<\/p>\n\n\n\n
      todos\n--------------------------------\nid          BIGINT PRIMARY KEY\ntitle       VARCHAR\ncompleted   BOOLEAN\nuser_id     BIGINT<\/code><\/pre>\n\n\n\n
      Relationship:<\/p>\n\n\n\n
              users\n          |\n          | 1\n          |\n          | *\n          v\n        todos<\/code><\/pre>\n\n\n\n
      In Java:<\/p>\n\n\n\n
      @OneToMany\nprivate List<Todo> todos;<\/code><\/pre>\n\n\n\n
      and:<\/p>\n\n\n\n
      @ManyToOne\nprivate User user;<\/code><\/pre>\n\n\n\n
      \n\n\n\n
      28. REST API<\/h1>\n\n\n\n
      The REST API is also protected.<\/p>\n\n\n\n
      GET     \/api\/todos\nGET     \/api\/todos\/1\nPOST    \/api\/todos\nPUT     \/api\/todos\/1\nPATCH   \/api\/todos\/1\/toggle\nDELETE  \/api\/todos\/1<\/code><\/pre>\n\n\n\n
      You need to be authenticated to access these endpoints.<\/p>\n\n\n\n
      For example:<\/p>\n\n\n\n
      curl http:\/\/localhost:8080\/api\/todos<\/code><\/pre>\n\n\n\n
      Without authentication, Spring Security will reject the request.<\/p>\n\n\n\n
      \n\n\n\n
      29. Test the API after login<\/h1>\n\n\n\n
      For a browser-based form login, testing the REST API with curl<\/code> is slightly different because the authentication is session-based.<\/p>\n\n\n\n
      For development, you can use Postman:<\/p>\n\n\n\n
      POST \/login<\/code><\/pre>\n\n\n\n
      with:<\/p>\n\n\n\n
      username=devesh\npassword=password123<\/code><\/pre>\n\n\n\n
      Then retain the session cookie and call:<\/p>\n\n\n\n
      GET \/api\/todos<\/code><\/pre>\n\n\n\n
      For a production REST application, I would normally change this architecture to JWT authentication<\/strong> rather than using the browser session.<\/p>\n\n\n\n
      \n\n\n\n
      30. Important Spring Security flow<\/h1>\n\n\n\n
      The login flow is:<\/p>\n\n\n\n
                          Browser\n                       |\n                       | POST \/login\n                       v\n              Spring Security\n                       |\n                       v\n        CustomUserDetailsService\n                       |\n                       v\n                UserRepository\n                       |\n                       v\n                    MySQL\n                       |\n                       v\n             PasswordEncoder\n                       |\n                       v\n                 BCrypt check\n                       |\n              \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n              |                 |\n           SUCCESS            FAILURE\n              |                 |\n              v                 v\n             \"\/\"             \/login?error<\/code><\/pre>\n\n\n\n
      The important code is:<\/p>\n\n\n\n
      @Service\npublic class CustomUserDetailsService\n        implements UserDetailsService<\/code><\/pre>\n\n\n\n
      Spring Security calls:<\/p>\n\n\n\n
      loadUserByUsername()<\/code><\/pre>\n\n\n\n
      which loads the user from MySQL.<\/p>\n\n\n\n
      Then BCrypt verifies the password.<\/p>\n\n\n\n
      \n\n\n\n
      31. Important security rule<\/h1>\n\n\n\n
      Do not<\/strong> do this:<\/p>\n\n\n\n
      user.setPassword(password);<\/code><\/pre>\n\n\n\n
      Instead:<\/p>\n\n\n\n
      user.setPassword(\n    passwordEncoder.encode(password)\n);<\/code><\/pre>\n\n\n\n
      And don’t create a database column containing plain-text passwords.<\/p>\n\n\n\n
      \n\n\n\n
      32. Run and verify<\/h1>\n\n\n\n
      Use these commands:<\/p>\n\n\n\n
      sudo systemctl start mysql<\/code><\/pre>\n\n\n\n
      cd ~\/todo<\/code><\/pre>\n\n\n\n
      .\/mvnw clean<\/code><\/pre>\n\n\n\n
      .\/mvnw spring-boot:run<\/code><\/pre>\n\n\n\n
      Then:<\/p>\n\n\n\n
      http://localhost:8080\/register<\/code><\/pre>\n\n\n\n
      Test this sequence:<\/p>\n\n\n\n
      Register\n   \u2193\nLogin\n   \u2193\nAdd Todo\n   \u2193\nEdit Todo\n   \u2193\nToggle Todo\n   \u2193\nDelete Todo\n   \u2193\nLogout<\/code><\/pre>\n\n\n\n
      Then create a second account and verify that the first user’s todos aren’t visible.<\/p>\n\n\n\n
      \n\n\n\n
      Final architecture<\/h2>\n\n\n\n
      Your application now looks like:<\/p>\n\n\n\n
                           \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                     \u2502    Browser    \u2502\n                     \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                             \u2502\n                             \u25bc\n                  \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                  \u2502   Spring Security  \u2502\n                  \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                            \u2502\n                 \u250c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2510\n                 \u2502                     \u2502\n                 \u25bc                     \u25bc\n             Login\/Auth            TodoController\n                 \u2502                     \u2502\n                 \u25bc                     \u25bc\n             UserService          TodoService\n                 \u2502                     \u2502\n                 \u25bc                     \u25bc\n           UserRepository       TodoRepository\n                 \u2502                     \u2502\n                 \u2514\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2518\n                            \u2502\n                            \u25bc\n                         MySQL<\/code><\/pre>\n\n\n\n
      This is now a solid Spring Boot MVC + Security + JPA + MySQL CRUD application<\/strong>. The natural next production-level extension is role-based authorization (USER<\/code>\/ADMIN<\/code>), admin user management, BCrypt password validation, CSRF-safe delete forms, and JWT-based REST authentication<\/strong>.<\/p>\n\n\n\n
      <\/p>\n","protected":false},"excerpt":{"rendered":"
      Yes. The next extension should add user registration + login\/logout + Spring Security + per-user Todo lists. The architecture becomes: I recommend using Spring Security 6 \/ Spring Boot 3.x, with passwords stored using BCrypt, never as plain text. I…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-29","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t