Giri\u015f Sayfas\u0131<\/title>\n<\/head>\n<body>\n <h2>Giri\u015f Yap<\/h2>\n <div th:if=\"${param.error}\" style=\"color:red;\">\n Hatal\u0131 kullan\u0131c\u0131 ad\u0131 veya \u015fifre.\n <\/div>\n <div th:if=\"${param.logout}\" style=\"color:green;\">\n Ba\u015far\u0131yla \u00e7\u0131k\u0131\u015f yapt\u0131n\u0131z.\n <\/div>\n <form th:action=\"@{\/login}\" method=\"post\">\n <div>\n <label for=\"username\">Kullan\u0131c\u0131 Ad\u0131:<\/label>\n <input type=\"text\" id=\"username\" name=\"username\"\/>\n <\/div>\n <div>\n <label for=\"password\">\u015eifre:<\/label>\n <input type=\"password\" id=\"password\" name=\"password\"\/>\n <\/div>\n <div>\n <input type=\"submit\" value=\"Giri\u015f Yap\"\/>\n <\/div>\n <\/form>\n <br\/>\n <a th:href=\"@{\/public}\">Herkese A\u00e7\u0131k Sayfa<\/a>\n<\/body>\n<\/html><\/code><\/pre>\n<p><strong><code>src\/main\/resources\/templates\/dashboard.html<\/code><\/strong><\/p>\n<pre><code class=\"language-html\"><!DOCTYPE html>\n<html xmlns:th=\"http:\/\/www.thymeleaf.org\"\n xmlns:sec=\"http:\/\/www.thymeleaf.org\/extras\/spring-security\">\n<head>\n <title>Dashboard<\/title>\n<\/head>\n<body>\n <h2>Ho\u015f Geldiniz, <span sec:authentication=\"name\"><\/span>!<\/h2>\n\n <p>Bu, giri\u015f yapm\u0131\u015f kullan\u0131c\u0131lar i\u00e7in bir dashboard sayfas\u0131d\u0131r.<\/p>\n\n <h3>Eri\u015filebilir Sayfalar:<\/h3>\n <ul>\n <li><a th:href=\"@{\/public}\">Herkese A\u00e7\u0131k Sayfa<\/a><\/li>\n <li sec:authorize=\"hasRole('USER')\"><a th:href=\"@{\/user\/dashboard}\">Kullan\u0131c\u0131 Paneli<\/a><\/li>\n <li sec:authorize=\"hasRole('ADMIN')\"><a th:href=\"@{\/admin\/settings}\">Y\u00f6netici Ayarlar\u0131<\/a><\/li>\n <li sec:authorize=\"hasAnyRole('ADMIN', 'EDITOR')\"><a th:href=\"@{\/editor\/article}\">Edit\u00f6r Makale Sayfas\u0131<\/a><\/li>\n <\/ul>\n\n <form th:action=\"@{\/logout}\" method=\"post\">\n <input type=\"submit\" value=\"\u00c7\u0131k\u0131\u015f Yap\"\/>\n <\/form>\n<\/body>\n<\/html><\/code><\/pre>\n<p><strong><code>src\/main\/resources\/templates\/access-denied.html<\/code><\/strong><\/p>\n<pre><code class=\"language-html\"><!DOCTYPE html>\n<html xmlns:th=\"http:\/\/www.thymeleaf.org\">\n<head>\n <title>Eri\u015fim Reddedildi<\/title>\n<\/head>\n<body>\n <h2>Eri\u015fim Reddedildi!<\/h2>\n <p>Bu kayna\u011fa eri\u015fim yetkiniz bulunmamaktad\u0131r.<\/p>\n <a th:href=\"@{\/dashboard}\">Ana Sayfaya D\u00f6n<\/a>\n<\/body>\n<\/html><\/code><\/pre>\n<p>Ve bu Thymeleaf \u015fablonlar\u0131n\u0131 g\u00f6stermek i\u00e7in basit bir <code>ViewController<\/code>:<\/p>\n<pre><code class=\"language-java\">\/\/ src\/main\/java\/com\/example\/securitydemo\/controller\/ViewController.java\n\npackage com.example.securitydemo.controller;\n\nimport org.springframework.stereotype.Controller;\nimport org.springframework.web.bind.annotation.GetMapping;\n\n@Controller\npublic class ViewController {\n\n @GetMapping(\"\/login\")\n public String login() {\n return \"login\";\n }\n\n @GetMapping(\"\/dashboard\")\n public String dashboard() {\n return \"dashboard\";\n }\n\n @GetMapping(\"\/access-denied\")\n public String accessDenied() {\n return \"access-denied\";\n }\n}<\/code><\/pre>\n<h4>Test Etme<\/h4>\n<p>Uygulamay\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n (<code>SpringSecurityDemoApplication.java<\/code>).<\/p>\n<p>1. <strong><code>http:\/\/localhost:8080\/<\/code> veya <code>http:\/\/localhost:8080\/public<\/code><\/strong>: Herkese a\u00e7\u0131k oldu\u011fu i\u00e7in giri\u015f yapmadan eri\u015febilirsiniz.<br \/>\n2. <strong><code>http:\/\/localhost:8080\/user\/dashboard<\/code><\/strong>: Giri\u015f yapman\u0131z istenecektir.<br \/>\n * <code>user\/password<\/code> ile giri\u015f yap\u0131n. Ba\u015far\u0131l\u0131 bir \u015fekilde eri\u015feceksiniz.<br \/>\n * <code>admin\/adminpass<\/code> ile giri\u015f yap\u0131n. <code>admin<\/code> kullan\u0131c\u0131s\u0131 <code>ROLE_USER<\/code> rol\u00fcne de sahip oldu\u011fu i\u00e7in eri\u015febilir.<br \/>\n3. <strong><code>http:\/\/localhost:8080\/admin\/settings<\/code><\/strong>: Giri\u015f yapman\u0131z istenecektir.<br \/>\n * <code>user\/password<\/code> ile giri\u015f yapmaya \u00e7al\u0131\u015f\u0131n. Eri\u015fim reddedilecektir (<code>\/access-denied<\/code> sayfas\u0131na y\u00f6nlendirilir).<br \/>\n * <code>admin\/adminpass<\/code> ile giri\u015f yap\u0131n. Ba\u015far\u0131l\u0131 bir \u015fekilde eri\u015feceksiniz.<br \/>\n4. <strong><code>http:\/\/localhost:8080\/admin\/users\/user<\/code><\/strong>:<br \/>\n * <code>user\/password<\/code> ile giri\u015f yap\u0131n. <code>authentication.name == #username<\/code> kural\u0131 sayesinde kendi kullan\u0131c\u0131 ad\u0131n\u0131zla eri\u015febilirsiniz.<br \/>\n * <code>admin\/adminpass<\/code> ile giri\u015f yap\u0131n. <code>hasRole('ADMIN')<\/code> kural\u0131 sayesinde eri\u015febilirsiniz.<br \/>\n * <code>user\/password<\/code> ile giri\u015f yap\u0131p <code>http:\/\/localhost:8080\/admin\/users\/admin<\/code> adresine gitmeye \u00e7al\u0131\u015f\u0131n. Eri\u015fim reddedilecektir, \u00e7\u00fcnk\u00fc <code>user<\/code> kullan\u0131c\u0131s\u0131 <code>admin<\/code> kullan\u0131c\u0131s\u0131n\u0131n detaylar\u0131na eri\u015femez.<\/p>\n<p>Bu testler, hem URL bazl\u0131 hem de metot bazl\u0131 rol tabanl\u0131 yetkilendirme kurallar\u0131n\u0131n ba\u015far\u0131yla uyguland\u0131\u011f\u0131n\u0131 g\u00f6stermektedir.<\/p>\n<h3>\u0130leri Seviye Konular ve En \u0130yi Uygulamalar<\/h3>\n<p>Uygulamalar b\u00fcy\u00fcd\u00fck\u00e7e ve karma\u015f\u0131kla\u015ft\u0131k\u00e7a, Spring Security ile yetkilendirme konusunda dikkate al\u0131nmas\u0131 gereken baz\u0131 ileri seviye konular ve en iyi uygulamalar vard\u0131r.<\/p>\n<h4>Veritaban\u0131 Tabanl\u0131 Kullan\u0131c\u0131 ve Rol Y\u00f6netimi<\/h4>\n<p>Ger\u00e7ek d\u00fcnya uygulamalar\u0131nda, kullan\u0131c\u0131lar ve rolleri genellikle bir veritaban\u0131nda saklan\u0131r. Bu durumda, <code>UserDetailsService<\/code> aray\u00fcz\u00fcn\u00fc implemente eden \u00f6zel bir s\u0131n\u0131f yazman\u0131z ve bu s\u0131n\u0131f i\u00e7inde veritaban\u0131ndan kullan\u0131c\u0131 bilgilerini (kullan\u0131c\u0131 ad\u0131, \u015fifre, rolleri\/yetkileri) \u00e7ekmeniz gerekir.<\/p>\n<pre><code class=\"language-java\">\/\/ \u00d6rnek: \u00d6zel UserDetailsService implementasyonu\n@Service\npublic class CustomUserDetailsService implements UserDetailsService {\n\n @Autowired\n private UserRepository userRepository; \/\/ Kendi kullan\u0131c\u0131 repository'niz\n\n @Override\n public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n com.example.securitydemo.model.User user = userRepository.findByUsername(username)\n .orElseThrow(() -> new UsernameNotFoundException(\"Kullan\u0131c\u0131 bulunamad\u0131: \" + username));\n\n \/\/ Kullan\u0131c\u0131n\u0131n rollerini GrantedAuthority nesnelerine d\u00f6n\u00fc\u015ft\u00fcr\u00fcn\n List<GrantedAuthority> authorities = user.getRoles().stream()\n .map(role -> new SimpleGrantedAuthority(role.getName())) \/\/ Role nesnenizin getName() metodu ROLE_ADMIN gibi bir string d\u00f6nmeli\n .collect(Collectors.toList());\n\n return new org.springframework.security.core.userdetails.User(\n user.getUsername(),\n user.getPassword(),\n authorities\n );\n }\n}<\/code><\/pre>\n<p>Bu \u00f6rnekte, <code>UserRepository<\/code> sizin veritaban\u0131 eri\u015fim katman\u0131n\u0131z\u0131 temsil eder ve <code>com.example.securitydemo.model.User<\/code> sizin \u00f6zel kullan\u0131c\u0131 entity’nizdir.<\/p>\n<h4>\u00d6zel Yetkilendirme Kararlar\u0131 (Custom Access Decisions)<\/h4>\n<p>Bazen <code>hasRole()<\/code>, <code>hasAuthority()<\/code> gibi haz\u0131r SpEL ifadeleri yetersiz kalabilir. Daha karma\u015f\u0131k i\u015f mant\u0131\u011f\u0131na dayal\u0131 yetkilendirme kararlar\u0131 i\u00e7in \u00f6zel bir <code>PermissionEvaluator<\/code> implementasyonu yazabilirsiniz. Bu, <code>@PreAuthorize(\"hasPermission(#object, 'read')\")<\/code> gibi ifadeler kullanman\u0131za olanak tan\u0131r.<\/p>\n<h4>CSRF, CORS, XSS Korumalar\u0131<\/h4>\n<p>Spring Security, varsay\u0131lan olarak bir\u00e7ok yayg\u0131n web g\u00fcvenlik a\u00e7\u0131\u011f\u0131na kar\u015f\u0131 koruma sa\u011flar:<br \/>\n* <strong>CSRF (Cross-Site Request Forgery)<\/strong>: Form tabanl\u0131 veya AJAX istekleri i\u00e7in otomatik olarak CSRF tokenleri ekler ve do\u011frular.<br \/>\n* <strong>CORS (Cross-Origin Resource Sharing)<\/strong>: Farkl\u0131 kaynaklardan gelen isteklere izin verme veya engelleme mekanizmas\u0131 sunar.<br \/>\n* <strong>XSS (Cross-Site Scripting)<\/strong>: Thymeleaf gibi \u015fablon motorlar\u0131 ve Spring’in HTTP response header’lar\u0131 sayesinde XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flan\u0131r.<\/p>\n<p>Bu korumalar\u0131n \u00e7o\u011fu varsay\u0131lan olarak etkindir ve genellikle ek bir konfig\u00fcrasyon gerektirmez. Ancak \u00f6zel durumlarda \u00f6zelle\u015ftirilebilirler.<\/p>\n<h4>Hata Y\u00f6netimi ve Eri\u015fim Reddi Sayfalar\u0131<\/h4>\n<p>Eri\u015fim reddedildi\u011finde kullan\u0131c\u0131ya dost\u00e7a bir mesaj g\u00f6stermek \u00f6nemlidir. <code>SecurityConfig<\/code> i\u00e7inde <code>exceptionHandling().accessDeniedPage(\"\/access-denied\")<\/code> ile \u00f6zel bir eri\u015fim reddi sayfas\u0131 belirleyebilirsiniz. Ayr\u0131ca, REST API’leri i\u00e7in <code>AccessDeniedHandler<\/code> ve <code>AuthenticationEntryPoint<\/code> implementasyonlar\u0131 ile \u00f6zel hata yan\u0131tlar\u0131 d\u00f6nd\u00fcrebilirsiniz.<\/p>\n<h4>Performans ve \u00d6l\u00e7eklenebilirlik<\/h4>\n<p>B\u00fcy\u00fck \u00f6l\u00e7ekli uygulamalarda, her istekte yetkilendirme kontrollerinin yap\u0131lmas\u0131 performans \u00fczerinde bir etkiye sahip olabilir. Performans\u0131 art\u0131rmak i\u00e7in:<br \/>\n* <strong>Caching<\/strong>: <code>UserDetailsService<\/code> sonu\u00e7lar\u0131n\u0131 veya yetki kontrollerini \u00f6nbelle\u011fe alabilirsiniz.<br \/>\n* <strong>Gran\u00fcler Yetkilendirme<\/strong>: Sadece gerekli yerlerde metot bazl\u0131 yetkilendirme kullan\u0131n. Geni\u015f kapsaml\u0131 URL bazl\u0131 yetkilendirme kurallar\u0131 genellikle daha performansl\u0131d\u0131r.<br \/>\n* <strong>Minimum Yetki Prensibi<\/strong>: Kullan\u0131c\u0131lara her zaman sadece i\u015flerini yapmak i\u00e7in gerekli olan minimum yetkileri verin. Bu, hem g\u00fcvenlik hem de y\u00f6netim kolayl\u0131\u011f\u0131 a\u00e7\u0131s\u0131ndan \u00f6nemlidir.<\/p>\n<h3>Sonu\u00e7<\/h3>\n<p>Spring Security, Java tabanl\u0131 uygulamalar i\u00e7in rol tabanl\u0131 eri\u015fim yetkilendirmesini uygulamak i\u00e7in g\u00fc\u00e7l\u00fc, esnek ve kapsaml\u0131 bir \u00e7er\u00e7eve sunar. Bu makalede, Spring Security’nin temel kavramlar\u0131ndan, proje yap\u0131land\u0131rmas\u0131na, URL ve metot bazl\u0131 yetkilendirme mekanizmalar\u0131na kadar bir\u00e7ok konuyu detayl\u0131 kod \u00f6rnekleriyle ele ald\u0131k.<\/p>\n<p>Do\u011fru bir \u015fekilde uyguland\u0131\u011f\u0131nda, Spring Security ile olu\u015fturulan rol tabanl\u0131 yetkilendirme sistemleri, uygulamalar\u0131n\u0131z\u0131n g\u00fcvenli\u011fini art\u0131r\u0131r, kullan\u0131c\u0131 y\u00f6netimini basitle\u015ftirir ve uygulaman\u0131z\u0131n farkl\u0131 kullan\u0131c\u0131 gruplar\u0131na g\u00f6re \u00f6l\u00e7eklenebilirli\u011fini sa\u011flar. Geli\u015ftiricilerin, uygulaman\u0131n g\u00fcvenlik gereksinimlerini dikkatlice analiz etmeleri ve Spring Security’nin sundu\u011fu zengin \u00f6zellik setini bu gereksinimlere g\u00f6re uyarlamalar\u0131 kritik \u00f6neme sahiptir. Bu k\u0131lavuzun, Spring Security ile rol tabanl\u0131 yetkilendirme konusunda sa\u011flam bir temel olu\u015fturman\u0131za yard\u0131mc\u0131 olmas\u0131n\u0131 umuyoruz.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\nBu makale, modern web uygulamalar\u0131n\u0131n g\u00fcvenlik mimarisinin","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[874],"tags":[],"class_list":{"0":"post-35246","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-server","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n<title>Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\" \/>\n<meta property=\"og:description\" content=\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz Bu makale, modern web uygulamalar\u0131n\u0131n g\u00fcvenlik mimarisinin\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-27T07:40:47+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\",\"datePublished\":\"2025-11-27T07:40:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\"},\"wordCount\":2130,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Server\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\",\"name\":\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-27T07:40:47+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n","yoast_head_json":{"title":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","og_locale":"tr_TR","og_type":"article","og_title":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz","og_description":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz Bu makale, modern web uygulamalar\u0131n\u0131n g\u00fcvenlik mimarisinin","og_url":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-27T07:40:47+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"16 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz","datePublished":"2025-11-27T07:40:47+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/"},"wordCount":2130,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Server"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","url":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","name":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-27T07:40:47+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=35246"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35246\/revisions"}],"predecessor-version":[{"id":35247,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35246\/revisions\/35247"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=35246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=35246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=35246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":35246,"date":"2025-11-27T10:40:47","date_gmt":"2025-11-27T07:40:47","guid":{"rendered":"https:\/\/fatihsoysal.com\/blog\/?p=35246"},"modified":"2025-11-27T10:40:47","modified_gmt":"2025-11-27T07:40:47","slug":"spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz","status":"publish","type":"post","link":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","title":{"rendered":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz"},"content":{"rendered":"

<\/p>\n

Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz<\/h2>\n
Bu makale, modern web uygulamalar\u0131n\u0131n g\u00fcvenlik mimarisinin temel ta\u015flar\u0131ndan biri olan rol tabanl\u0131 eri\u015fim yetkilendirmesini Spring Security \u00e7er\u00e7evesiyle nas\u0131l uygulayaca\u011f\u0131n\u0131z\u0131 detayl\u0131 bir \u015fekilde a\u00e7\u0131klamaktad\u0131r. Spring Security, Java tabanl\u0131 uygulamalar i\u00e7in g\u00fc\u00e7l\u00fc ve \u00f6zelle\u015ftirilebilir bir g\u00fcvenlik \u00e7er\u00e7evesi sunar. \u00d6zellikle karma\u015f\u0131k yetkilendirme gereksinimleri olan kurumsal uygulamalar i\u00e7in vazge\u00e7ilmez bir ara\u00e7t\u0131r.<\/p>\n

Giri\u015f: Spring Security ve Yetkilendirme Kavram\u0131<\/h3>\n
G\u00fcn\u00fcm\u00fcz\u00fcn dijital d\u00fcnyas\u0131nda, uygulamalar\u0131n g\u00fcvenli\u011fi en \u00f6ncelikli konulardan biridir. Kullan\u0131c\u0131lar\u0131n hassas verilere yetkisiz eri\u015fimini engellemek, sistemin b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc korumak ve yasal d\u00fczenlemelere uyum sa\u011flamak i\u00e7in sa\u011flam g\u00fcvenlik mekanizmalar\u0131na ihtiya\u00e7 duyar\u0131z. Spring Security, bu gereksinimleri kar\u015f\u0131lamak \u00fczere tasarlanm\u0131\u015f kapsaml\u0131 bir g\u00fcvenlik \u00e7\u00f6z\u00fcm\u00fcd\u00fcr.<\/p>\n
Spring Security’nin iki ana i\u015flevi vard\u0131r:
\n1. Kimlik Do\u011frulama (Authentication)<\/strong>: Bir kullan\u0131c\u0131n\u0131n kim oldu\u011funu do\u011frulamak. Genellikle kullan\u0131c\u0131 ad\u0131 ve \u015fifre gibi kimlik bilgileriyle yap\u0131l\u0131r. Ba\u015far\u0131l\u0131 kimlik do\u011frulama, kullan\u0131c\u0131n\u0131n sisteme giri\u015f yapmas\u0131na izin verir.
\n2. Yetkilendirme (Authorization)<\/strong>: Kimli\u011fi do\u011frulanm\u0131\u015f bir kullan\u0131c\u0131n\u0131n belirli bir kayna\u011fa (URL, metot, veri) eri\u015fim izni olup olmad\u0131\u011f\u0131n\u0131 belirlemek. Bu, kullan\u0131c\u0131n\u0131n hangi i\u015flemleri yapabilece\u011fini ve hangi verilere eri\u015febilece\u011fini kontrol eden s\u00fcre\u00e7tir.<\/p>\n
Rol tabanl\u0131 eri\u015fim kontrol\u00fc (RBAC), yetkilendirme yakla\u015f\u0131mlar\u0131ndan biridir. RBAC’de, kullan\u0131c\u0131lara belirli roller (\u00f6rne\u011fin, “ADMIN”, “USER”, “EDITOR”) atan\u0131r ve bu rollere de belirli izinler (\u00f6rne\u011fin, “\u00fcr\u00fcnleri y\u00f6net”, “makale oku”, “sipari\u015fleri g\u00f6r\u00fcnt\u00fcle”) verilir. Bu sayede, her kullan\u0131c\u0131n\u0131n tek tek izinlerini y\u00f6netmek yerine, rolleri y\u00f6neterek ve kullan\u0131c\u0131lara uygun rolleri atayarak daha esnek ve \u00f6l\u00e7eklenebilir bir yetkilendirme sistemi kurabiliriz. Spring Security, bu RBAC modelini uygulamak i\u00e7in zengin \u00f6zellikler sunar.<\/p>\n
Bu makalede, Spring Boot tabanl\u0131 bir uygulama \u00fczerinden Spring Security’nin rol tabanl\u0131 yetkilendirme \u00f6zelliklerini ad\u0131m ad\u0131m ele alacak, hem URL bazl\u0131 hem de metot bazl\u0131 yetkilendirme mekanizmalar\u0131n\u0131 kod \u00f6rnekleriyle a\u00e7\u0131klayaca\u011f\u0131z.<\/p>\n

Temel Kavramlar ve Bile\u015fenler<\/h3>\n
Spring Security’nin rol tabanl\u0131 yetkilendirme mekanizmas\u0131n\u0131 anlamak i\u00e7in baz\u0131 temel kavramlara hakim olmak \u00f6nemlidir:<\/p>\n
UserDetails ve UserDetailsService<\/h4>\n
* UserDetails<\/code><\/strong>: Spring Security’de bir kullan\u0131c\u0131n\u0131n temel bilgilerini (kullan\u0131c\u0131 ad\u0131, \u015fifre, hesap durumu, yetkiler vb.) temsil eden bir aray\u00fczd\u00fcr. Genellikle bu aray\u00fcz\u00fc kendi User<\/code> s\u0131n\u0131f\u0131n\u0131zla implemente edersiniz. \n* UserDetailsService<\/code><\/strong>: Kullan\u0131c\u0131 ad\u0131 verilen bir UserDetails<\/code> nesnesini y\u00fcklemekten sorumlu bir aray\u00fczd\u00fcr. Genellikle veritaban\u0131ndan, LDAP’tan veya in-memory depolamadan kullan\u0131c\u0131 bilgilerini \u00e7ekmek i\u00e7in kullan\u0131l\u0131r. loadUserByUsername(String username)<\/code> metodu bulunur.<\/p>\n
GrantedAuthority<\/h4>\n* GrantedAuthority<\/code> aray\u00fcz\u00fc, kimli\u011fi do\u011frulanm\u0131\u015f bir kullan\u0131c\u0131n\u0131n sahip oldu\u011fu bir yetkiyi temsil eder. Bu yetkiler genellikle rollerdir (\u00f6rn. “ROLE_ADMIN”, “ROLE_USER”) veya daha gran\u00fcler izinler olabilir (\u00f6rn. “PRODUCT_READ”, “ORDER_WRITE”). \n* Spring Security, rolleri ROLE_<\/code> \u00f6nekiyle tan\u0131r. \u00d6rne\u011fin, hasRole('ADMIN')<\/code> ifadesi, kullan\u0131c\u0131n\u0131n ROLE_ADMIN<\/code> yetkisine sahip olup olmad\u0131\u011f\u0131n\u0131 kontrol eder. Bu \u00f6nek, rolleri di\u011fer yetkilerden ay\u0131rt etmek i\u00e7in bir konvansiyondur.<\/p>\n SecurityContextHolder<\/h4>\n* SecurityContextHolder<\/code>, uygulaman\u0131n herhangi bir yerinden mevcut g\u00fcvenlik ba\u011flam\u0131na (yani kimli\u011fi do\u011frulanm\u0131\u015f kullan\u0131c\u0131ya ve yetkilerine) eri\u015fmek i\u00e7in kullan\u0131lan statik bir s\u0131n\u0131ft\u0131r. \n* SecurityContextHolder.getContext().getAuthentication()<\/code> metodu ile o anki Authentication<\/code> nesnesine ula\u015f\u0131l\u0131r. Bu nesne, kimli\u011fi do\u011frulanm\u0131\u015f kullan\u0131c\u0131n\u0131n Principal<\/code>‘\u0131n\u0131 (genellikle UserDetails<\/code> nesnesi) ve GrantedAuthority<\/code>‘lerini i\u00e7erir.<\/p>\n Roller ve Yetkiler: Farklar\u0131 ve Kullan\u0131m\u0131<\/h4>\n* Roller<\/strong>: Genellikle kullan\u0131c\u0131n\u0131n sistemdeki genel i\u015flevini veya grubunu tan\u0131mlar (\u00f6rn. “Y\u00f6netici”, “\u00c7al\u0131\u015fan”, “M\u00fc\u015fteri”). Spring Security’de ROLE_<\/code> \u00f6nekiyle kullan\u0131l\u0131rlar. \n* Yetkiler (Authorities)<\/strong>: Daha gran\u00fcler izinleri ifade eder. \u00d6rne\u011fin, bir “Y\u00f6netici” rol\u00fc, “kullan\u0131c\u0131lar\u0131_y\u00f6net” ve “raporlar\u0131_g\u00f6r\u00fcnt\u00fcle” gibi yetkilere sahip olabilir. Roller asl\u0131nda bir t\u00fcr yetkidir, ancak Spring Security’de rollere \u00f6zel kolayl\u0131klar sa\u011flan\u0131r. \n* En iyi uygulama, yetkilendirme kontrollerinde genellikle hasRole()<\/code> veya hasAuthority()<\/code> kullanmakt\u0131r. hasRole('ADMIN')<\/code> kullan\u0131ld\u0131\u011f\u0131nda Spring Security otomatik olarak ROLE_ADMIN<\/code> yetkisini arar. hasAuthority('READ_PRIVILEGE')<\/code> ise tam olarak verilen yetkiyi arar.<\/p>\n Spring Security Projesini Yap\u0131land\u0131rma<\/h3>\nSpring Boot ile Spring Security’yi projenize entegre etmek olduk\u00e7a basittir.<\/p>\n Ba\u011f\u0131ml\u0131l\u0131klar (Maven\/Gradle)<\/h4>\nBir Spring Boot projesi olu\u015ftururken Spring Initializr (start.spring.io) \u00fczerinden Spring Security<\/code> ba\u011f\u0131ml\u0131l\u0131\u011f\u0131n\u0131 eklemeniz yeterlidir. Manuel olarak pom.xml<\/code>‘e eklemek isterseniz:<\/p>\n \n\n org.springframework.boot<\/groupId>\n spring-boot-starter-security<\/artifactId>\n<\/dependency>\n\n org.springframework.boot<\/groupId>\n spring-boot-starter-web<\/artifactId>\n<\/dependency>\n\n org.springframework.boot<\/groupId>\n spring-boot-starter-thymeleaf<\/artifactId> \n<\/dependency>\n\n org.thymeleaf.extras<\/groupId>\n thymeleaf-extras-springsecurity6<\/artifactId> \n<\/dependency><\/code><\/pre>\nTemel G\u00fcvenlik Konfig\u00fcrasyonu<\/h4>\nSpring Boot 2.7 \u00f6ncesi WebSecurityConfigurerAdapter<\/code> kullan\u0131l\u0131yordu. Spring Boot 2.7 ve 3.x’ten itibaren ise SecurityFilterChain<\/code> bean’leri tan\u0131mlanarak g\u00fcvenlik konfig\u00fcrasyonu yap\u0131l\u0131r. Bu yakla\u015f\u0131m daha esnek ve fonksiyoneldir.<\/p>\n \/\/ src\/main\/java\/com\/example\/securitydemo\/config\/SecurityConfig.java\n\npackage com.example.securitydemo.config;\n\nimport org.springframework.context.annotation.Bean;\nimport org.springframework.context.annotation.Configuration;\nimport org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; \/\/ Spring Boot 3+ i\u00e7in\n\/\/ import org.springframework.security.config.annotation.web.configuration.EnableGlobalMethodSecurity; \/\/ Spring Boot 2.x i\u00e7in\nimport org.springframework.security.config.annotation.web.builders.HttpSecurity;\nimport org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;\nimport org.springframework.security.core.userdetails.User;\nimport org.springframework.security.core.userdetails.UserDetails;\nimport org.springframework.security.core.userdetails.UserDetailsService;\nimport org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;\nimport org.springframework.security.crypto.password.PasswordEncoder;\nimport org.springframework.security.provisioning.InMemoryUserDetailsManager;\nimport org.springframework.security.web.SecurityFilterChain;\n\n@Configuration\n@EnableWebSecurity\n@EnableMethodSecurity \/\/ Metot bazl\u0131 g\u00fcvenli\u011fi etkinle\u015ftirir (Spring Boot 3+)\n\/\/ @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true) \/\/ Spring Boot 2.x i\u00e7in\npublic class SecurityConfig {\n\n \/\/ URL bazl\u0131 g\u00fcvenlik kurallar\u0131 ve HTTP konfig\u00fcrasyonu\n @Bean\n public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {\n http\n .authorizeHttpRequests(authorize -> authorize\n .requestMatchers(\"\/\", \"\/public\").permitAll() \/\/ Herkese a\u00e7\u0131k sayfalar\n .requestMatchers(\"\/user\/<\/em>\").hasRole(\"USER\") \/\/ Sadece ROLE_USER rol\u00fcne sahip olanlar eri\u015febilir\n .requestMatchers(\"\/admin\/<\/em>\").hasRole(\"ADMIN\") \/\/ Sadece ROLE_ADMIN rol\u00fcne sahip olanlar eri\u015febilir\n .anyRequest().authenticated() \/\/ Di\u011fer t\u00fcm istekler kimlik do\u011frulamas\u0131 gerektirir\n )\n .formLogin(form -> form\n .loginPage(\"\/login\") \/\/ \u00d6zel login sayfas\u0131\n .defaultSuccessUrl(\"\/dashboard\", true) \/\/ Ba\u015far\u0131l\u0131 giri\u015f sonras\u0131 y\u00f6nlendirilecek sayfa\n .permitAll()\n )\n .logout(logout -> logout\n .logoutSuccessUrl(\"\/\") \/\/ Ba\u015far\u0131l\u0131 \u00e7\u0131k\u0131\u015f sonras\u0131 y\u00f6nlendirilecek sayfa\n .permitAll()\n )\n .exceptionHandling(exception -> exception\n .accessDeniedPage(\"\/access-denied\") \/\/ Eri\u015fim reddedildi\u011finde g\u00f6sterilecek sayfa\n );\n return http.build();\n }\n\n \/\/ Kullan\u0131c\u0131 detaylar\u0131n\u0131 sa\u011flayan servis (\u015fimdilik in-memory)\n @Bean\n public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {\n UserDetails user = User.builder()\n .username(\"user\")\n .password(passwordEncoder.encode(\"password\"))\n .roles(\"USER\") \/\/ Otomatik olarak ROLE_USER olur\n .build();\n\n UserDetails admin = User.builder()\n .username(\"admin\")\n .password(passwordEncoder.encode(\"adminpass\"))\n .roles(\"ADMIN\", \"USER\") \/\/ ADMIN rol\u00fc ayn\u0131 zamanda USER yetkilerine de sahip olabilir\n .build();\n\n return new InMemoryUserDetailsManager(user, admin);\n }\n\n \/\/ \u015eifre \u015fifreleyici (PasswordEncoder)\n @Bean\n public PasswordEncoder passwordEncoder() {\n return new BCryptPasswordEncoder();\n }\n}<\/code><\/pre>\nBu konfig\u00fcrasyonda: \n* @Configuration<\/code> ve @EnableWebSecurity<\/code> Spring Security’yi etkinle\u015ftirir. \n* @EnableMethodSecurity<\/code> (Spring Boot 3+) metot bazl\u0131 g\u00fcvenlik anotasyonlar\u0131n\u0131 etkinle\u015ftirir. Spring Boot 2.x i\u00e7in @EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)<\/code> kullan\u0131l\u0131r. \n* securityFilterChain<\/code> metodu, HTTP istekleri i\u00e7in g\u00fcvenlik kurallar\u0131n\u0131 tan\u0131mlar. requestMatchers<\/code> ile URL yollar\u0131 e\u015fle\u015ftirilir ve permitAll()<\/code>, hasRole()<\/code>, authenticated()<\/code> gibi yetkilendirme kurallar\u0131 uygulan\u0131r. \n* userDetailsService<\/code> metodu, in-memory kullan\u0131c\u0131lar olu\u015fturur. Ger\u00e7ek uygulamalarda bu, veritaban\u0131ndan kullan\u0131c\u0131 \u00e7eken \u00f6zel bir UserDetailsService<\/code> implementasyonu olacakt\u0131r. \n* passwordEncoder<\/code> metodu, \u015fifreleri g\u00fcvenli bir \u015fekilde saklamak i\u00e7in BCryptPasswordEncoder<\/code> kullan\u0131r.<\/p>\n Rol Tabanl\u0131 Yetkilendirme Mekanizmalar\u0131<\/h3>\nSpring Security, rol tabanl\u0131 yetkilendirme i\u00e7in hem URL d\u00fczeyinde hem de metot d\u00fczeyinde \u00e7e\u015fitli mekanizmalar sunar.<\/p>\n URL Bazl\u0131 Yetkilendirme<\/h4>\nURL bazl\u0131 yetkilendirme, belirli URL yollar\u0131na kimlerin eri\u015febilece\u011fini tan\u0131mlamak i\u00e7in kullan\u0131l\u0131r. Bu, genellikle uygulaman\u0131n genel eri\u015fim politikalar\u0131n\u0131 belirlemek i\u00e7in ilk ad\u0131md\u0131r. SecurityFilterChain<\/code> bean’i i\u00e7erisinde authorizeHttpRequests<\/code> blo\u011funda yap\u0131land\u0131r\u0131l\u0131r.<\/p>\n * requestMatchers(patterns).permitAll()<\/code><\/strong>: Belirtilen yollara herkesin eri\u015fimine izin verir. \n* requestMatchers(patterns).authenticated()<\/code><\/strong>: Belirtilen yollara sadece kimli\u011fi do\u011frulanm\u0131\u015f kullan\u0131c\u0131lar\u0131n eri\u015fimine izin verir. \n* requestMatchers(patterns).hasRole(role)<\/code><\/strong>: Belirtilen yollara sadece belirli bir role sahip kullan\u0131c\u0131lar\u0131n eri\u015fimine izin verir (\u00f6rn. hasRole(\"ADMIN\")<\/code> ROLE_ADMIN<\/code> yetkisini arar). \n* requestMatchers(patterns).hasAnyRole(role1, role2)<\/code><\/strong>: Belirtilen yollara belirtilen rollerden herhangi birine sahip kullan\u0131c\u0131lar\u0131n eri\u015fimine izin verir. \n* requestMatchers(patterns).hasAuthority(authority)<\/code><\/strong>: Belirtilen yollara belirli bir yetkiye sahip kullan\u0131c\u0131lar\u0131n eri\u015fimine izin verir (\u00f6rn. hasAuthority(\"READ_PRIVILEGE\")<\/code>). \n* requestMatchers(patterns).hasAnyAuthority(auth1, auth2)<\/code><\/strong>: Belirtilen yollara belirtilen yetkilerden herhangi birine sahip kullan\u0131c\u0131lar\u0131n eri\u015fimine izin verir. \n* anyRequest().authenticated()<\/code><\/strong>: Yukar\u0131daki kurallarla e\u015fle\u015fmeyen t\u00fcm isteklerin kimlik do\u011frulamas\u0131 gerektirdi\u011fini belirtir.<\/p>\n \u00d6rnek:<\/strong><\/p>\n http\n .authorizeHttpRequests(authorize -> authorize\n .requestMatchers(\"\/\", \"\/public\").permitAll()\n .requestMatchers(\"\/user\/<\/em>\").hasRole(\"USER\")\n .requestMatchers(\"\/admin\/<\/em>\").hasRole(\"ADMIN\")\n .requestMatchers(\"\/api\/products\").hasAnyRole(\"USER\", \"ADMIN\")\n .requestMatchers(\"\/api\/products\/add\").hasAuthority(\"PRODUCT_WRITE\") \/\/ Daha gran\u00fcler yetki\n .anyRequest().authenticated()\n );<\/code><\/pre>\nMetot Bazl\u0131 Yetkilendirme<\/h4>\nMetot bazl\u0131 yetkilendirme, bir s\u0131n\u0131f\u0131n veya metodun \u00e7a\u011fr\u0131lmadan \u00f6nce belirli yetkilendirme kurallar\u0131n\u0131n uygulanmas\u0131n\u0131 sa\u011flar. Bu, daha ince taneli (fine-grained) yetkilendirme kontrol\u00fc sa\u011flamak i\u00e7in idealdir. Metot bazl\u0131 yetkilendirmeyi kullanmak i\u00e7in SecurityConfig<\/code> s\u0131n\u0131f\u0131nda @EnableMethodSecurity<\/code> (Spring Boot 3+) veya @EnableGlobalMethodSecurity<\/code> (Spring Boot 2.x) anotasyonunu etkinle\u015ftirmelisiniz.<\/p>\n * @PreAuthorize<\/code><\/strong>: Metot \u00e7a\u011fr\u0131lmadan \u00f6nce yetkilendirme kontrol\u00fc yapar. Spring Expression Language (SpEL) kullanarak karma\u015f\u0131k ifadeler yaz\u0131labilir. \n * @PreAuthorize(\"hasRole('ADMIN')\")<\/code> \n * @PreAuthorize(\"hasAnyRole('ADMIN', 'USER')\")<\/code> \n * @PreAuthorize(\"hasAuthority('PRODUCT_CREATE')\")<\/code> \n * @PreAuthorize(\"principal.username == #username\")<\/code> (Metot parametresine eri\u015fim) \n * @PreAuthorize(\"hasRole('ADMIN') or @myCustomSecurityService.canAccess(#id)\")<\/code> (\u00d6zel servis \u00e7a\u011fr\u0131s\u0131) \n* @PostAuthorize<\/code><\/strong>: Metot \u00e7a\u011fr\u0131ld\u0131ktan ve sonu\u00e7 d\u00f6nd\u00fcr\u00fcld\u00fckten sonra yetkilendirme kontrol\u00fc yapar. Genellikle d\u00f6nen nesneye eri\u015fim kontrol\u00fc i\u00e7in kullan\u0131l\u0131r. \n * @PostAuthorize(\"returnObject.owner == authentication.name\")<\/code> \n* @Secured<\/code><\/strong>: Daha basit, rol tabanl\u0131 yetkilendirme i\u00e7in kullan\u0131l\u0131r. Birden fazla rol belirtilebilir. \n * @Secured(\"ROLE_ADMIN\")<\/code> \n * @Secured({\"ROLE_ADMIN\", \"ROLE_USER\"})<\/code> \n* @RolesAllowed<\/code> (JSR-250)<\/strong>: Standart Java EE anotasyonudur. @Secured<\/code>‘a benzer \u015fekilde \u00e7al\u0131\u015f\u0131r. \n * @RolesAllowed(\"ADMIN\")<\/code> \n * @RolesAllowed({\"ADMIN\", \"USER\"})<\/code><\/p>\n \u00d6rnek:<\/strong><\/p>\n \/\/ src\/main\/java\/com\/example\/securitydemo\/controller\/MyController.java\n\npackage com.example.securitydemo.controller;\n\nimport org.springframework.security.access.prepost.PreAuthorize;\nimport org.springframework.web.bind.annotation.GetMapping;\nimport org.springframework.web.bind.annotation.PathVariable;\nimport org.springframework.web.bind.annotation.RequestMapping;\nimport org.springframework.web.bind.annotation.RestController;\n\n@RestController\n@RequestMapping(\"\/\")\npublic class MyController {\n\n @GetMapping(\"\/public\")\n public String publicPage() {\n return \"Herkese a\u00e7\u0131k sayfa!\";\n }\n\n @GetMapping(\"\/user\/dashboard\")\n @PreAuthorize(\"hasRole('USER')\") \/\/ Sadece ROLE_USER eri\u015febilir\n public String userDashboard() {\n return \"Kullan\u0131c\u0131 Paneli - Sadece kullan\u0131c\u0131lar eri\u015febilir.\";\n }\n\n @GetMapping(\"\/admin\/settings\")\n @PreAuthorize(\"hasRole('ADMIN')\") \/\/ Sadece ROLE_ADMIN eri\u015febilir\n public String adminSettings() {\n return \"Y\u00f6netici Ayarlar\u0131 - Sadece y\u00f6neticiler eri\u015febilir.\";\n }\n\n @GetMapping(\"\/admin\/users\/{username}\")\n @PreAuthorize(\"hasRole('ADMIN') or (hasRole('USER') and authentication.name == #username)\")\n public String getUserDetails(@PathVariable String username) {\n return \"Kullan\u0131c\u0131 detaylar\u0131: \" + username;\n }\n\n @GetMapping(\"\/editor\/article\")\n @PreAuthorize(\"hasAnyRole('ADMIN', 'EDITOR')\") \/\/ ADMIN veya EDITOR eri\u015febilir\n public String editorArticlePage() {\n return \"Edit\u00f6r makale sayfas\u0131.\";\n }\n}<\/code><\/pre>\nBu \u00f6rnekte @PreAuthorize<\/code> kullanarak farkl\u0131 endpoint’lere farkl\u0131 rol ve yetki kontrolleri eklenmi\u015ftir. \u00d6zellikle getUserDetails<\/code> metodu, hem ADMIN rol\u00fcne sahip olanlar\u0131n hem de USER rol\u00fcne sahip olup kendi kullan\u0131c\u0131 adlar\u0131na eri\u015fenlerin bu metodu kullanabilece\u011fini g\u00f6steren karma\u015f\u0131k bir SpEL ifadesi i\u00e7erir.<\/p>\n \u00d6rnek Bir Spring Boot Uygulamas\u0131 Geli\u015ftirme<\/h3>\n\u015eimdi yukar\u0131daki teorik bilgileri birle\u015ftirerek basit bir Spring Boot uygulamas\u0131 geli\u015ftirelim.<\/p>\n Proje Olu\u015fturma ve Ba\u011f\u0131ml\u0131l\u0131klar<\/h4>\nSpring Initializr (start.spring.io) kullanarak a\u015fa\u011f\u0131daki ba\u011f\u0131ml\u0131l\u0131klarla bir proje olu\u015fturun: \n* Spring Web \n* Spring Security \n* Thymeleaf (Basit bir UI i\u00e7in)<\/p>\n pom.xml<\/code> dosyan\u0131zda yukar\u0131da belirtilen ba\u011f\u0131ml\u0131l\u0131klar\u0131n oldu\u011fundan emin olun.<\/p>\n Kullan\u0131c\u0131 ve Rol Modelleri (In-Memory)<\/h4>\nGer\u00e7ek uygulamalarda veritaban\u0131 tabanl\u0131 kullan\u0131c\u0131 ve rol y\u00f6netimi kullan\u0131l\u0131r. Ancak bu \u00f6rnekte basitlik ad\u0131na in-memory kullan\u0131c\u0131lar tan\u0131mlayaca\u011f\u0131z. SecurityConfig<\/code> s\u0131n\u0131f\u0131nda UserDetailsService<\/code> bean’i zaten bu in-memory kullan\u0131c\u0131lar\u0131 sa\u011flamaktad\u0131r.<\/p>\n G\u00fcvenlik Konfig\u00fcrasyonu (SecurityConfig.java<\/code>)<\/h4>\nYukar\u0131da detayl\u0131ca a\u00e7\u0131klanan SecurityConfig<\/code> s\u0131n\u0131f\u0131n\u0131 kullanaca\u011f\u0131z. Bu s\u0131n\u0131f, URL bazl\u0131 yetkilendirme kurallar\u0131n\u0131 ve metot bazl\u0131 yetkilendirme i\u00e7in @EnableMethodSecurity<\/code>‘yi i\u00e7erir.<\/p>\n \/\/ src\/main\/java\/com\/example\/securitydemo\/config\/SecurityConfig.java\n\/\/ (Yukar\u0131daki \u00f6rnekle ayn\u0131)<\/code><\/pre>\nKontrolc\u00fc Katman\u0131 (MyController.java<\/code>)<\/h4>\nYukar\u0131da metot bazl\u0131 yetkilendirme \u00f6rneklerinde kulland\u0131\u011f\u0131m\u0131z MyController<\/code> s\u0131n\u0131f\u0131n\u0131 kullanaca\u011f\u0131z. Bu kontrolc\u00fc, farkl\u0131 URL’ler ve metot bazl\u0131 g\u00fcvenlik kurallar\u0131 ile eri\u015filebilen \u00e7e\u015fitli endpoint’lere sahiptir.<\/p>\n \/\/ src\/main\/java\/com\/example\/securitydemo\/controller\/MyController.java\n\/\/ (Yukar\u0131daki \u00f6rnekle ayn\u0131)<\/code><\/pre>\nEk olarak, basit bir login sayfas\u0131 ve dashboard i\u00e7in Thymeleaf \u015fablonlar\u0131 olu\u015ftural\u0131m:<\/p>\n src\/main\/resources\/templates\/login.html<\/code><\/strong><\/p>\n \n\n\n Giri\u015f Sayfas\u0131<\/title>\n<\/head>\n<body>\n <h2>Giri\u015f Yap<\/h2>\n <div th:if=\"${param.error}\" style=\"color:red;\">\n Hatal\u0131 kullan\u0131c\u0131 ad\u0131 veya \u015fifre.\n <\/div>\n <div th:if=\"${param.logout}\" style=\"color:green;\">\n Ba\u015far\u0131yla \u00e7\u0131k\u0131\u015f yapt\u0131n\u0131z.\n <\/div>\n <form th:action=\"@{\/login}\" method=\"post\">\n <div>\n <label for=\"username\">Kullan\u0131c\u0131 Ad\u0131:<\/label>\n <input type=\"text\" id=\"username\" name=\"username\"\/>\n <\/div>\n <div>\n <label for=\"password\">\u015eifre:<\/label>\n <input type=\"password\" id=\"password\" name=\"password\"\/>\n <\/div>\n <div>\n <input type=\"submit\" value=\"Giri\u015f Yap\"\/>\n <\/div>\n <\/form>\n <br\/>\n <a th:href=\"@{\/public}\">Herkese A\u00e7\u0131k Sayfa<\/a>\n<\/body>\n<\/html><\/code><\/pre>\n<p><strong><code>src\/main\/resources\/templates\/dashboard.html<\/code><\/strong><\/p>\n<pre><code class=\"language-html\"><!DOCTYPE html>\n<html xmlns:th=\"http:\/\/www.thymeleaf.org\"\n xmlns:sec=\"http:\/\/www.thymeleaf.org\/extras\/spring-security\">\n<head>\n <title>Dashboard<\/title>\n<\/head>\n<body>\n <h2>Ho\u015f Geldiniz, <span sec:authentication=\"name\"><\/span>!<\/h2>\n\n <p>Bu, giri\u015f yapm\u0131\u015f kullan\u0131c\u0131lar i\u00e7in bir dashboard sayfas\u0131d\u0131r.<\/p>\n\n <h3>Eri\u015filebilir Sayfalar:<\/h3>\n <ul>\n <li><a th:href=\"@{\/public}\">Herkese A\u00e7\u0131k Sayfa<\/a><\/li>\n <li sec:authorize=\"hasRole('USER')\"><a th:href=\"@{\/user\/dashboard}\">Kullan\u0131c\u0131 Paneli<\/a><\/li>\n <li sec:authorize=\"hasRole('ADMIN')\"><a th:href=\"@{\/admin\/settings}\">Y\u00f6netici Ayarlar\u0131<\/a><\/li>\n <li sec:authorize=\"hasAnyRole('ADMIN', 'EDITOR')\"><a th:href=\"@{\/editor\/article}\">Edit\u00f6r Makale Sayfas\u0131<\/a><\/li>\n <\/ul>\n\n <form th:action=\"@{\/logout}\" method=\"post\">\n <input type=\"submit\" value=\"\u00c7\u0131k\u0131\u015f Yap\"\/>\n <\/form>\n<\/body>\n<\/html><\/code><\/pre>\n<p><strong><code>src\/main\/resources\/templates\/access-denied.html<\/code><\/strong><\/p>\n<pre><code class=\"language-html\"><!DOCTYPE html>\n<html xmlns:th=\"http:\/\/www.thymeleaf.org\">\n<head>\n <title>Eri\u015fim Reddedildi<\/title>\n<\/head>\n<body>\n <h2>Eri\u015fim Reddedildi!<\/h2>\n <p>Bu kayna\u011fa eri\u015fim yetkiniz bulunmamaktad\u0131r.<\/p>\n <a th:href=\"@{\/dashboard}\">Ana Sayfaya D\u00f6n<\/a>\n<\/body>\n<\/html><\/code><\/pre>\n<p>Ve bu Thymeleaf \u015fablonlar\u0131n\u0131 g\u00f6stermek i\u00e7in basit bir <code>ViewController<\/code>:<\/p>\n<pre><code class=\"language-java\">\/\/ src\/main\/java\/com\/example\/securitydemo\/controller\/ViewController.java\n\npackage com.example.securitydemo.controller;\n\nimport org.springframework.stereotype.Controller;\nimport org.springframework.web.bind.annotation.GetMapping;\n\n@Controller\npublic class ViewController {\n\n @GetMapping(\"\/login\")\n public String login() {\n return \"login\";\n }\n\n @GetMapping(\"\/dashboard\")\n public String dashboard() {\n return \"dashboard\";\n }\n\n @GetMapping(\"\/access-denied\")\n public String accessDenied() {\n return \"access-denied\";\n }\n}<\/code><\/pre>\n<h4>Test Etme<\/h4>\n<p>Uygulamay\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n (<code>SpringSecurityDemoApplication.java<\/code>).<\/p>\n<p>1. <strong><code>http:\/\/localhost:8080\/<\/code> veya <code>http:\/\/localhost:8080\/public<\/code><\/strong>: Herkese a\u00e7\u0131k oldu\u011fu i\u00e7in giri\u015f yapmadan eri\u015febilirsiniz.<br \/>\n2. <strong><code>http:\/\/localhost:8080\/user\/dashboard<\/code><\/strong>: Giri\u015f yapman\u0131z istenecektir.<br \/>\n * <code>user\/password<\/code> ile giri\u015f yap\u0131n. Ba\u015far\u0131l\u0131 bir \u015fekilde eri\u015feceksiniz.<br \/>\n * <code>admin\/adminpass<\/code> ile giri\u015f yap\u0131n. <code>admin<\/code> kullan\u0131c\u0131s\u0131 <code>ROLE_USER<\/code> rol\u00fcne de sahip oldu\u011fu i\u00e7in eri\u015febilir.<br \/>\n3. <strong><code>http:\/\/localhost:8080\/admin\/settings<\/code><\/strong>: Giri\u015f yapman\u0131z istenecektir.<br \/>\n * <code>user\/password<\/code> ile giri\u015f yapmaya \u00e7al\u0131\u015f\u0131n. Eri\u015fim reddedilecektir (<code>\/access-denied<\/code> sayfas\u0131na y\u00f6nlendirilir).<br \/>\n * <code>admin\/adminpass<\/code> ile giri\u015f yap\u0131n. Ba\u015far\u0131l\u0131 bir \u015fekilde eri\u015feceksiniz.<br \/>\n4. <strong><code>http:\/\/localhost:8080\/admin\/users\/user<\/code><\/strong>:<br \/>\n * <code>user\/password<\/code> ile giri\u015f yap\u0131n. <code>authentication.name == #username<\/code> kural\u0131 sayesinde kendi kullan\u0131c\u0131 ad\u0131n\u0131zla eri\u015febilirsiniz.<br \/>\n * <code>admin\/adminpass<\/code> ile giri\u015f yap\u0131n. <code>hasRole('ADMIN')<\/code> kural\u0131 sayesinde eri\u015febilirsiniz.<br \/>\n * <code>user\/password<\/code> ile giri\u015f yap\u0131p <code>http:\/\/localhost:8080\/admin\/users\/admin<\/code> adresine gitmeye \u00e7al\u0131\u015f\u0131n. Eri\u015fim reddedilecektir, \u00e7\u00fcnk\u00fc <code>user<\/code> kullan\u0131c\u0131s\u0131 <code>admin<\/code> kullan\u0131c\u0131s\u0131n\u0131n detaylar\u0131na eri\u015femez.<\/p>\n<p>Bu testler, hem URL bazl\u0131 hem de metot bazl\u0131 rol tabanl\u0131 yetkilendirme kurallar\u0131n\u0131n ba\u015far\u0131yla uyguland\u0131\u011f\u0131n\u0131 g\u00f6stermektedir.<\/p>\n<h3>\u0130leri Seviye Konular ve En \u0130yi Uygulamalar<\/h3>\n<p>Uygulamalar b\u00fcy\u00fcd\u00fck\u00e7e ve karma\u015f\u0131kla\u015ft\u0131k\u00e7a, Spring Security ile yetkilendirme konusunda dikkate al\u0131nmas\u0131 gereken baz\u0131 ileri seviye konular ve en iyi uygulamalar vard\u0131r.<\/p>\n<h4>Veritaban\u0131 Tabanl\u0131 Kullan\u0131c\u0131 ve Rol Y\u00f6netimi<\/h4>\n<p>Ger\u00e7ek d\u00fcnya uygulamalar\u0131nda, kullan\u0131c\u0131lar ve rolleri genellikle bir veritaban\u0131nda saklan\u0131r. Bu durumda, <code>UserDetailsService<\/code> aray\u00fcz\u00fcn\u00fc implemente eden \u00f6zel bir s\u0131n\u0131f yazman\u0131z ve bu s\u0131n\u0131f i\u00e7inde veritaban\u0131ndan kullan\u0131c\u0131 bilgilerini (kullan\u0131c\u0131 ad\u0131, \u015fifre, rolleri\/yetkileri) \u00e7ekmeniz gerekir.<\/p>\n<pre><code class=\"language-java\">\/\/ \u00d6rnek: \u00d6zel UserDetailsService implementasyonu\n@Service\npublic class CustomUserDetailsService implements UserDetailsService {\n\n @Autowired\n private UserRepository userRepository; \/\/ Kendi kullan\u0131c\u0131 repository'niz\n\n @Override\n public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {\n com.example.securitydemo.model.User user = userRepository.findByUsername(username)\n .orElseThrow(() -> new UsernameNotFoundException(\"Kullan\u0131c\u0131 bulunamad\u0131: \" + username));\n\n \/\/ Kullan\u0131c\u0131n\u0131n rollerini GrantedAuthority nesnelerine d\u00f6n\u00fc\u015ft\u00fcr\u00fcn\n List<GrantedAuthority> authorities = user.getRoles().stream()\n .map(role -> new SimpleGrantedAuthority(role.getName())) \/\/ Role nesnenizin getName() metodu ROLE_ADMIN gibi bir string d\u00f6nmeli\n .collect(Collectors.toList());\n\n return new org.springframework.security.core.userdetails.User(\n user.getUsername(),\n user.getPassword(),\n authorities\n );\n }\n}<\/code><\/pre>\n<p>Bu \u00f6rnekte, <code>UserRepository<\/code> sizin veritaban\u0131 eri\u015fim katman\u0131n\u0131z\u0131 temsil eder ve <code>com.example.securitydemo.model.User<\/code> sizin \u00f6zel kullan\u0131c\u0131 entity’nizdir.<\/p>\n<h4>\u00d6zel Yetkilendirme Kararlar\u0131 (Custom Access Decisions)<\/h4>\n<p>Bazen <code>hasRole()<\/code>, <code>hasAuthority()<\/code> gibi haz\u0131r SpEL ifadeleri yetersiz kalabilir. Daha karma\u015f\u0131k i\u015f mant\u0131\u011f\u0131na dayal\u0131 yetkilendirme kararlar\u0131 i\u00e7in \u00f6zel bir <code>PermissionEvaluator<\/code> implementasyonu yazabilirsiniz. Bu, <code>@PreAuthorize(\"hasPermission(#object, 'read')\")<\/code> gibi ifadeler kullanman\u0131za olanak tan\u0131r.<\/p>\n<h4>CSRF, CORS, XSS Korumalar\u0131<\/h4>\n<p>Spring Security, varsay\u0131lan olarak bir\u00e7ok yayg\u0131n web g\u00fcvenlik a\u00e7\u0131\u011f\u0131na kar\u015f\u0131 koruma sa\u011flar:<br \/>\n* <strong>CSRF (Cross-Site Request Forgery)<\/strong>: Form tabanl\u0131 veya AJAX istekleri i\u00e7in otomatik olarak CSRF tokenleri ekler ve do\u011frular.<br \/>\n* <strong>CORS (Cross-Origin Resource Sharing)<\/strong>: Farkl\u0131 kaynaklardan gelen isteklere izin verme veya engelleme mekanizmas\u0131 sunar.<br \/>\n* <strong>XSS (Cross-Site Scripting)<\/strong>: Thymeleaf gibi \u015fablon motorlar\u0131 ve Spring’in HTTP response header’lar\u0131 sayesinde XSS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 koruma sa\u011flan\u0131r.<\/p>\n<p>Bu korumalar\u0131n \u00e7o\u011fu varsay\u0131lan olarak etkindir ve genellikle ek bir konfig\u00fcrasyon gerektirmez. Ancak \u00f6zel durumlarda \u00f6zelle\u015ftirilebilirler.<\/p>\n<h4>Hata Y\u00f6netimi ve Eri\u015fim Reddi Sayfalar\u0131<\/h4>\n<p>Eri\u015fim reddedildi\u011finde kullan\u0131c\u0131ya dost\u00e7a bir mesaj g\u00f6stermek \u00f6nemlidir. <code>SecurityConfig<\/code> i\u00e7inde <code>exceptionHandling().accessDeniedPage(\"\/access-denied\")<\/code> ile \u00f6zel bir eri\u015fim reddi sayfas\u0131 belirleyebilirsiniz. Ayr\u0131ca, REST API’leri i\u00e7in <code>AccessDeniedHandler<\/code> ve <code>AuthenticationEntryPoint<\/code> implementasyonlar\u0131 ile \u00f6zel hata yan\u0131tlar\u0131 d\u00f6nd\u00fcrebilirsiniz.<\/p>\n<h4>Performans ve \u00d6l\u00e7eklenebilirlik<\/h4>\n<p>B\u00fcy\u00fck \u00f6l\u00e7ekli uygulamalarda, her istekte yetkilendirme kontrollerinin yap\u0131lmas\u0131 performans \u00fczerinde bir etkiye sahip olabilir. Performans\u0131 art\u0131rmak i\u00e7in:<br \/>\n* <strong>Caching<\/strong>: <code>UserDetailsService<\/code> sonu\u00e7lar\u0131n\u0131 veya yetki kontrollerini \u00f6nbelle\u011fe alabilirsiniz.<br \/>\n* <strong>Gran\u00fcler Yetkilendirme<\/strong>: Sadece gerekli yerlerde metot bazl\u0131 yetkilendirme kullan\u0131n. Geni\u015f kapsaml\u0131 URL bazl\u0131 yetkilendirme kurallar\u0131 genellikle daha performansl\u0131d\u0131r.<br \/>\n* <strong>Minimum Yetki Prensibi<\/strong>: Kullan\u0131c\u0131lara her zaman sadece i\u015flerini yapmak i\u00e7in gerekli olan minimum yetkileri verin. Bu, hem g\u00fcvenlik hem de y\u00f6netim kolayl\u0131\u011f\u0131 a\u00e7\u0131s\u0131ndan \u00f6nemlidir.<\/p>\n<h3>Sonu\u00e7<\/h3>\n<p>Spring Security, Java tabanl\u0131 uygulamalar i\u00e7in rol tabanl\u0131 eri\u015fim yetkilendirmesini uygulamak i\u00e7in g\u00fc\u00e7l\u00fc, esnek ve kapsaml\u0131 bir \u00e7er\u00e7eve sunar. Bu makalede, Spring Security’nin temel kavramlar\u0131ndan, proje yap\u0131land\u0131rmas\u0131na, URL ve metot bazl\u0131 yetkilendirme mekanizmalar\u0131na kadar bir\u00e7ok konuyu detayl\u0131 kod \u00f6rnekleriyle ele ald\u0131k.<\/p>\n<p>Do\u011fru bir \u015fekilde uyguland\u0131\u011f\u0131nda, Spring Security ile olu\u015fturulan rol tabanl\u0131 yetkilendirme sistemleri, uygulamalar\u0131n\u0131z\u0131n g\u00fcvenli\u011fini art\u0131r\u0131r, kullan\u0131c\u0131 y\u00f6netimini basitle\u015ftirir ve uygulaman\u0131z\u0131n farkl\u0131 kullan\u0131c\u0131 gruplar\u0131na g\u00f6re \u00f6l\u00e7eklenebilirli\u011fini sa\u011flar. Geli\u015ftiricilerin, uygulaman\u0131n g\u00fcvenlik gereksinimlerini dikkatlice analiz etmeleri ve Spring Security’nin sundu\u011fu zengin \u00f6zellik setini bu gereksinimlere g\u00f6re uyarlamalar\u0131 kritik \u00f6neme sahiptir. Bu k\u0131lavuzun, Spring Security ile rol tabanl\u0131 yetkilendirme konusunda sa\u011flam bir temel olu\u015fturman\u0131za yard\u0131mc\u0131 olmas\u0131n\u0131 umuyoruz.<\/body><\/p>\n","protected":false},"excerpt":{"rendered":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\nBu makale, modern web uygulamalar\u0131n\u0131n g\u00fcvenlik mimarisinin","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_page_header_type":"","csco_page_load_nextpost":"","csco_page_subscribe_form":"","csco_page_contact_form":"","footnotes":""},"categories":[874],"tags":[],"class_list":{"0":"post-35246","1":"post","2":"type-post","3":"status-publish","4":"format-standard","6":"category-server","7":"cs-entry","8":"cs-video-wrap"},"yoast_head":"\n<title>Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\" \/>\n<meta property=\"og:locale\" content=\"tr_TR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\" \/>\n<meta property=\"og:description\" content=\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz Bu makale, modern web uygulamalar\u0131n\u0131n g\u00fcvenlik mimarisinin\" \/>\n<meta property=\"og:url\" content=\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\" \/>\n<meta property=\"og:site_name\" content=\"Kodlar\u0131n Gizemli D\u00fcnyas\u0131\" \/>\n<meta property=\"article:published_time\" content=\"2025-11-27T07:40:47+00:00\" \/>\n<meta name=\"author\" content=\"Fatih Soysal\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Yazan:\" \/>\n\t<meta name=\"twitter:data1\" content=\"Fatih Soysal\" \/>\n\t<meta name=\"twitter:label2\" content=\"Tahmini okuma s\u00fcresi\" \/>\n\t<meta name=\"twitter:data2\" content=\"16 dakika\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\"},\"author\":{\"name\":\"Fatih Soysal\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"headline\":\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\",\"datePublished\":\"2025-11-27T07:40:47+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\"},\"wordCount\":2130,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"articleSection\":[\"Server\"],\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#respond\"]}],\"copyrightYear\":\"2025\",\"copyrightHolder\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\",\"name\":\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131\",\"isPartOf\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\"},\"datePublished\":\"2025-11-27T07:40:47+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb\"},\"inLanguage\":\"tr\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Anasayfa\",\"item\":\"https:\/\/fatihsoysal.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#website\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/\",\"name\":\"Fatihsoysal.com\",\"description\":\"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim\",\"publisher\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"tr\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1\",\"name\":\"Fatih Soysal\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"tr\",\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"contentUrl\":\"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png\",\"width\":512,\"height\":512,\"caption\":\"Fatih Soysal\"},\"logo\":{\"@id\":\"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/\"},\"description\":\"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.\",\"url\":\"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/\"}]}<\/script>\n","yoast_head_json":{"title":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","og_locale":"tr_TR","og_type":"article","og_title":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz","og_description":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz Bu makale, modern web uygulamalar\u0131n\u0131n g\u00fcvenlik mimarisinin","og_url":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","og_site_name":"Kodlar\u0131n Gizemli D\u00fcnyas\u0131","article_published_time":"2025-11-27T07:40:47+00:00","author":"Fatih Soysal","twitter_card":"summary_large_image","twitter_misc":{"Yazan:":"Fatih Soysal","Tahmini okuma s\u00fcresi":"16 dakika"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#article","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/"},"author":{"name":"Fatih Soysal","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"headline":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz","datePublished":"2025-11-27T07:40:47+00:00","mainEntityOfPage":{"@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/"},"wordCount":2130,"commentCount":0,"publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"articleSection":["Server"],"inLanguage":"tr","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#respond"]}],"copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/fatihsoysal.com\/blog\/#organization"}},{"@type":"WebPage","@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","url":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/","name":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz - Kodlar\u0131n Gizemli D\u00fcnyas\u0131","isPartOf":{"@id":"https:\/\/fatihsoysal.com\/blog\/#website"},"datePublished":"2025-11-27T07:40:47+00:00","breadcrumb":{"@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb"},"inLanguage":"tr","potentialAction":[{"@type":"ReadAction","target":["https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/fatihsoysal.com\/blog\/spring-security-ile-rol-tabanli-erisim-yetkilendirme-ornegi-detayli-bir-kilavuz\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Anasayfa","item":"https:\/\/fatihsoysal.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Spring Security ile Rol Tabanl\u0131 Eri\u015fim Yetkilendirme \u00d6rne\u011fi: Detayl\u0131 Bir K\u0131lavuz"}]},{"@type":"WebSite","@id":"https:\/\/fatihsoysal.com\/blog\/#website","url":"https:\/\/fatihsoysal.com\/blog\/","name":"Fatihsoysal.com","description":"Blog - Yaz\u0131l\u0131m D\u00fcnyas\u0131 Tecr\u00fcbelerim","publisher":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/fatihsoysal.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"tr"},{"@type":["Person","Organization"],"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/002a254750921dcfd568a99e48240dd1","name":"Fatih Soysal","image":{"@type":"ImageObject","inLanguage":"tr","@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","contentUrl":"https:\/\/fatihsoysal.com\/blog\/wp-content\/uploads\/2024\/04\/cropped-replicate-prediction-3kgg1hgjn5rgp0cf0p5tr0jw7w-1.png","width":512,"height":512,"caption":"Fatih Soysal"},"logo":{"@id":"https:\/\/fatihsoysal.com\/blog\/#\/schema\/person\/image\/"},"description":"Kullan\u0131m ve kodlama m\u00fckemmeliyetini odak alan uygulamalar olu\u015fturma deneyimine sahip, profesyonel olarak 15+ y\u0131l \u00fczeri deneyime sahip bir yaz\u0131l\u0131m m\u00fchendisi.","url":"https:\/\/fatihsoysal.com\/blog\/author\/fatihsoysal\/"}]}},"yoast_meta":{"yoast_wpseo_title":"","yoast_wpseo_metadesc":"","yoast_wpseo_canonical":""},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/comments?post=35246"}],"version-history":[{"count":1,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35246\/revisions"}],"predecessor-version":[{"id":35247,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/posts\/35246\/revisions\/35247"}],"wp:attachment":[{"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/media?parent=35246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/categories?post=35246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fatihsoysal.com\/blog\/wp-json\/wp\/v2\/tags?post=35246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}