Spring Security

31 lessons · free to read

Lock down a Spring Boot app: filter chain, JWT, method security and the classic traps.

Take this course in the learning hub

Lessons

• The security filter chainKnow how Spring Security hooks into a servlet app and what happens before your controller runs.
• Authentication vs authorizationTell the two halves of security apart and know where Spring Security keeps the current user.
• Configuring SecurityFilterChainWrite the modern lambda-DSL config bean and order request rules so they actually take effect.
• Loading users with UserDetailsServiceConnect your own user table to Spring Security by implementing a single lookup method.
• Password encoding with BCryptStore passwords the only acceptable way and understand what BCrypt is doing for you.
• Form login vs stateless APIsPick the right login style for browsers and for machines, and run both in one app.
• Sessions and the STATELESS policyControl when a session is created, protect it from fixation, and know what STATELESS really does.
• Roles vs authoritiesStop guessing about the ROLE_ prefix and model permissions in a way that scales.
• Method security with @PreAuthorizeEnforce rules on service methods, not just URLs, and avoid the proxy traps that silently skip them.
• CSRF: when it mattersDecide correctly whether to keep CSRF protection on, and wire the token for forms and SPAs.
• CORS done rightConfigure cross-origin access in the security chain so preflight requests stop failing.
• Issuing a JWTMint signed tokens with the built-in Nimbus encoder and choose sane claims and lifetimes.
• Validating JWTs on every requestAccept bearer tokens with the built-in resource server instead of writing a custom filter.
• OAuth2 and OIDC in one pageSeparate delegated access from login, and know which Spring Security role your app is playing.
• Misconfigurations that biteRecognise the handful of mistakes behind most Spring Security bugs and security holes.
• How a login is actually verifiedFollow a username and password from the login filter into ProviderManager and back out again.
• Carrying the user across threadsSee why @Async and a plain new Thread lose the current user, and how to hand the context over.
• Anonymous users and permitAllUnderstand why the context is never empty on a permitAll route, and which check proves a real login.
• Entry point vs access denied handlerReturn clean JSON for 401 and 403 by plugging in the two handlers ExceptionTranslationFilter calls.
• Testing a secured endpointMake MockMvc run the real filter chain, then drive it with mock users, JWTs and CSRF tokens.
• Security headers and HTTPSKnow the headers Spring Security already sends, the ones you must add, and how to force HTTPS.
• Brute force, lockout and auth eventsCount failed logins with Spring Security events and lock an account before an attacker guesses it.
• The authorization code flow, hop by hopFollow a browser through redirect, code and token exchange, and see what PKCE actually protects.
• Refresh tokens and rotationKeep access tokens short without hourly logins, and detect a refresh token that has been stolen.
• Owner-only rules with a guard beanExpress "only the owner may edit this row" without copying the check into every controller method.
• Several filter chains in one applicationA stateless API and a session-backed UI need different rules, and order decides which applies.
• Validating a JWT properlyThe checks that are easy to skip, and what each one lets an attacker do.
• How authentication actually resolvesAuthenticationManager, ProviderManager and the delegation chain behind a login.
• Session fixation, concurrency and remember-meThe session controls that matter, and the cookie flags that do the real work.
• Beyond roles: attribute and domain-object authorizationWhen hasRole stops being enough, and how to express "only their own orders".
• A review checklist that finds real holesThe handful of settings that account for most production security incidents.