beginnerFoundations: What Is Security, and Why Should You Care?

Is Spring Security only for REST APIs, or also for traditional MVC apps?

Spring Security works for both. For server-rendered MVC/monolithic apps it supports formLogin() with server-side sessions and CSRF-protected forms. For stateless REST APIs consumed by SPAs or mobile apps, it supports stateless session management (SessionCreationPolicy.STATELESS) combined with JWT or OAuth2 bearer tokens, with CSRF typically disabled because there's no browser-managed session cookie to forge.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to Why is HTTP 401 sometimes confusingly called 'Unauthorized' when it's actually about authentication? →← Back to all Spring Security questions