Spring Security

Every later chapter assumes you already know what a Filter is and why authentication and authorization are two different questions. This chapter is that foundation, built from zero prior security knowledge.

Spring Security is implemented entirely as a chain of servlet filters. This chapter is that chain — what gets added the moment you include the starter, and the exact order requests flow through it.

Every authentication flow eventually needs to answer one question: who is this user, really? This chapter is UserDetailsService and UserDetailsManager — the mechanism Spring Security uses to look that up.

"Just hash the password" hides three genuinely different techniques with very different security properties. This chapter is why only one of the three (hashing) is ever correct for passwords.

The default DaoAuthenticationProvider covers the common case. This chapter is what to do when authentication needs custom logic — and how to handle it cleanly when authentication fails.

Session-based auth has its own failure modes that token-based auth simply doesn't share. This chapter is timeout, concurrent-session limits, and fixation attacks — and why REST APIs usually skip sessions entirely.

A frontend on one origin calling a backend on another is normal in modern architectures, and browsers block it by default. This chapter is what "origin" actually means and how to correctly unblock it.

CSRF protection is on by default in Spring Security for a specific reason tied to cookies — and disabling it globally to "fix" a 403 is one of the most common security regressions teams introduce.

Authentication answers who you are. This chapter is authorization — roles, authorities, and how Spring Security actually decides what an authenticated user is allowed to do.

Session cookies don't scale cleanly across load-balanced servers or mobile clients. This chapter is JWT — a self-contained, signed token that carries identity without server-side session state.

URL-level authorization stops at the controller. This chapter is @PreAuthorize, @PostAuthorize, and filtering collections — enforcing rules at the exact method (or even list-of-results) level.

"Login with Google" looks like one button but hides a specific, standardized protocol with four distinct actors. This chapter is OAuth2 and OpenID Connect, precisely.

A single microservice validating its own users doesn't scale to ten microservices. This chapter is centralizing authentication with Keycloak (or your own Spring Authorization Server) across a whole system.

Every prior chapter built one mechanism correctly in isolation. This closing chapter maps those mechanisms onto the OWASP API Security Top 10 and the real mistakes teams actually ship to production.