What is Spring Security?

Spring Security is a mature, open-source framework for handling authentication and authorization in Java applications. It provides a flexible, extensible security foundation for web apps, REST APIs, and enterprise systems.

Key Features#

Authentication: Supports form login, HTTP Basic, OAuth 2.0 / OIDC, JWTs, and custom providers. Integrates with databases, LDAP/Active Directory, and external identity providers.
Authorization: Fine-grained access control via annotations (e.g., @PreAuthorize), URL rules, and policy-based checks.
Security Filter Chain: A customizable chain that inspects and enforces security on incoming HTTP requests.
Remember-Me: Persistent login tokens for long-lived sessions.
CSRF Protection: Built-in defenses against Cross-Site Request Forgery using request tokens.
Auditing & Events: Security events, logging hooks, and integration points for monitoring and compliance.

In short: Spring Security reduces boilerplate and centralizes security concerns so you can focus on application logic.

Common Use Cases#

Web applications: User login, session management, and URL-based access control.
REST APIs: Token-based security with JWTs, OAuth 2.0 resource servers, and stateless authentication.
Single Sign-On (SSO): Integration with Keycloak, Okta, CAS, and other identity providers.
Enterprise directories: Authentication against LDAP or Active Directory for centralized user management.

Quick Implementation Guide#

Below are concise steps to get started and a modern configuration example.

1) Add the dependency#

Maven:

1
<dependency>
2
  <groupId>org.springframework.boot</groupId>
3
  <artifactId>spring-boot-starter-security</artifactId>
4
</dependency>

Gradle:

1
implementation 'org.springframework.boot:spring-boot-starter-security'

2) Configure security (modern approach)#

In recent Spring Security versions, WebSecurityConfigurerAdapter is deprecated. Use a SecurityFilterChain bean and configure HTTP security with HttpSecurity.

1
@Configuration
2
public class SecurityConfig {
3

4
  @Bean
5
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
6
    http
7
      .csrf().and()
8
      .authorizeHttpRequests(auth -> auth
9
        .requestMatchers("/public/**", "/login", "/css/**").permitAll()
10
        .anyRequest().authenticated())
11
      .formLogin(form -> form.loginPage("/login").permitAll())
12
      .logout(logout -> logout.logoutUrl("/logout").permitAll());
13

14
    return http.build();
15
  }
16

17
}

What this does:

Allows unauthenticated access to /public/** and the custom login page.
Requires authentication for all other endpoints.
Configures form-based login and logout handling.

If you prefer the older style (pre-deprecation) you’ll still find WebSecurityConfigurerAdapter examples, but favor the SecurityFilterChain approach for new projects.

3) Load users from a database#

Implement UserDetailsService (or use JdbcUserDetailsManager / UserDetailsManager) to load credentials and authorities from your data store.

1
@Service
2
public class CustomUserDetailsService implements UserDetailsService {
3
  @Override
4
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
5
    // Lookup user, map roles to GrantedAuthority, return a UserDetails instance
6
  }
7
}

Register a password encoder (e.g., BCryptPasswordEncoder) and wire the UserDetailsService into authentication configuration.

4) Protect endpoints and methods#

Use URL rules and method-level annotations like @PreAuthorize("hasRole('ADMIN')") to enforce role-based access.

5) Test and validate#

Verify public endpoints are accessible without authentication.
Test authenticated flows, role restrictions, and corner cases (expired tokens, invalid sessions).
Inspect logs and enable Spring Security debugging (DebugFilter) when troubleshooting.

Best Practices#

Use BCryptPasswordEncoder or another modern password encoder for stored credentials.
Prefer stateless JWTs for scalable APIs, but keep token lifetimes and revocation strategies in mind.
Centralize security configuration and avoid sprinkling authorization logic throughout business code.
Keep dependencies and Spring Security versions up to date to receive security fixes and improvements.

Conclusion#

Spring Security is a robust, flexible toolkit that handles authentication and authorization across a wide range of application architectures. Start with the spring-boot-starter-security dependency and a SecurityFilterChain configuration, then iterate by adding custom UserDetailsService, JWT or OAuth support, and method-level protections as your application’s needs grow.

If you want, I can also add an example for JWT-based stateless authentication or an OAuth2 resource-server configuration. Would you like one of those next?