Handbooks / Spring Boot / Chapter 7

Spring Security

7 pages · ~4 min✓ Reviewed

Builds on Database Migrations. Next up: Caching, Async and Scheduling.

Spring BootPage 1

Filter Chain and Auth Model

1. The Filter Chain

DelegatingFilterProxyservlet filter
FilterChainProxySpring Security entry
SecurityFilterChainfirst match wins

Key filters, in order

1SecurityContextHolderFilter
2CorsFilter
3CsrfFilter
4Authentication filterUsernamePasswordAuthenticationFilter or custom JWT filter
5AuthorizationFilteralways last

2. Authentication vs Authorization

	Authentication	Authorization
Asks	Who are you?	What may you do?
Failure	401 Unauthorized	403 Forbidden
When	missing or invalid credentials	authenticated but denied

3. Authentication Flow

Filterbuilds Authentication token
ProviderManagerAuthenticationManager
AuthenticationProviderUserDetailsService + PasswordEncoder
SecurityContextHolderstores the result

Thread-local gotcha

SecurityContextHolder is thread-local. Values do not reach new threads or async tasks unless a delegating strategy is configured.

Spring BootPage 2

SecurityFilterChain Configuration

1. The Chain Bean

Declare a @Bean SecurityFilterChain taking HttpSecurity
End the method with http.build()
WebSecurityConfigurerAdapter is removed in Spring Security 6

java

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  http.authorizeHttpRequests(a -> a
    .requestMatchers("/public/**").permitAll()
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .anyRequest().authenticated());
  return http.build();
}

Lambda DSL

2. Matching Rules

Rules match top to bottom, first match wins
Put specific matchers before broader ones
Finish with anyRequest()

Spring BootPage 3

Password Encoding

1. Why Hash, and With What

Never store plain text or fast hashes (MD5, SHA-1)
Use an adaptive salted hash via PasswordEncoder
Two methods: encode(raw) and matches(raw, stored)

Encoder	Notes
`BCryptPasswordEncoder`	Standard bean; strength 10; salt inside the hash
`Argon2PasswordEncoder`	Memory-hard alternative
`SCryptPasswordEncoder`	Memory-hard alternative

2. Delegating Encoder

Spring BootPage 4

JWT Stateless Authentication

1. JWT Anatomy

header.payload.signature, each part Base64URL
Signed, not encrypted: anyone can read the payload
Claims: sub, exp, iat, roles
Never put secrets in the payload

2. Login and Filter Flow

Stateless: STATELESS session policy, CSRF disabled for token-only APIs
Login calls AuthenticationManager.authenticate(UsernamePasswordAuthenticationToken)
Returns a signed token with a short exp

Loginauthenticate()
Signed JWTshort exp
Bearer headerevery request
JWT filterOncePerRequestFilter
SecurityContextHolderAuthentication set

Spring BootPage 5

Method Security, CORS and CSRF

1. Method Security

@EnableMethodSecurity replaces @EnableGlobalMethodSecurity
@PreAuthorize checks before the method; @PostAuthorize checks after it
SpEL sees arguments and principal: owner-only access
Proxy-based: self-invocation is not checked

java

@PreAuthorize("hasRole('ADMIN')")
void purge() { }
@PreAuthorize("#id == authentication.principal.id")
User get(Long id) { }

second rule: owner-only access

2. CORS vs CSRF

	CORS	CSRF
Is	browser rule, response headers	token on POST/PUT/DELETE

Spring BootPage 6

Security Cheat Sheet

1. Status Codes and Config

Check	Means
401	not authenticated
403	authenticated but forbidden
`hasRole('X')`	authority `ROLE_X`
`hasAuthority('X')`	the exact string

java

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  http.authorizeHttpRequests(a -> a
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .anyRequest().authenticated());
  return http.build();
}

order rules specific to general

2. Passwords and JWT

Spring BootPage 7

Check yourself

Rules are /api/** authenticated, then /api/public/** permitAll. An anonymous user calls /api/public/ping. Result?

Blocked: login required.
First match wins, so the broad rule catches it.
Put the specific matcher first.

Each encode adds a fresh salt, so the strings differ.
Use encoder.matches(raw, stored).

A browser shows a CORS error on POST. The network tab shows the OPTIONS preflight got 401. Fix?

Security rejected the credential-less preflight.
Enable http.cors(withDefaults()) with a CorsConfigurationSource bean.

Call	Checks authority
`hasRole("ADMIN")`	`ROLE_ADMIN`
`hasAuthority("ROLE_ADMIN")`	exact string `ROLE_ADMIN`

Spring Security

Filter Chain and Auth Model

1. The Filter Chain

2. Authentication vs Authorization

3. Authentication Flow

SecurityFilterChain Configuration

1. The Chain Bean

2. Matching Rules

Password Encoding

1. Why Hash, and With What

2. Delegating Encoder

JWT Stateless Authentication

1. JWT Anatomy

2. Login and Filter Flow

Method Security, CORS and CSRF

1. Method Security

2. CORS vs CSRF

Security Cheat Sheet

1. Status Codes and Config

2. Passwords and JWT

Check yourself

3. Multiple Chains

3. Checking a Password

4. Gotcha

3. Trade-offs

3. Mistakes

3. Method, CORS, CSRF