Spring Boot Security
22 lessons in this section of the Spring Boot tutorial. Work through them in order, or jump to the one you need.
- 1.Spring Security Basics
Spring Security is the standard security framework for Spring Boot applications.
- 2.Authentication
Authentication is the process of verifying who a user is.
- 3.Authorization
Authorization decides what an authenticated user may do.
- 4.UserDetailsService
UserDetailsService is the core Spring Security interface for loading user data during authentication.
- 5.Password Encoding
Spring Security's PasswordEncoder interface abstracts password hashing.
- 6.BCryptPasswordEncoder
BCryptPasswordEncoder is Spring Security's bcrypt implementation of PasswordEncoder.
- 7.Role-Based Access
Spring Security models access control as GrantedAuthority strings: a role is just an authority with a ROLE_ prefix.
- 8.JWT Authentication
Step-by-step JWT authentication for Spring Boot 3 and Spring Security 6 REST APIs using JJWT 0.12: access token generation, an OncePerRequestFilter, refresh token…
- 9.OAuth2
How OAuth2 works in a Spring Boot 3 application: the four roles, the grant types worth using, and the two roles you will actually build.
- 10.OAuth2 Login
Add Google, GitHub or Keycloak login to Spring Boot with spring-boot-starter-oauth2-client: setup, OAuth2 vs OIDC user services, account mapping, logout, SPA setup and…
- 11.Social Login
Social login with Spring Security OAuth2 Client: how the authorization code flow works, setting up Google (OIDC) and GitHub (plain OAuth2), why each needs its own user…
- 12.Google Login
Google sign-in is OpenID Connect (OIDC) layered on OAuth2, and Spring Boot ships a ready-made Google provider, so a working login needs only a client id and secret.
- 13.GitHub Login
Add GitHub login to a Spring Boot 3 application with Spring Security's oauth2Login.
- 14.Session Management
Configure session management in Spring Boot 3 and Spring Security 6: SessionCreationPolicy, session fixation protection, concurrent session limits, secure cookies…
- 15.CSRF Protection
CSRF (Cross-Site Request Forgery) is an attack where a malicious site tricks a user's browser into making an authenticated request to your application.
- 16.CORS Configuration
CORS errors in a Spring Boot project almost always show up the first time a React, Angular or Vite frontend on localhost:3000 calls an API on localhost:8080, and they…
- 17.Security Filters
Spring Security is a chain of servlet filters that every request passes through before it reaches a controller.
- 18.Method Level Security
Method level security enforces authorization on service methods with annotations, independent of how the method is reached (HTTP, a scheduled job, a message listener).
- 19.Security Configuration
Spring Security configuration centres on the SecurityFilterChain bean.
- 20.Stateless Authentication
Stateless authentication eliminates server-side session storage — every request carries all the information needed to authenticate it.
- 21.Refresh Tokens
Refresh tokens enable long-lived authentication without storing long-lived access tokens.
- 22.API Security Best Practices
Securing a REST API requires defence in depth across multiple layers.