Spring Boot Security
22 lessons in this section of the Spring Boot tutorial. Work through them in order, or jump to the one you need.
- 1.Spring Security Basics
Spring Security is the standard security framework for Spring Boot applications.
- 2.Authentication
Authentication is the process of verifying who a user is.
- 3.Authorization
Authorization determines what an authenticated user is allowed to do.
- 4.UserDetailsService
UserDetailsService is the core Spring Security interface for loading user data during authentication.
- 5.Password Encoding
Spring Security's PasswordEncoder interface abstracts password hashing.
- 6.BCryptPasswordEncoder
BCryptPasswordEncoder is Spring Security's recommended PasswordEncoder.
- 7.Role-Based Access
Spring Security implements role-based access control (RBAC) through GrantedAuthority.
- 8.JWT Authentication
JSON Web Tokens (JWT) provide stateless authentication for REST APIs.
- 9.OAuth2
OAuth2 is the industry-standard authorization framework for delegating access to resources without sharing credentials.
- 10.OAuth2 Login
OAuth2 Login (also called Social Login) lets users sign in with an external identity provider — Google, GitHub, Facebook, Keycloak, or any OpenID Connect provider …
- 11.Social Login
Spring Security OAuth2 Client provides social login through the OAuth2 authorization code flow.
- 12.Google Login
Google login uses OpenID Connect (OIDC) on top of OAuth2.
- 13.GitHub Login
GitHub login uses OAuth2 (not OIDC) — there is no ID token.
- 14.Session Management
Spring Security manages HTTP sessions through HttpSessionSecurityContextRepository and SessionManagementFilter.
- 15.CSRF Protection
CSRF (Cross-Site Request Forgery) is an attack where a malicious site tricks a user's browser into making an authenticated request to your application.
- 16.CORS Configuration
CORS (Cross-Origin Resource Sharing) is a browser security mechanism that blocks JavaScript from making requests to a different origin (domain, port, or protocol) than…
- 17.Security Filters
Spring Security's filter chain is an ordered list of servlet filters that process every HTTP request before it reaches a controller.
- 18.Method Level Security
Method level security enforces authorization at the service layer using annotations on individual methods.
- 19.Security Configuration
Spring Security configuration centres on the SecurityFilterChain bean.
- 20.Stateless Authentication
Stateless authentication eliminates server-side session storage — every request carries all the information needed to authenticate it.
- 21.Refresh Tokens
Refresh tokens enable long-lived authentication without storing long-lived access tokens.
- 22.API Security Best Practices
Securing a REST API requires defence in depth across multiple layers.