Spring Security
Core architecture, authentication, authorization, SecurityFilterChain, and common Spring Boot patterns
1. What Spring Security does
Spring Security is a framework for authentication, authorization, protection against common web attacks, and
integration with application security mechanisms.
Authentication answers: who are you? Authorization answers: what are you allowed to do?
2. Core security objects
SecurityContext — holds the current security information for the executing request/thread context.
Authentication — represents the authenticated principal and its authorities.
GrantedAuthority — represents an authority/permission such as ROLE_ADMIN.
UserDetails — common abstraction describing a user for authentication.
AuthenticationManager — coordinates authentication.
PasswordEncoder — hashes and verifies passwords.
3. Authentication flow
HTTP Request
↓
Security filters
↓
Authentication mechanism
↓
AuthenticationManager
↓
AuthenticationProvider
↓
UserDetailsService / credential validation
↓
Authenticated Authentication
↓
SecurityContext
The exact filters and providers depend on the application's configuration.
4. SecurityFilterChain
In modern Spring Security, application web security is commonly configured using one or more SecurityFilterChain
beans.
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(auth -> auth
.requestMatchers("/public/**").permitAll()
.requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated()
)
.formLogin([Link]());
return [Link]();
}
5. Password hashing
Never store raw passwords. A PasswordEncoder hashes passwords and later verifies a supplied password against the
stored hash.
@Bean
PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
String hash = [Link](rawPassword);
boolean ok = [Link](rawPassword, hash);
6. Authorization
Authorization can be configured by URL rules or method security. Examples include
requestMatchers(...).hasRole("ADMIN") and method-level annotations such as @PreAuthorize when method security is
enabled.
@PreAuthorize("hasRole('ADMIN')")
public void deleteUser(long id) {
...
}
7. Stateless JWT pattern
For a REST API using JWT, a common design is stateless authentication: each request carries a token, a security filter
validates it, and the resulting Authentication is placed into the SecurityContext for that request.
Do not confuse JWT authentication with authorization. The token identifies/claims information about the principal;
authorization rules decide whether the principal may perform the operation.
8. CSRF and CORS
CSRF protects browser-based applications where credentials are automatically attached to requests, such as cookies.
Whether CSRF should be disabled depends on the application's authentication and browser threat model.
CORS controls which browser origins may make cross-origin requests. CORS is not an authentication mechanism.
9. Debugging checklist
Check which SecurityFilterChain matches the request.
Check whether the endpoint is permitAll or authenticated.
Check Authentication in the SecurityContext.
Check authorities and ROLE_ prefix expectations.
Check password encoding.
For JWT, check token extraction, validation, expiration, and authority mapping.
Use Spring Security debug logging when you need to see filter processing.