Spring Security

What is Spring Security, Architecturally?

Spring Security is a chain of Filters — plain Servlet filters, the same mechanism covered in HTTP Protocol & Methods and contrasted with Spring's own interceptors in Spring MVC — inserted in front of your application via a single DelegatingFilterProxy. That proxy delegates to a FilterChainProxy, which holds an ordered list of SecurityFilterChain beans, each guarding a set of URL patterns. The first chain whose pattern matches the request wins — everything inside it (authentication, CSRF, authorization decisions) runs before the request ever reaches DispatcherServlet.

Setup and the Default Behaviour

<!-- pom.xml -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

The Authentication Flow — What Actually Happens

/*
 *  Login request ──▶ UsernamePasswordAuthenticationFilter
 *                              │  builds an unauthenticated Authentication (username + password)
 *                              ▼
 *                    AuthenticationManager
 *                              │  delegates to the first AuthenticationProvider that supports it
 *                              ▼
 *                    DaoAuthenticationProvider
 *                              │  1. UserDetailsService.loadUserByUsername(username)
 *                              │  2. PasswordEncoder.matches(rawPassword, storedHash)
 *                              ▼
 *                    Authenticated Authentication object
 *                              │  (principal + authorities, password discarded)
 *                              ▼
 *                    SecurityContextHolder.getContext().setAuthentication(...)
 *                              │  stored for the rest of THIS request (and the session, if any)
 */

Every piece here is replaceable independently. Provide your own UserDetailsService to load users from a database instead of memory; the AuthenticationManager/DaoAuthenticationProvider machinery around it stays exactly the same. This is why a custom database-backed UserDetailsService, further down, plugs in without touching anything else in the configuration.

Session-Based Configuration (Form Login)

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Order matters: rules are evaluated top to bottom, first match wins.
                // A specific /admin/** rule AFTER a catch-all anyRequest() would never run.
                .requestMatchers("/public/**", "/login").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
                .permitAll()
            );
            // CSRF stays ENABLED here — the default, and correct, for a session-based app

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

UserDetailsService — Where Users Actually Come From

In-memory (testing only)

@Bean
public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
    UserDetails user = User.builder()
        .username("user")
        .password(passwordEncoder.encode("password"))
        .roles("USER")
        .build();

    return new InMemoryUserDetailsManager(user);
}

Database-backed (real applications)

@Service
public class CustomUserDetailsService implements UserDetailsService {

    private final UserRepository userRepository;

    public CustomUserDetailsService(UserRepository userRepository) {
        this.userRepository = userRepository;
    }

    @Override
    public UserDetails loadUserByUsername(String username) {
        AppUser appUser = userRepository.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException("User not found: " + username));

        // stored password is ALREADY a BCrypt hash — never re-encode it here
        return org.springframework.security.core.userdetails.User.builder()
            .username(appUser.getUsername())
            .password(appUser.getPassword())
            .authorities(appUser.getRoles().stream()
                .map(r -> new SimpleGrantedAuthority("ROLE_" + r.getName()))
                .toList())
            .disabled(!appUser.isEnabled())
            .build();
    }
}

Stateless Configuration (JWT) — a Genuinely Different Shape, Not a Variant

A REST API with no server-side session needs a different SecurityFilterChain altogether — not the form-login one from Section 3 with a filter bolted on. Pick one shape per application, not both.

@Configuration
@EnableWebSecurity
public class JwtSecurityConfig {

    private final JwtAuthenticationFilter jwtAuthFilter;

    public JwtSecurityConfig(JwtAuthenticationFilter jwtAuthFilter) {
        this.jwtAuthFilter = jwtAuthFilter;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)  // see the warning below BEFORE copying this line
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS))  // no HttpSession is ever created
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

// The filter's only job: read the header, validate the token, populate SecurityContext.
// Token issuing/validation logic (JwtService) is covered on the dedicated JWT page.
@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;
    private final UserDetailsService userDetailsService;

    public JwtAuthenticationFilter(JwtService jwtService, UserDetailsService userDetailsService) {
        this.jwtService = jwtService;
        this.userDetailsService = userDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
                                     FilterChain filterChain) throws ServletException, IOException {

        String authHeader = request.getHeader("Authorization");
        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }

        String jwt = authHeader.substring(7);
        String username = jwtService.extractUsername(jwt);

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = userDetailsService.loadUserByUsername(username);
            if (jwtService.isTokenValid(jwt, userDetails)) {
                var authToken = new UsernamePasswordAuthenticationToken(
                    userDetails, null, userDetails.getAuthorities());
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        filterChain.doFilter(request, response);
    }
}

Method-Level Security

@Configuration
@EnableMethodSecurity
public class MethodSecurityConfig {}

@Service
public class UserService {

    @PreAuthorize("hasRole('ADMIN')")                              // checked BEFORE the method body runs
    public void deleteUser(Long id) { }

    @PreAuthorize("#userId == authentication.principal.id")          // can reference method parameters directly
    public User getProfile(Long userId) { ... }

    @PostAuthorize("returnObject.owner == authentication.name")        // checked AFTER — needs the return value to decide
    public Document getDocument(Long id) { ... }

    @PostFilter("filterObject.owner == authentication.name")         // filters the returned collection element-by-element
    public List<Document> getAllDocuments() {
        return documentRepository.findAll();
    }
}

Accessing the Current User

@RestController
public class ProfileController {

    // Preferred — resolved directly from SecurityContext by an argument resolver,
    // no manual lookup, works with your own UserDetails implementation too
    @GetMapping("/profile")
    public String getProfile(@AuthenticationPrincipal UserDetails user) {
        return "Hello, " + user.getUsername();
    }

    // Equivalent, framework-agnostic — Authentication implements java.security.Principal
    @GetMapping("/profile-principal")
    public String getProfileViaPrincipal(Principal principal) {
        return "Hello, " + principal.getName();
    }
}

CORS vs CSRF — Not the Same Problem

These get confused because both are three-letter acronyms about cross-origin requests, but they solve opposite problems. CORS is the browser relaxing its same-origin policy so your own frontend, on a different origin, is allowed to call your API. CSRF is a defence against a request the browser sends without the user's intent, triggered by a malicious third-party page. Configuring one has no effect on the other.

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration config = new CorsConfiguration();
    config.setAllowedOrigins(List.of("https://app.example.com"));  // never "*" if allowCredentials is true
    config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
    config.setAllowCredentials(true);

    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", config);
    return source;
}
// Wired in: http.cors(cors -> cors.configurationSource(corsConfigurationSource()))

Testing Secured Endpoints

@WebMvcTest(UserController.class)
class UserControllerSecurityTest {

    @Autowired private MockMvc mockMvc;

    @Test
    void deleteUser_asAdmin_succeeds() throws Exception {
        mockMvc.perform(delete("/admin/users/1").with(csrf()))
            .andExpect(status().isNoContent());
    }

    @Test
    @WithMockUser(roles = "USER")  // simulates an authenticated USER — no real login flow needed
    void deleteUser_asRegularUser_isForbidden() throws Exception {
        mockMvc.perform(delete("/admin/users/1").with(csrf()))
            .andExpect(status().isForbidden());
    }
}

Interview Questions