01
Foundations
What Spring Security does and how its pieces fit together.
Free Spring Security Course
Spring Security Tutorial
Spring Security is the standard framework for protecting Spring applications. It checks who is calling your application and what they are allowed to do, and it defends against common web attacks before a request reaches your code. This Spring Security tutorial takes you from the filter chain to JWT, OAuth2 and interview-ready design decisions.
- Security filter chain
- Authentication
- JWT and OAuth2
- Roles and method security
What Is Spring Security?
Spring Security is a Spring project that handles login, access control and protection against attacks such as cross-site request forgery. Add the starter to a Spring Boot application and every endpoint immediately requires a login, using a default user and a password printed in the startup log. From there, you replace those defaults with your own rules and user store.
Spring Boot starterspring-boot-starter-security
Current lineSpring Security 7
Runs onSpring Boot 4, Java 17+
Works throughServlet filters
Authentication vs Authorization
This is the first distinction to get right, and a favourite opening question in interviews. Picture a hotel: showing your ID at the front desk is authentication, and your key card opening only your own room is authorization.
| Authentication | Authorization | |
|---|---|---|
| Question | Who are you? | What may you do? |
| Happens | First | After identity is known |
| Typical input | Password, token or certificate | Roles, authorities and rules |
| Failure over HTTP | 401 Unauthorized | 403 Forbidden |
What You Will Learn
- How the security filter chain handles a request
- Authenticating users from your own data
- Storing passwords safely
- Protecting URLs with access rules
- Building stateless APIs with JWT
- Signing in with OAuth2
- Securing service methods with annotations
- Answering common security interview questions
Who this is for
Java developers securing their first application, Spring Boot and microservices engineers with 3 to 15 years of experience, and anyone preparing for product-company interviews.
Prerequisites
Core Java, basic HTTP and some Spring Boot. New to Spring Boot? Begin with the Spring Boot tutorial.
How Spring Security Works
Spring Security sits in front of your controllers as a chain of servlet filters. Each filter has one job: one reads credentials, another stores the signed-in user in the SecurityContext, and a later one applies your access rules. A request that fails is rejected there, so it never reaches your business code.
Callers
Browser
Mobile app
Other services
Spring Security
SecurityFilterChain
Authenticatewho?
Contextstore user
Authorizeallowed?
Your App
Controller
Service
Database
Core Spring Security Components
You will meet these names in every tutorial and most interviews.
| Component | What it does |
|---|---|
SecurityFilterChain | The bean where you declare the rules for incoming requests. |
AuthenticationManager | Entry point that verifies a login attempt. |
UserDetailsService | Loads a user by username, often from your database. |
PasswordEncoder | Hashes passwords and checks them at login. |
SecurityContextHolder | Gives your code access to the current signed-in user. |
AuthorizationManager | Decides whether the current user may proceed. |
Version note: WebSecurityConfigurerAdapter was removed in Spring Security 6, so older tutorials that extend it no longer work. In Spring Security 7, rules are written in the lambda style, as in http.csrf(csrf -> ...).
Spring Security Learning Path
Follow the tracks in order, or jump to the topic you need. Every link below is a published tutorial.
02
Identity and Access
Separate proving who a user is from deciding what they may do.
03
Tokens and Login
Secure stateless APIs and sign users in through other providers.
04
Method Security
Protect service methods, not only URLs.
05
Beyond One Service
Apply security at the edge and across your APIs.
Common Security Mistakes
These errors appear in real code reviews and make good interview discussions.
Disabling CSRF Blindly
CSRF protection is on by default. Turning it off suits stateless token APIs, but not applications that sign in with session cookies.
Secrets in a JWT
A standard signed JWT can be read by anyone holding it. Never put passwords or private data in its payload.
Wrong Rule Order
URL rules are checked from the top and the first match wins. Put specific paths before general ones.
Hiding Is Not Securing
Hiding a button in the UI protects nothing. Enforce every permission on the server as well.
Preparing for interviews? Continue with our Spring Boot interview questions.
Start Learning Spring Security
Good security comes from understanding the request path, not from copying configuration. Work through this Spring Security tutorial track by track, starting with the architecture, then move on to JWT and method-level security as your applications grow.
Was this tutorial helpful?