Spring Security

Introduction

Spring Security is the de-facto auth framework for Java backends. It provides filter chains for authentication, authorization, CSRF protection, session management and OAuth2/JWT integration out of the box.

Informative example

Security filter chain with JWT:

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated())
            .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
            .build();
    }
}

Best practices

• Never store passwords in plain text — use BCryptPasswordEncoder.
• Apply least privilege — default deny, explicitly permit.
• Keep security config in one @Configuration class per profile.

Purpose of this lesson

Master Spring Security so you can apply it confidently in production Java code, technical interviews, and code reviews.

Step-by-step explanation

1. Understand the core idea behind Spring Security.
2. Walk through the runnable example and tweak it in the playground.
3. Apply the pattern in a small Spring Boot or CLI exercise of your own.
4. Re-read the common mistakes and interview Q&A to lock the concept in.

Interactive workflow diagram

Debugging tips

• Read the full stack trace — Java's exception messages name the offending class and line.
• Reproduce in the smallest possible main() method before fixing in the real app.
• Use IntelliJ's debugger breakpoints and 'Evaluate Expression' rather than scattering System.out.

Optimization strategies

• Profile before optimizing — JFR (Java Flight Recorder) and async-profiler reveal real hotspots.
• Prefer immutable data and stream pipelines over hand-rolled loops when readability matters.
• Reach for the right JDK collection (ArrayList vs LinkedList vs ArrayDeque) before writing custom data structures.

Enterprise example

Auth0/Okta integrate via Spring Security OAuth2 Resource Server — JWT validated with JWK Set URI, no custom filter needed.

Interview questions & answers

Summary

In this lesson you learned Spring Security — the concept, syntax, a runnable example, and the production pitfalls to avoid. Apply it in the playground before moving on.