Spring Boot Tutorial 0/110 lessons ~6 min read Lesson 38“Production-grade backends”

Spring Security Introduction

Spring Security is the standard for authentication and authorization on the JVM.

Course progress0%

Focus

3 guided sections

Practice signal

Examples included

Career prep

Foundation builder

Introduction

Spring Security is the standard for authentication and authorization on the JVM. The moment you add the starter, every endpoint requires login by default — secure by default, opt out explicitly.

Understanding the topic

The mental model:

SecurityFilterChain — a stack of filters every request passes through.
AuthenticationManager — verifies credentials.
SecurityContext — holds the authenticated Principal per request.
AuthorizationManager — decides if the principal can hit this URL/method.

Informative example

Minimal security config in 2026 (Spring Security 6+):

@Configuration
@EnableWebSecurity
public class SecurityConfig {

  @Bean
  SecurityFilterChain api(HttpSecurity http) throws Exception {
    return http
        .csrf(CsrfConfigurer::disable)               // stateless API
        .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
        .authorizeHttpRequests(a -> a
            .requestMatchers("/api/v1/auth/**", "/actuator/health").permitAll()
            .requestMatchers("/api/v1/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated())
        .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
        .build();
  }
}

Ready to mark this lesson complete?Track your journey across the entire course.