Spring Security

Spring Security handles authentication, authorization, common web protections, and security context propagation.

Authentication and authorization

Authentication asks “who are you?” Authorization asks “may you do this?” For browser sessions, protect login, session fixation, CSRF, cookies, and logout. For APIs, validate OAuth 2.0/OIDC tokens as a resource server and authorize scopes/claims plus business ownership.

Filter chain

Web security runs through a SecurityFilterChain. Define request rules explicitly and keep a deny-by-default mindset. Method security with @EnableMethodSecurity can protect business operations, but it should complement—not replace—HTTP rules.

Passwords and tokens

Store passwords only with an adaptive one-way password encoder. Never log passwords or bearer tokens. Validate token issuer, audience, signature, expiry, and intended use.

CSRF and CORS

CSRF matters when browsers automatically attach credentials such as cookies. Do not disable it blindly. CORS is a browser cross-origin rule, not authentication. Allow only required origins, methods, and headers.

Actuator

Expose only required management endpoints, preferably on a controlled path or network. Health detail, environment, mappings, heap dumps, and loggers can leak information or change behavior.

Feynman check

The filter chain is airport security. Authentication checks the passport. Authorization checks the boarding pass. CORS decides which airport entrances a browser may use; it does not prove identity.