---
title: "Spring Security"
chapter: "10"
---

# Spring Security

Spring Security handles authentication, authorization, common web protections,
and security context propagation.

## Authentication and authorization

Authentication asks “who are you?” Authorization asks “may you do this?”
For browser sessions, protect login, session fixation, CSRF, cookies, and
logout. For APIs, validate OAuth 2.0/OIDC tokens as a resource server and
authorize scopes/claims plus business ownership.

## Filter chain

Web security runs through a `SecurityFilterChain`. Define request rules
explicitly and keep a deny-by-default mindset. Method security with
`@EnableMethodSecurity` can protect business operations, but it should
complement—not replace—HTTP rules.

## Passwords and tokens

Store passwords only with an adaptive one-way password encoder. Never log
passwords or bearer tokens. Validate token issuer, audience, signature, expiry,
and intended use.

## CSRF and CORS

CSRF matters when browsers automatically attach credentials such as cookies.
Do not disable it blindly. CORS is a browser cross-origin rule, not
authentication. Allow only required origins, methods, and headers.

## Actuator

Expose only required management endpoints, preferably on a controlled path or
network. Health detail, environment, mappings, heap dumps, and loggers can leak
information or change behavior.

## Feynman check

The filter chain is airport security. Authentication checks the passport.
Authorization checks the boarding pass. CORS decides which airport entrances a
browser may use; it does not prove identity.