Chapter 7.1☕ 16 min read

Spring Security Intro

When you put your app on the internet, Spring Security is the bouncer at the door.

01The Concept: Authentication vs Authorization

The HITEC City IT Park Security Analogy:

Imagine entering a massive IT park in HITEC City. There are two steps:

Authentication: The security guard checks your ID card at the main gate. They verify who you are. (Are you a real employee?)
Authorization: You try to enter Server Room B. The guard checks your ID card again, but this time checks your permissions. (Are you allowed in this specific room?) A regular developer is authenticated but not authorized to enter the server room.

Spring Security handles both. It intercepts every HTTP request, checks who you are, and checks if you are allowed to access that URL.

02Technical Explanation

SecurityFilterChain: In Spring Security 6, we don’t use WebSecurityConfigurerAdapter anymore. We define a @Bean of type SecurityFilterChain and configure rules using a lambda DSL.
authorizeHttpRequests: The modern way to define URL rules (replaces authorizeRequests).
requestMatchers: The modern way to match URLs (replaces antMatchers).

03Full Working Code: Basic Security Setup

First, add the Spring Security dependency to your pom.xml.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Here is the configuration to permit public APIs and secure the rest.

package com.devinhyderabad;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            // 1. Disable CSRF for REST APIs
            .csrf(csrf -> csrf.disable())
            
            // 2. Configure URL rules
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            
            // 3. Use HTTP Basic Authentication
            .httpBasic(httpBasic -> {});

        return http.build();
    }
}

If you try to access http://localhost:8080/api/public/hello, it works. If you access http://localhost:8080/api/secure/data, you get a 401 Unauthorized popup.

04Code Walkthrough

The code above defines a single SecurityFilterChain bean that configures all security rules:

CSRF Disabled: REST APIs don’t need CSRF protection (no browser-generated cookies). We disable it cleanly with lambda DSL.
URL Rules: requestMatchers (modern replacement of antMatchers) defines which URLs need authentication and which are public.
HTTP Basic: The browser popup login mechanism. Used here for simplicity; JWT replaces this in real apps.

05Why It Matters / Interview Note

Interview Question: “How has Spring Security configuration changed in Spring Boot 3 / Spring Security 6?”

Answer: The WebSecurityConfigurerAdapter was completely removed. We no longer override configure(HttpSecurity) methods. Instead, we define a SecurityFilterChain @Bean. Furthermore, methods like authorizeRequests() and antMatchers() were replaced with authorizeHttpRequests() and requestMatchers() to support the new lambda DSL and Servlet 6 APIs.

Enterprise Note: Basic Authentication (browser popup) is terrible for user experience and modern web apps. We use it only for internal tools or quick prototyping. For real frontends like Angular/React, we use JWT (JSON Web Tokens) or OAuth2, which we will cover in the next chapters.

Key Takeaways

✅ Authentication = who you are, Authorization = what you can do
✅ Spring Security 6 uses SecurityFilterChain @Bean (no WebSecurityConfigurerAdapter)
✅ authorizeHttpRequests() and requestMatchers() are the modern API
✅ CSRF is disabled for stateless REST APIs
✅ Basic Auth is for prototyping; real apps use JWT or OAuth2

PreviousSending Emails with Spring 📋 All Chapters Next ChapterPassword Encoding with BCrypt →