Security Fundamentals

Security is a system property. Adding a filter chain cannot compensate for an undefined trust boundary, exposed secrets, or missing authorization rules.

Authentication and authorization

• Authentication establishes an identity or principal.
• Authorization decides whether that principal may perform an action on a resource.

Spring Security's servlet support operates through filters. The security context represents the current authenticated principal and authorities. Apply request-level and method-level authorization intentionally; neither should rely only on hiding UI controls.

@Bean
SecurityFilterChain apiSecurity(HttpSecurity http) throws Exception {
    return http
            .authorizeHttpRequests(authorize -> authorize
                    .requestMatchers(HttpMethod.GET, "/books/**").permitAll()
                    .anyRequest().authenticated())
            .httpBasic(Customizer.withDefaults())
            .build();
}

This is an educational minimum, not a universal production policy.

Web threats

• Use CSRF protection for browser requests authenticated by automatically sent credentials unless the architecture justifies and safely configures another policy.
• CORS controls which browser origins may read responses; it is not authentication.
• Encode untrusted output for its destination context to prevent injection.
• Use parameterized database access, strict input handling, and least privilege.
• Set secure transport, cookie, and response-header policies.

Credentials and tokens

Store passwords using an adaptive one-way password hashing function through an appropriate encoder; do not encrypt passwords for later recovery. Rotate and scope secrets, keep them out of source control and logs, and prefer a managed secret store.

A signed JWT is not encrypted by default. Validate issuer, audience, signature, time claims, accepted algorithms, and authorization semantics. Plan revocation, key rotation, clock skew, and token lifetime before choosing stateless tokens.

Avoid revealing whether a protected identifier exists when disclosure itself is sensitive. Log security events without logging credentials or complete tokens.

See the official Spring Security architecture.