Backend Technologies · Java
Spring Security — Free Learning Resources
Free, printable resources for Spring Security — practice problems, quick-reference cheatsheet, and an interview prep sheet. No sign-up required.
Spring Security — Practice Worksheet
Structured exercises and problems to build hands-on Spring Security skills. Work through key concepts step by step.
Spring Security — Cheatsheet
One-page quick-reference for Spring Security — key syntax, commands, patterns, and best practices at a glance.
Spring Security — Interview Sheet
Top Spring Security interview questions with concise answers. Get ready for any technical round with this focused prep sheet.
About Spring Security
Spring Security is the de-facto standard authentication and access-control framework for Spring applications. It provides comprehensive security services — HTTP security, OAuth2, JWT, method-level authorization, CSRF protection, and more — with a highly customizable filter-chain architecture.
Spring SecurityCheat Sheet — What's Covered
- ✓Security filter chain — ordering, custom filters, and override points
- ✓Authentication providers — UserDetailsService, DaoAuthenticationProvider
- ✓OAuth2 resource server and JWT validation configuration
- ✓Method security — @PreAuthorize, @PostAuthorize, @Secured
- ✓CSRF, CORS, session management, and secure headers
Frequently Asked Questions — Spring Security
How does the Spring Security filter chain work?
Spring Security installs a chain of servlet filters before your application code. Each filter handles a specific concern (authentication, CSRF, session, etc.). SecurityFilterChain bean lets you configure which URLs require authentication and which filters are active.
How do you implement JWT authentication in Spring Security?
Configure an oauth2ResourceServer().jwt() DSL in your SecurityFilterChain. Spring Security validates the JWT signature and expiry using a JwtDecoder bean. Extract claims with @AuthenticationPrincipal Jwt in your controllers.
What is the difference between authentication and authorization in Spring Security?
Authentication verifies who the caller is (username/password, token). Authorization decides what the authenticated user may do (@PreAuthorize, http.authorizeHttpRequests). Spring Security always authenticates first, then applies authorization rules.
How does @PreAuthorize work?
@PreAuthorize evaluates a SpEL expression before the method runs. Example: @PreAuthorize("hasRole('ADMIN') or #id == principal.id"). Enable it with @EnableMethodSecurity. The method is only called if the expression evaluates to true.
When should CSRF protection be disabled?
Disable CSRF only for stateless REST APIs consumed by non-browser clients (mobile apps, other services). Browser-based apps that use cookies must keep CSRF enabled. JWT-based APIs are stateless and do not use cookies, so CSRF is not applicable.
Who Is This For?
Spring developers who need to secure web applications or REST APIs with authentication, authorization, and protection against common web vulnerabilities.