Spring Security Basics

Authentication answers who the user is. Authorization answers what the user can access. Spring Security filters enforce both before your controller runs.

Authentication and authorization

Authentication answers who the user is. Authorization answers what the user can access. Spring Security filters enforce both before your controller runs.

Minimal security config

Route-level restrictions

@Configuration
@EnableWebSecurity
public class SecurityConfig {
  @Bean
  SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    return http
      .csrf(csrf -> csrf.disable())
      .authorizeHttpRequests(auth -> auth
        .requestMatchers("/api/public/**").permitAll()
        .anyRequest().authenticated()
      )
      .httpBasic(Customizer.withDefaults())
      .build();
  }
}