Lesson 6 of 8Article20 min
Spring Security Basics
Authentication answers who the user is. Authorization answers what the user can access. Spring Security filters enforce both before your controller runs.
01Authentication and authorization
Authentication answers who the user is. Authorization answers what the user can access. Spring Security filters enforce both before your controller runs.
02Minimal security config
Route-level restrictions
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
return http
.csrf(csrf -> csrf.disable())
.authorizeHttpRequests(auth -> auth
.requestMatchers("/api/public/**").permitAll()
.anyRequest().authenticated()
)
.httpBasic(Customizer.withDefaults())
.build();
}
}