Chapter 6: Spring Security & Authentication

Securing modern enterprise services requires deep knowledge of Spring Security's filter chain architecture, Spring Security 6 functional lambda configuration, stateless JWT validation, fine-grained role-based method authorization, and cryptographic password hashing.

---

🧭 Subtopics & Curriculum

Click anywhere on a topic card below to open that subtopic note, or use the Obsidian button to open it directly in the Obsidian app:

Filter Chain Internals6.1

🔐

6.1 Security Architecture & Filter Chain

• Authentication vs Authorization
• Authentication Flow
• Filter Chain Architecture
• The Core Security Abstractions
  • AuthenticationManager
  • AuthenticationProvider
  • UserDetailsService
  • UserDetails
  • PasswordEncoder
  • Why BCrypt?

🔮 Open in Obsidian

Modern DSL6.2

⚡

6.2 Modern Security Configuration

• 1. Component-Based SecurityFilterChain
• 2. CORS (Cross-Origin Resource Sharing)
• 3. Why Disable CSRF in Stateless REST APIs?

🔮 Open in Obsidian

Stateless Auth6.3

🎟️

6.3 JWT Stateless Authentication

• 1. Structure of a JWT
• 2. The Custom JwtAuthenticationFilter
• 3. Access Token vs Refresh Token Strategy

🔮 Open in Obsidian

Access Control6.4

🛡️

6.4 Role-Based & Method Security

• 1. Roles vs Authorities
• 2. Declarative Method-Level Security
  • Powerful SpEL (Spring Expression Language) Annotations:
• 3. Filtering Collections with @PreFilter & @PostFilter

🔮 Open in Obsidian

Credential Security6.5

🔑

6.5 Password Hashing & UserDetailsService

• 1. PasswordEncoder & BCrypt
  • Why BCrypt is Industry Standard:
• 2. Implementing UserDetailsService & UserDetails
  • 1. The Domain User Entity
  • 2. Loading User From Database

🔮 Open in Obsidian