6.1 Security Architecture & Filter Chain

← Back to Chapter 6: Spring Security & Authentication

Spring Security provides authentication, authorization, and protection against exploits (such as CSRF and session fixation). Its foundational architecture operates as a chain of servlet filters.

---

Authentication vs Authorization

Authentication

Authentication means: Who are you?

Authorization

Authorization means: What are you allowed to do?

• Authentication (AuthN): "Who are you?" Validates identity using credentials (passwords, JWTs, API keys, OAuth2 tokens). Produces an Authentication principal.
• Authorization (AuthZ): "What are you allowed to do?" Determines whether the authenticated principal has permission to access the requested resource or method (ROLE_ADMIN, order:write).

Authentication Flow

A simple username/password flow looks like this:

Client
  |
  | username + password
  v
Spring Security
  |
  v
AuthenticationManager
  |
  v
AuthenticationProvider
  |
  v
UserDetailsService
  |
  v
Database

Database returns user information.

Filter Chain Architecture

Servlet containers maintain a native filter chain. Spring bridges this standard servlet environment to the Spring IoC container using DelegatingFilterProxy:

[ Inbound HTTP Request ]
          │
          ▼
[ Standard Servlet Filters ]
          │
          ▼
┌──────────────────────────────────────────────────────────┐
│ DelegatingFilterProxy (Standard Servlet Filter)          │
│ └── Delegates execution to Spring-managed bean:          │
│     FilterChainProxy (springSecurityFilterChain)         │
└───────────────────────────┬──────────────────────────────┘
                            │
                            ▼
┌──────────────────────────────────────────────────────────┐
│ SecurityFilterChain (List of Security Filters)           │
│  1. HeaderWriterFilter (Adds security headers)           │
│  2. CorsFilter (Handles CORS preflight OPTIONS)          │
│  3. CsrfFilter (CSRF token verification)                 │
│  4. JwtAuthenticationFilter (Custom token parser)        │
│  5. UsernamePasswordAuthenticationFilter                 │
│  6. SecurityContextHolderFilter                          │
│  7. AuthorizationFilter (Enforces URL path permissions)   │
└───────────────────────────┬──────────────────────────────┘
                            │
                            ▼
               [ DispatcherServlet ]

---

The Core Security Abstractions

AuthenticationManager (authenticate())
          │ delegates to
ProviderManager
          │ tries list of
AuthenticationProvider (e.g. DaoAuthenticationProvider)
          │ loads user via
UserDetailsService (loadUserByUsername())
          │ compares password with
PasswordEncoder (matches(raw, encoded))

1. SecurityContextHolder: Holds the SecurityContext for the current execution thread (by default via ThreadLocal).
2. SecurityContext: Stores the current Authentication object.
3. Authentication: Contains the principal (user identity), credentials, and granted authorities (Collection<? extends GrantedAuthority>).
4. AuthenticationManager: The API defining how Spring Security filters execute authentication.

AuthenticationManager

AuthenticationManager is responsible for performing authentication.

Spring Security, please authenticate this username and password.

AuthenticationProvider

AuthenticationProvider actually knows how to authenticate a particular type of authentication.

For username/password authentication, Spring commonly uses:

DaoAuthenticationProvider

UserDetailsService

UserDetailsService is responsible for loading a user.

@Service
public class CustomUserDetailsService
        implements UserDetailsService {

    @Override
    public UserDetails loadUserByUsername(String username) {

        // Fetch user from database

        return User.builder()
                .username(username)
                .password("$2a$10$...")
                .roles("USER")
                .build();
    }
}

UserDetails

UserDetails represents authenticated user's information.

PasswordEncoder

Never store passwords as plain text.

Spring provides:

PasswordEncoder

A common implementation is:

BCryptPasswordEncoder

Why BCrypt?

BCrypt is designed for password hashing.

It is intentionally computationally expensive compared with simple hashing.