Spring Security Tutorial

What Spring Security gives you Spring Security is the standard framework for securing Spring applications. It handles the hard, easy-to-get-wrong parts of security – login, ...

Add the dependency Adding one starter secures the whole application immediately: Restart the app and every endpoint now requires login. Spring Boot generates a default user user ...

Never store plain passwords Passwords must be stored hashed , never in plain text. Spring Security’s BCryptPasswordEncoder applies a slow, salted hash designed to resist brute ...

URL-based authorization The most common rules protect whole sections of the app by path and role: hasRole("ADMIN") – requires ROLE_ADMIN . hasAnyRole(...) – any of several roles. ...

Why stateless Form login keeps a server-side session , which does not scale well across many servers and does not suit mobile or third-party API clients. The alternative is ...

Social login with OAuth2 Instead of managing passwords yourself, you can let users sign in with an existing account (Google, GitHub) via OAuth2 . Spring Security has first-class ...