Why Spring Security and How It Works

What Spring Security gives you

Spring Security is the standard framework for securing Spring applications. It handles the hard, easy-to-get-wrong parts of security – login, session management, password hashing, protection against CSRF and common attacks, and fine-grained access control – so you do not build them yourself.

Authentication vs authorization

Two words that sound alike but mean different things, and every security discussion depends on the distinction:

• Authentication – who are you? Verifying identity, e.g. checking a username and password.
• Authorization – what are you allowed to do? Deciding whether an authenticated user may access a resource.

The filter chain

Spring Security works as a chain of servlet filters that every request passes through before reaching your controller. Each filter has one job – read the session, check a token, enforce authorization – and can stop the request early (for example, redirecting an anonymous user to the login page).

The core objects

• SecurityFilterChain – the bean where you declare your rules.
• AuthenticationManager – verifies credentials.
• UserDetailsService – loads a user (and their roles) by username.
• SecurityContext – holds the authenticated user for the duration of the request.

Key points

• Spring Security provides login, password hashing, attack protection and access control.
• Authentication proves identity; authorization decides permissions.
• Requests flow through a chain of single-purpose filters before your controller.
• You configure security by defining a SecurityFilterChain bean.