Understanding Spring Security Fundamentals
What is Web Security?
AuthN vs. AuthZ
Why Spring Security?
The Security Filter Chain
Request Flow: The Big Picture
AuthenticationManager
AuthenticationProvider
UserDetailsService Explained
UserDetails Interface
GrantedAuthority
SecurityContextHolder
The Authentication Process
The Authorization Process
Default Security Behavior
Recap: Core Concepts
Setting Up Spring Security in Spring Boot 3.x
Project Setup & Tools
Adding Security Dependency
Security's Default Behavior
Introducing SecurityFilterChain
Basic SecurityFilterChain
Lambda DSL for HttpSecurity
Disabling Default Security
Customizing Request Matchers
Understanding Auto-Config
Implementing In-Memory User Authentication
Why In-Memory Users?
The UserDetails Interface
The UserDetailsService
Setting Up In-Memory Users
Adding Multiple In-Memory Users
Password Encoding for In-Memory
Connecting to SecurityFilterChain
Testing In-Memory Login
Testing Invalid Credentials
User Details with Builder
Customizing User Details
In-Memory vs. Real-World
Common In-Memory Issues
Best Practices for In-Memory
Next Steps: Persistent Users
Configuring Form-Based Login
Form Login: The Basics
Enabling Form Login
Default Login Page Tour
Why Customize Login?
Creating a Custom Login Page
Configuring Custom Login Page
Login Success Redirection
Login Failure Redirection
Customizing Login Parameters
Remember Me Functionality
Session Fixation Protection
Concurrent Session Control
Full Form Login Example
Testing Form Login
Form Login Best Practices
Implementing Logout and Session Management
Why Logout Matters
Default Logout Behavior
Enabling Logout
Logout Success Redirect
Invalidating Sessions
Custom Logout URL
Adding Logout Handlers
Logout Success Handlers
Clearing Authentication
Invalidating HTTP Session
Session Fixation Attack
Session Creation Policy
Concurrent Sessions
Session Expiration
Session Registry
Securing Web Endpoints and Basic Authorization
Why Secure Endpoints?
The Authorization Flow
Introducing HttpSecurity
Using requestMatchers
Matching HTTP Methods
Common Matcher Patterns
Allowing All: permitAll()
Requiring Authentication
Denying All: denyAll()
Introducing Roles
hasRole() for Access
Multiple Roles: hasAnyRole()
Order Matters!
Combining Rules
Securing All Others
Secure Password Storage with PasswordEncoder
Why Not Store Plaintext?
Introducing Hashing
The Role of Salting
Key Hashing Algorithms
What is PasswordEncoder?
Choosing Your Encoder
Configuring PasswordEncoder
Encoding Passwords
Verifying Passwords
Updating In-Memory Users
Customizing BCrypt Cost
Delegating PasswordEncoder
Password Storage Best Practices
Understanding and Leveraging CSRF Protection
What is CSRF?
How CSRF Attacks Work
Impact of CSRF Attacks
CSRF Protection Basics
How Spring Security Protects
Benefits of Default CSRF
CSRF Tokens in HTML Forms
Thymeleaf & CSRF Tokens
CSRF with AJAX Requests
When to Disable CSRF
How to Disable CSRF
Customizing CSRF Behavior
CSRF Best Practices
CSRF vs. XSS
Review & Next Steps