Spring Security Tutorial: The Complete Guide

Picture this: You've just deployed your new Java application. Everything looks great — the UI is smooth, the API responses are fast, and users are signing up. Then one morning, you discover that someone exploited a vulnerability and accessed user data they shouldn't have. The fix? A proper security implementation that takes an afternoon to put in place.

This isn't a hypothetical scenario. It's happening right now to companies that treated security as an afterthought. The cost? Data breaches average $4.45 million in damages, not to mention the destroyed user trust and potential legal liability.

Enter Spring Security — the de facto standard for securing Java applications. Whether you're building a simple web app or a complex microservices architecture, Spring Security provides the building blocks you need to implement robust authentication and authorization. In this guide, we'll walk through everything you need to know to secure your applications properly.

What Is Spring Security?

Spring Security is a powerful, customizable authentication and authorization framework for Java applications. It's part of the Spring ecosystem and integrates seamlessly with Spring Boot, Spring MVC, and Spring WebFlux applications.

The framework handles everything from basic login forms to complex multi-factor authentication and OAuth2 implementations. With over 87% market share in enterprise Java security, if you're building Java applications, you're almost certainly using Spring Security whether you know it or not.

Here's what Spring Security handles out of the box:

Setting Up Spring Security

Getting started with Spring Security is straightforward, especially with Spring Boot. Let's walk through the setup process.

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
</dependencies>

With just these dependencies, Spring Security auto-configures a basic security setup. Every endpoint requires authentication by default, and a default login page is provided. But for production applications, you'll want to customize this.

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**", "/login").permitAll()
                .requestMatchers("/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .defaultSuccessUrl("/dashboard", true)
            )
            .httpBasic(Customizer.withDefaults());
        
        return http.build();
    }
}

Authentication: Who Are You?

Authentication is the process of verifying that users are who they claim to be. Spring Security supports multiple authentication mechanisms, from simple username/password to complex multi-factor authentication.

JWT Authentication: The Modern Standard

JSON Web Tokens (JWT) have become the standard for stateless authentication in modern applications. Here's why: they reduce server load by 60%+ compared to session-based auth, work seamlessly with microservices, and scale effortlessly.

@Component
public class JwtTokenProvider {
    
    public String generateToken(UserDetails user) {
        Map<String, Object> claims = new HashMap<>();
        claims.put("roles", user.getAuthorities().stream()
            .map(GrantedAuthority::getAuthority)
            .toList());
        
        return Jwts.builder()
            .setClaims(claims)
            .setSubject(user.getUsername())
            .setIssuedAt(new Date())
            .setExpiration(new Date(System.currentTimeMillis() + 86400000))
            .signWith(SignatureAlgorithm.HS256, "secret-key")
            .compact();
    }
    
    public boolean validateToken(String token) {
        try {
            Jwts.parser().setSigningKey("secret-key")
                .parseClaimsJws(token);
            return true;
        } catch (Exception e) {
            return false;
        }
    }
}

The JWT contains all necessary user information, eliminating the need for session storage. Each request includes the token, and the server validates it without checking a database — dramatically improving performance.

Authorization: What Can You Do?

Once we know who users are (authentication), we need to determine what they can do (authorization). Spring Security provides fine-grained control over access based on roles and permissions.

@RestController
public class UserController {
    
    @GetMapping("/users")
    @PreAuthorize("hasRole('ADMIN')")
    public List<User> getAllUsers() {
        return userService.findAll();
    }
    
    @GetMapping("/profile")
    @PreAuthorize("hasRole('USER') or hasRole('ADMIN')")
    public User getProfile() {
        return userService.getCurrentUser();
    }
}

OAuth2: Enterprise Identity Management

For enterprise applications, OAuth2 has become the standard for authentication and authorization. It enables single sign-on (SSO), social login, and secure API access without sharing credentials.

Spring Security provides comprehensive OAuth2 support with just a few configuration changes:

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: your-google-client-id
            client-secret: your-google-client-secret
            scope: profile, email
        provider:
          google:
            user-name-attribute: sub

With this configuration, users can authenticate with their Google accounts. The same pattern works for GitHub, Facebook, Okta, Auth0, and other OAuth2 providers.

How Boundev Solves This for You

Everything we've covered in this blog — Spring Security setup, authentication mechanisms, JWT, authorization, and OAuth2 — is exactly what our Java team handles every day. Here's how we approach security for our clients.

Frequently Asked Questions