Java Spring Boot Security
In this page:
What is Spring Security?
Spring Security handles authentication (who are you) and authorization (what are you allowed to do) for enterprise applications, and integrates directly with Spring Boot's request pipeline to keep every route's access rules centrally configured rather than scattered across controllers.
Example: What is Spring Security?
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
public class Main {
public static void main(String[] args) {
// http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated());
System.out.println("Authentication (who) + Authorization (what) centrally configured");
}
}Login to try C/C++/Java/PHP code in the editor
Username and Password Authentication
Traditional username/password login schemes compare the credentials a user submits against hashed values stored in your database, never comparing or storing the plaintext password itself once the account is created.
Example: Username and Password Authentication
public class Main {
public static void main(String[] args) {
String submittedPassword = "secret123";
String storedHash = "$2a$10$hashedvalue"; // never the plaintext password itself
System.out.println("Compare submitted credentials against " + storedHash);
}
}Login to try C/C++/Java/PHP code in the editor
Role-Based Authorization
Role-based authorization lets you restrict access to specific methods or API URLs based on the roles assigned to the authenticated user (like ADMIN or USER), so a single application can expose different capabilities to different kinds of users without separate codebases.
Example: Role-Based Authorization
import org.springframework.security.access.prepost.PreAuthorize;
public class Main {
@PreAuthorize("hasRole('ADMIN')") // restricts access based on the user's assigned role
void deleteUser(int id) {
System.out.println("Deleting user " + id);
}
public static void main(String[] args) {
new Main().deleteUser(5);
}
}Login to try C/C++/Java/PHP code in the editor
Password Encoding
Passwords must always be hashed, never stored in plaintext, before they're written to your database. Spring provides encoders like BCrypt specifically because they're deliberately slow and salted, which makes brute-forcing stolen password hashes much harder than with fast general-purpose hash functions.
Example: Password Encoding
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
public class Main {
public static void main(String[] args) {
BCryptPasswordEncoder encoder = new BCryptPasswordEncoder(); // deliberately slow and salted
String hashed = encoder.encode("myPassword");
System.out.println(hashed);
}
}Login to try C/C++/Java/PHP code in the editor
JSON Web Token (JWT) Security
JSON Web Tokens (JWTs) are self-contained, stateless tokens used to authorize incoming requests without the server needing to keep a session store, since the token itself carries the user's claims and is verified by its signature on every request.
Example: JSON Web Token (JWT) Security
public class Main {
public static void main(String[] args) {
String token = "eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJyaXlhIn0.signature"; // self-contained, no server-side session
System.out.println("Token carries claims and is verified by its signature: " + token);
}
}Login to try C/C++/Java/PHP code in the editor
Chapter Quiz — Complete all 6 topics to unlock
0/6 topics done
Complete these topics first: