Advanced
Spring Security
The filter chain, and what it protects.
The security filter chain, authentication versus authorization, stateless JWT resource servers, OAuth2 and OpenID Connect, method security, and CORS and CSRF for an API.
4 lessons written2 modules~1h reading
After this course you can
- Explain the filter chain and read a security configuration
- Secure a stateless REST API with JWT validation done correctly
- Configure an OAuth2 resource server and know the difference from a client
- Apply method-level authorization and test it
Curriculum
4 lessons · outlined lessons show their plan01
The security filter chainHow a request is authenticated, the SecurityContext, AuthenticationManager and providers, and the order of filters that decides everything.13 minJWT resource serversValidating a JWT: signature, issuer, audience, expiry, and the claims-to-authorities mapping. Also, what not to put in a token.13 minThe filter chain
02
OAuth2 and OpenID ConnectAuthorization code with PKCE, client credentials, the roles of each party, and why a backend rarely needs the password grant.12 minMethod security, CORS and CSRF@PreAuthorize with SpEL, role hierarchies, CORS configured on purpose, and the CSRF decision for a stateless API.11 min