Spring Security Basics

Secure By Default

💡 Spring Security ek BUILDING KA SECURITY SYSTEM hai — HAR door (endpoint) par GUARD khada hai, jo VISITOR (request) ka ID CHECK karta hai (authentication) aur DECIDE karta hai kaunse ROOMS (resources) tak access hai (authorization) — koi bhi door BYPASS nahi kar sakta bina guard se guzarे.

Spring Security ek COMPREHENSIVE security framework hai — AUTHENTICATION (tum KAUN ho?) aur AUTHORIZATION (tumhe KYA karne ki permission hai?) dono handle karta hai. Ye ek FILTER CHAIN ke through kaam karta hai — HAR request DispatcherServlet tak pahunchne se PEHLE, security checks se guzarтी hai.

spring-boot-starter-security add karте hi, Spring Boot "SECURE BY DEFAULT" ho jaata hai — SAARI endpoints AUTOMATICALLY LOCKED ho jaati hain (login required), ek RANDOM password console mein GENERATE hoti hai. Custom configuration (kya PUBLIC hona chahiye, kaunsa auth mechanism) SecurityFilterChain @Bean se define hoti hai.

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }
}

🔒

Spring Security ek BUILDING KA SECURITY SYSTEM hai — HAR door (endpoint) par GUARD khada hai, jo VISITOR (request) ka ID CHECK karta hai (authentication) aur DECIDE karta hai kaunse ROOMS (resources) tak access hai (authorization) — koi bhi door BYPASS nahi kar sakta bina guard se guzarे.

1 / 6

⚡ Quick Recap

Authentication = "tum KAUN ho" (identity verify)
Authorization = "tumhe KYA karne ki permission hai" (access control)
Filter chain — DispatcherServlet se PEHLE security checks

On this page (2 subtopics)

Spring Security ek CHAIN OF FILTERS ke through kaam karta hai — HAR HTTP request DispatcherServlet tak pahunchne se PEHLE, MULTIPLE security filters se guzarта hai (authentication check, CSRF validation, session management). Ye filter chain DispatcherServlet ke BILKUL PEHLE, servlet container level par kaam karta hai.

💡Tip: Filter chain ko DEBUG karna kabhi mushkil ho sakta hai — Spring Security ka DEBUG logging (logging.level.org.springframework.security=DEBUG) EXACTLY dikhाta hai kaun sa filter request ko REJECT/ALLOW kar raha hai.

spring-boot-starter-security add karте hi, Spring Boot AUTOMATICALLY SAARI endpoints ko SECURE kar deta hai — ek RANDOM generated password console mein print hoti hai, aur EK default login page ban jaata hai. Ye "secure by default" philosophy hai — explicitly configure karo KYA public hona chahiye, sab kuch by default LOCKED hai.

Dependency add karte hi, SAB endpoints AUTOMATICALLY secured ho jaate hain
Default username = "user", password RANDOMLY generated (console mein print)
Explicitly configure karna padta hai kya PUBLIC hona chahiye

← Previous🔒 Transactions Next →🔑 Authentication

Code10x

Spring Security Basics

The Security Filter Chain

Default Security Behavior