Spring Security Auto-Configuration
spring-boot-starter-security dependency ADD karте hi, DRAMATIC CHANGES AUTOMATICALLY HAPPEN — SecurityFilterChain AUTOMATICALLY CONFIGURE hoती hai, SAARI ENDPOINTS PROTECTED ho jaati hain (login REQUIRED), EK DEFAULT LOGIN FORM (HTML) GENERATE hota hai, aur STARTUP LOGS mein EK RANDOM-GENERATED PASSWORD PRINT hoती hai.
YE "SECURE BY DEFAULT" auto-configuration EK INTENTIONAL PHILOSOPHY hai — DEVELOPERS ko ACCIDENTALLY INSECURE APPLICATION SHIP karne se ROKTA hai. CUSTOM SecurityFilterChain @Bean DEFINE karте hi, DEFAULT auto-configuration BACK OFF ho jaata hai (SAME @ConditionalOnMissingBean pattern JO tumne pehle SEEKHA THA).
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(auth -> auth
.requestMatchers("/api/public/**").permitAll()
.requestMatchers("/api/admin/**").hasRole("ADMIN")
.anyRequest().authenticated()
)
.csrf(csrf -> csrf.disable()) // REST APIs ke liye TYPICALLY disabled
.sessionManagement(session -> session
.sessionCreationPolicy(SessionCreationPolicy.STATELESS)); // JWT-based APIs ke liye
return http.build();
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}- Starter add karте hi, "SECURE BY DEFAULT" — SAARI endpoints AUTOMATICALLY LOCKED
- Custom SecurityFilterChain @Bean = auto-configuration OVERRIDE (BACK OFF pattern)
- REST APIs (JWT) ke liye = CSRF disabled, STATELESS session common pattern
spring-boot-starter-security ADD karte hi, MULTIPLE THINGS AUTOMATICALLY HAPPEN — SecurityFilterChain AUTOMATICALLY CONFIGURE hoती hai, SAARI ENDPOINTS PROTECTED ho jaati hain, EK DEFAULT LOGIN PAGE (HTML form) GENERATE hota hai, aur EK RANDOM PASSWORD, APPLICATION STARTUP LOGS mein PRINT hoती hai.
Custom SecurityFilterChain @Bean DEFINE karte hi, DEFAULT AUTO-CONFIGURATION AUTOMATICALLY BACK OFF ho jaata hai (@ConditionalOnMissingBean pattern, jo TUM PEHLE SEEKH CHUKE ho) — TUMHARI CONFIGURATION APPLY hoती hai.
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/api/public/**").permitAll()
.anyRequest().authenticated());
return http.build();
}
}