Spring Security & Authentication

What you will be able to do

• Explain authentication vs authorisation and how the Spring Security filter chain works
• Store passwords safely with BCrypt and build sign-up and login endpoints
• Protect a REST API with stateless JWT authentication
• Restrict endpoints and data by role and by owner
• Configure CORS and avoid the common web security mistakes
• Secure ShopLite so customers and admins see only what they should

What it will cover

1. 17.1Security Basics

   The core ideas you need before touching any security code.

   Show 5 topics
   • Authentication vs authorisation
   • Common attacks: stolen passwords, injection, broken access control
   • Hashing vs encryption vs encoding
   • HTTPS and why tokens need it
   • The OWASP Top 10 at a glance

2. 17.2How Spring Security Works

   What changes when you add Spring Security and how a request is checked.

   Show 5 topics
   • Adding the starter and the default login
   • The security filter chain
   • SecurityFilterChain configuration
   • SecurityContext and the current user
   • Permitting public endpoints

3. 17.3Users & Password Storage

   Keep user accounts in the database and store passwords so a leak does not expose them.

   Show 5 topics
   • User entity and roles table
   • UserDetails and UserDetailsService
   • PasswordEncoder and BCrypt
   • Sign-up endpoint with validation
   • Handling duplicate emails

4. 17.4HTTP Basic & Sessions

   The simpler ways to sign in and why REST APIs usually move beyond them.

   Show 4 topics
   • HTTP Basic authentication
   • Form login and session cookies
   • CSRF and when it matters
   • Why stateless APIs prefer tokens

5. 17.5JWT Authentication

   Issue and check signed tokens so the API stays stateless.

   Show 6 topics
   • JWT structure: header, payload, signature
   • Login endpoint that returns a token
   • A filter that validates the token on each request
   • Expiry, clock skew and signing keys from configuration
   • Refresh tokens and logout (the trade-offs)
   • Where clients should store tokens

6. 17.6Roles & Permissions

   Allow each user to do only what their role permits.

   Show 5 topics
   • Roles vs authorities
   • URL rules with requestMatchers
   • Method security with @PreAuthorize
   • Owner checks: a customer sees only their own orders
   • 401 vs 403 and custom error responses

7. 17.7CORS & Browser Clients

   Let a frontend on another origin call your API safely.

   Show 4 topics
   • Why the browser blocks cross-origin calls
   • Preflight requests
   • Configuring CORS in Spring Security
   • Common CORS mistakes

8. 17.8Common Security Mistakes

   The errors that turn up in real projects and code reviews, and how to avoid them.

   Show 6 topics
   • Secrets in code and Git history
   • Leaking data through entities and error messages
   • Missing ownership checks (IDOR)
   • Brute-force login and account lockout
   • Logging sensitive data
   • Keeping dependencies up to date

9. 17.9Security Mini Project: Secure ShopLite

   Add sign-up, JWT login and role-based access to the ShopLite API.

   Show 5 topics
   • Customer sign-up and login
   • Admin-only product and stock management
   • Customers place and view only their own orders
   • Security error responses and CORS for a frontend
   • Documenting secured endpoints in Swagger UI