Architecture Deep Dive in Spring Security
summary
Shows how Spring Security actually authenticates, authorizes and handles exceptions by wiring a real demo: an Angular public site using HTTP Basic for public, form login for admin talking to a Spring Boot backend, three sample users and observable 401/403 responses. Traces filters and classes: authentication filter → AuthenticationManager → DaoAuthenticationProvider → UserDetailsService, SecurityContext stored and restored (SecurityContext stored in HttpSession), FilterSecurityInterceptor → AccessDecisionManager with role voter, ExceptionTranslationFilter delegating to AuthenticationEntryPoint or AccessDeniedHandler. Warns that multiple chains must be ordered (@Order) to avoid one being skipped (Filter ordering via @Order causes chain to be skipped). Also notes Spring Security 5 milestones for reactive and OAuth.
AI-written summary · about
chapters (6)
- 0:00Introduction and setup
- 3:07Authentication demo
- 8:21Authentication mechanics
- 23:27Authorization and filtering
- 32:34Exception handling flow
- 43:35Security configuration overview
related talks
54mSpring Security Patterns
51mServers, OAuth Client, SecurityFilterChain and More with Spring Security
45mSpring Security: The Good Parts
33mSpring Security Patterns
01h 31mGetting Started with Spring Security 3.1
01h 02mSpring Security 5: The Reactive Parts - Rob Winch
57mSpring Security for N00bz: A quick introduction for the terminally insecure
50mAuthorization in Spring Security: permissions, roles and beyond