---

Introduction

Security is one of the most critical aspects of enterprise applications.

Every day, banking, healthcare, insurance, and e-commerce applications process millions of requests that must be protected against unauthorized access.

Examples

• Internet Banking
• Credit Card Payments
• Insurance Claims
• Online Shopping
• Healthcare Portals
• Government Services

Spring Security is the de facto security framework for Spring applications.

It provides

• Authentication
• Authorization
• Password Encryption
• Session Management
• CSRF Protection
• CORS Support
• OAuth2
• JWT Authentication
• Method-Level Security

Spring Security integrates seamlessly with Spring Boot and protects applications with minimal configuration.

---

Spring Security Architecture

flowchart LR

Client --> SecurityFilterChain

SecurityFilterChain --> Authentication

Authentication --> Authorization

Authorization --> Controller

Controller --> Service

Service --> Database

Controller --> Response

Response --> Client

---

Q1. What is Spring Security?

Answer

Spring Security is a comprehensive security framework for Java applications built on Spring.

It protects applications by handling

• Authentication
• Authorization
• Password encryption
• Session management
• Secure communication

It works by intercepting every incoming HTTP request before it reaches the application.

---

Q2. Why do we need Spring Security?

Without security,

anyone could

• Access sensitive data
• Modify records
• Transfer money
• Delete customer information

Spring Security protects applications from

• Unauthorized access
• Password attacks
• Session hijacking
• CSRF attacks
• Common web vulnerabilities

---

Q3. What is Authentication?

Authentication answers the question:

Who are you?

Examples

• Username & Password
• OTP
• Fingerprint
• Face Recognition
• JWT Token
• OAuth Login

Example

Username: john

Password: ********

Authentication verifies the user's identity.

---

Q4. What is Authorization?

Authorization answers the question:

What are you allowed to do?

Example

Customer

↓

View Account

↓

Transfer Funds

Administrator

Manage Users

Manage Roles

Delete Accounts

Authorization determines resource access after authentication.

---

Q5. Authentication vs Authorization

Authentication	Authorization
Verify identity	Verify permissions
Login process	Access control
Happens first	Happens after authentication
Uses credentials	Uses roles/authorities
Example: Username & Password	Example: ROLE_ADMIN

---

Q6. What is SecurityContext?

SecurityContext stores the authenticated user's security information during the request.

It contains

• Username
• Roles
• Authorities
• Authentication status

SecurityContext

flowchart LR

Authentication --> SecurityContext

SecurityContext --> Controller

Controller --> Service

Controllers and services can access the current authenticated user from the SecurityContext.

---

Q7. What is SecurityFilterChain?

The SecurityFilterChain is the heart of Spring Security.

Every request passes through it.

Responsibilities

• Authentication
• Authorization
• CSRF checks
• Session validation
• Exception handling

Security Filter Chain

flowchart LR

HTTPRequest --> SecurityFilterChain

SecurityFilterChain --> AuthenticationFilter

AuthenticationFilter --> AuthorizationFilter

AuthorizationFilter --> Controller

---

Q8. What is UserDetailsService?

UserDetailsService loads user information during authentication.

Typical responsibilities

• Load user by username
• Retrieve password
• Retrieve roles
• Return UserDetails

Example

UserDetails loadUserByUsername(
        String username);

Spring Security calls this service automatically during login.

---

Q9. What is PasswordEncoder?

Passwords should never be stored in plain text.

Spring Security provides

• BCryptPasswordEncoder
• Argon2PasswordEncoder
• PBKDF2PasswordEncoder
• SCryptPasswordEncoder

Example

PasswordEncoder encoder =
        new BCryptPasswordEncoder();

BCrypt is the most commonly used encoder in enterprise applications.

---

Q10. Spring Security Best Practices

Never Store Plain Text Passwords

Always hash passwords.

---

Use HTTPS

Encrypt all communication.

---

Apply Principle of Least Privilege

Grant minimum required permissions.

---

Keep Authentication Stateless for APIs

Prefer JWT over server-side sessions.

---

Enable Audit Logging

Track authentication and authorization events.

---

Banking Example

flowchart TD

Customer --> LoginRequest

LoginRequest --> SecurityFilterChain

SecurityFilterChain --> Authentication

Authentication --> Authorization

Authorization --> PaymentController

PaymentController --> PaymentService

PaymentService --> Database

Only authenticated and authorized users can access banking operations.

---

Common Interview Questions

• What is Spring Security?
• Why do we need Spring Security?
• What is Authentication?
• What is Authorization?
• Authentication vs Authorization?
• What is SecurityContext?
• What is SecurityFilterChain?
• What is UserDetailsService?
• What is PasswordEncoder?
• Spring Security best practices?

---

Quick Revision

Topic	Summary
Spring Security	Security framework for Spring
Authentication	Verify identity
Authorization	Verify permissions
SecurityContext	Holds authenticated user
SecurityFilterChain	Intercepts every request
UserDetailsService	Loads user information
UserDetails	Authenticated user object
PasswordEncoder	Hashes passwords
BCrypt	Recommended password hashing
HTTPS	Secure communication

---

Complete Authentication Request Lifecycle

sequenceDiagram
Client->>SecurityFilterChain: Login Request
SecurityFilterChain->>AuthenticationManager: Authenticate
AuthenticationManager->>UserDetailsService: Load User
UserDetailsService-->>AuthenticationManager: UserDetails
AuthenticationManager->>PasswordEncoder: Verify Password
PasswordEncoder-->>AuthenticationManager: Valid
AuthenticationManager-->>SecurityContext: Store Authentication
SecurityContext-->>SecurityFilterChain: Authenticated
SecurityFilterChain-->>Controller: Continue Request
Controller-->>Client: HTTP Response

---

Production Example – Banking Login

A banking customer logs into a mobile banking application.

Workflow

1. Customer enters username and password.

2. Request reaches the SecurityFilterChain.

3. AuthenticationManager delegates to UserDetailsService.

4. User details are loaded from the database.

5. BCryptPasswordEncoder compares the entered password with the stored hash.

6. On success:

   • An authenticated Authentication object is created.
   • It is stored in the SecurityContext.

7. Authorization verifies whether the customer can access /accounts, /payments, or /loans.

8. The request proceeds to the controller.

@Bean
PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

flowchart LR

MobileApp --> SecurityFilterChain

SecurityFilterChain --> AuthenticationManager

AuthenticationManager --> UserDetailsService

UserDetailsService --> PostgreSQL

AuthenticationManager --> SecurityContext

SecurityContext --> AuthorizationManager

AuthorizationManager --> AccountController

AccountController --> MobileApp

---

Spring Security Core Components

Component	Responsibility
SecurityFilterChain	Intercepts every HTTP request
AuthenticationManager	Coordinates authentication
AuthenticationProvider	Performs authentication
UserDetailsService	Loads user information
UserDetails	Represents authenticated user
PasswordEncoder	Hashes and verifies passwords
SecurityContext	Stores current authentication
Authentication	Represents login status
GrantedAuthority	Represents permissions/roles

---

Common Authentication Methods

Method	Enterprise Usage
Username & Password	Traditional applications
JWT	REST APIs & Microservices
OAuth2	Third-party login
OpenID Connect	Single Sign-On (SSO)
LDAP	Enterprise directory integration
Multi-Factor Authentication (MFA)	Banking & Healthcare
Biometric Authentication	Mobile banking apps

---

Key Takeaways

• Spring Security is the standard security framework for Spring applications, providing authentication, authorization, and protection against common web vulnerabilities.
• Authentication verifies the user's identity, while Authorization determines what the authenticated user is allowed to access.
• The SecurityFilterChain is the core component that intercepts every HTTP request before it reaches application controllers.
• SecurityContext stores authentication details for the current request and makes them available throughout the application.
• UserDetailsService loads user credentials and authorities, while PasswordEncoder securely hashes and verifies passwords.
• Passwords should always be stored using strong hashing algorithms such as BCrypt or Argon2, never in plain text.
• Modern REST APIs typically use JWT-based stateless authentication, whereas traditional web applications often use session-based authentication.
• Building secure enterprise applications requires HTTPS, least-privilege authorization, secure password storage, centralized authentication, and comprehensive audit logging.