Security

Filter Chain, JWT, OAuth2

The mental model for how Spring Security works — the filter chain — plus the two auth patterns you'll implement on every project.

Architecture

Security Filter Chain

Every HTTP request passes through an ordered chain of filters before reaching your controller. You configure a SecurityFilterChain bean — not WebSecurityConfigurerAdapter (deprecated in Boot 3).

Key Filters in Order

SecurityContextPersistenceFilter — loads/stores SecurityContext
Your custom JWT filter (insert here)
UsernamePasswordAuthenticationFilter — form login
ExceptionTranslationFilter — converts AuthExceptions to HTTP responses
FilterSecurityInterceptor — final access decision

You don't need to memorise the full chain — understand that it's ordered and each filter can short-circuit.

Filter Chain as a Pipe

HTTP Request

SecurityContext

JWT Filter (yours)

Auth Filter

Exception Filter

Access Check

Controller

Concepts

Authentication vs Authorisation

Authentication

Who are you? → Authentication object in SecurityContext

Authorisation

What are you allowed to do? → roles and authorities checked against the request

SecurityContextHolder — thread-local storage for the current user's Authentication
UserDetailsService — the bridge between Spring Security and your user store

Rules

Configuring Access

URL-Based Rules

SecurityFilterChain bean with HttpSecurity — the modern fluent API. requestMatchers("/public/**").permitAll(), .anyRequest().authenticated().

Method-Level Security

@PreAuthorize("hasRole('ADMIN')") — enable with @EnableMethodSecurity. Use @PreAuthorize over @Secured or @RolesAllowed — it supports SpEL expressions.

Stateless REST APIs

CSRF: enabled by default — disable for stateless REST APIs (JWT-based, no session cookie)
Session management: set to STATELESS for REST APIs

Access Decision Tree

Token Auth

JWT Flow

JWT Structure

Header.Payload.Signature — the payload contains claims: sub (userId), roles, iat (issued at), exp (expiry). The server validates the signature — no session lookup needed. Stateless.

Phase 1 — Login

Client → POST /auth/login {username, password}
       ← 200 { token: "eyJ..." }

Phase 2 — Authenticated Request

JWT Validation Sequence

GET /api/orders
Bearer eyJ...

JwtAuthFilter

Validate Sig + Exp

Set SecurityContext

Controller

200 [orders]

Delegation

OAuth2 / OIDC

OAuth2 Roles

Resource Owner (user), Client (your app), Authorization Server (Keycloak/Auth0/Google), Resource Server (your API).

Two Modes Spring Boot Supports

Mode	Starter	Use Case
OAuth2 Client	`spring-boot-starter-oauth2-client`	"Login with Google" — your app IS the client
Resource Server	`spring-boot-starter-oauth2-resource-server`	Your API validates JWTs from an auth server

OIDC adds identity on top of OAuth2 — id_token contains user profile claims. One property enables JWT validation: spring.security.oauth2.resourceserver.jwt.issuer-uri.

Pitfalls

Common Misconfigurations

1. CSRF not disabled for REST APIs
Stateless JWT APIs don't need CSRF protection (no session cookie to forge). Leaving it enabled causes 403s on POST/PUT/DELETE.

2. permitAll() doesn't bypass all filters
The request still runs through the filter chain. A JWT filter that throws on a missing token before permitAll() is checked will still block it.

3. hasRole('ADMIN') vs hasAuthority('ROLE_ADMIN')
hasRole prepends ROLE_ automatically. Don't double-prefix.

4. @PreAuthorize not working
@EnableMethodSecurity is required. Forgetting it means the annotation is silently ignored.

LearningTree

Security — Filter Chain, JWT, OAuth2 | Spring Guide