Basic Configuration

Add a single dependency to a Spring Boot project and your application becomes unreachable. Every URL requires authentication, a login form appears, and a random password is printed to the console at startup. This behavior is surprising, but it reflects a defensible design decision: Spring Security assumes everything is closed and asks you to explicitly open what needs to be open.

This is the opposite of the naive approach, where you protect sensitive pages one by one. That approach always fails the same way: the day someone adds an admin controller without thinking about security, the URL is public. With a closed-by-default stance, forgetting something produces an embarrassing 401 in QA, not a data leak in production.

This lesson takes you from the default behavior to a configuration you write yourself. You will declare a SecurityFilterChain bean, decide which URLs are public, and wire up a custom login page and a clean logout. Above all, you will see the two mistakes that cost the most time: an authorization rule placed where it will never be reached, and a login page protected by the very rule it is supposed to help satisfy.