Introduction to Spring Security

Most of the security flaws found in production don't come from a broken cryptographic algorithm. They come from a developer who copied a configuration found online without knowing exactly what it allowed. A permitAll() that is a bit too broad, an authorization rule placed after another one that swallows it, a protection disabled "so it works locally" and never turned back on: this is the daily reality of security audits.

Spring Security is a framework that makes security declarative. That is both its strength and its trap. Its strength, because a dozen lines are enough to get a correct authentication system, resistant to classic attacks, with properly hashed passwords. Its trap, because those dozen lines look like harmless configuration, when each one decides who can read what.

This course therefore starts with the model before the syntax. You will first understand where Spring Security fits into the processing of an HTTP request, which object represents the current user, and how the framework distinguishes two questions that people constantly confuse: "who are you?" and "are you allowed to?". Once this model is in place, configuration stops being an incantation and becomes something you can simply read.