Beginner6 min read
Spring Security Architecture Deep Dive
How Spring Security actually works: the filter chain and its ordering, SecurityContextHolder, the AuthenticationManager delegation model, and where to plug in custom logic.
Read tutorialSpring Security · Phase 1
Spring Security Foundations
The filter chain, and every way to prove who someone is: passwords, JWT, OAuth 2.0, OIDC, SAML, LDAP — plus the authorisation models and cryptography you build on top of them.
Beginner5 min read
Password Management & Encoding
Storing passwords properly: choosing between BCrypt, Argon2 and scrypt, DelegatingPasswordEncoder for zero-downtime migration, strength rules, and breached-password checks.
Read tutorialBeginner6 min read
HTTP Basic & Form-Based Authentication
The two classic authentication mechanisms: when Basic is appropriate, configuring form login properly, custom success and failure handlers, logout, and account lockout that is not a DoS.
Read tutorialBeginner5 min read
In-Memory & JDBC Authentication
Where user credentials live: in-memory users for tests, JdbcUserDetailsManager and its schema, writing a custom UserDetailsService, and seeding an initial administrator safely.
Read tutorialIntermediate7 min read
JWT Authentication Deep Dive
JWTs done safely: structure and claims, why RS256 beats HS256, key rotation with JWKS, the alg=none and key-confusion attacks, and how to revoke a stateless token.
Read tutorialAdvanced5 min read
OAuth 2.0 — The Complete Guide
OAuth 2.0 without the confusion: the four actors, the grants that still matter, why PKCE is mandatory, refresh token rotation, and what OAuth 2.1 removed.
Read tutorialAdvanced6 min read
Spring Authorization Server
Running your own OAuth 2.1 and OIDC provider: registering clients, persisting authorizations, JWK sources and key rotation, custom claims, and the consent page.
Read tutorialAdvanced6 min read
OAuth 2.0 Resource Server
Validating tokens correctly: NimbusJwtDecoder configuration, issuer and audience validators, mapping claims to authorities, opaque token introspection and multi-tenant decoding.
Read tutorialAdvanced5 min read
OpenID Connect (OIDC)
The identity layer on OAuth 2.0: what an ID token is and how to validate it, standard scopes and claims, discovery, and single logout across relying parties.
Read tutorialIntermediate6 min read
Social Login — Google, GitHub, Microsoft
Adding sign in with Google, GitHub and Microsoft: client registration, mapping provider profiles to your user model, safe account linking, and the onboarding flow afterwards.
Read tutorialExpert5 min read
SAML 2.0 Authentication
Enterprise SSO with SAML: the SP-initiated flow step by step, RelyingPartyRegistration, the assertion checks that matter, metadata exchange and single logout.
Read tutorialIntermediate6 min read
LDAP & Active Directory Integration
Authenticating against a corporate directory: LDAP structure, bind versus password comparison, ActiveDirectoryLdapAuthenticationProvider, group-to-role mapping and LDAPS.
Read tutorialIntermediate6 min read
Role-Based Access Control (RBAC)
Authorisation with roles: HTTP versus method security, role hierarchies, @PreAuthorize and @PostAuthorize, custom PermissionEvaluator, and where RBAC stops being enough.
Read tutorialAdvanced6 min read
Attribute-Based Access Control (ABAC)
When roles are not enough: the PDP/PEP model, Open Policy Agent and Rego, integrating OPA with Spring, and deciding between ABAC and a richer RBAC.
Read tutorialAdvanced6 min read
Cryptography & Encryption in Spring
Applied cryptography without inventing anything: choosing AES-GCM, envelope encryption, encrypting database columns with an AttributeConverter, and Vault Transit for key management.
Read tutorial