SPRING BOOT SECURITY: SECURING WEB APPLICATIONS

Engineering Core

ISB Vietnam's skilled software engineers deliver high-quality applications, leveraging their extensive experience in developing financial tools, business management systems, medical technology, and mobile/web platforms.

In modern web application development, security is essential. Spring Boot integrates seamlessly with Spring Security, providing mechanisms for authentication, authorization, and endpoint protection out-of-the-box. This section explains Spring Boot Security, how to configure it, practical examples, and its benefits.

I. What is Spring Boot Security?

Spring Boot Security is a powerful framework that helps you:

Authenticate users (Authentication)
Control access to resources (Authorization)
Protect your application against common attacks such as CSRF, XSS, and session fixation
Support OAuth2, JWT, Basic Auth, and Form Login

By adding the spring-boot-starter-security dependency, Spring Boot Security can secure your application with minimal configuration.

II. How Does Spring Boot Security Work?

Spring Boot Security works using Filter Chains and the SecurityContext:

Filter Chain: Intercepts all incoming requests and applies security rules.
AuthenticationManager: Validates user credentials.
Authorization: Determines if the authenticated user has permission to access a resource.
PasswordEncoder: Hashes passwords for secure storage.

By default, if you add spring-boot-starter-security, all endpoints require login with a default username: user and a generated password.

III. How to Use Spring Boot Security

1. Add Dependency

Maven:

<dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

</dependency>

Gradle:

implementation 'org.springframework.boot:spring-boot-starter-security

2. Configure Security

You can customize security using SecurityFilterChain (Spring Boot 2.7+ / 3.x):

@Configuration

@EnableWebSecuritypublic class SecurityConfig {

@Bean

public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

http

.csrf().disable()

.authorizeHttpRequests(auth -> auth

.requestMatchers("/admin/**")

.hasRole("ADMIN")

.requestMatchers("/user/**")

.hasAnyRole("USER", "ADMIN")

.anyRequest().permitAll())

.formLogin()

.and()

.httpBasic();

return http.build();

}

@Bean

public PasswordEncoder passwordEncoder() {

return new BCryptPasswordEncoder();

}

/admin/** is accessible only by admins
/user/** is accessible by both users and admins
All other endpoints are public
Supports form login and HTTP Basic authentication

3. Im-Memory Authentication Example

@Bean

public UserDetailsService users() {

UserDetails user = User.builder()

.username("user")

.password(passwordEncoder().encode("password"))

.roles("USER")

.build();

UserDetails admin = User.builder()

.username("admin")

.password(passwordEncoder().encode("admin123"))

.roles("ADMIN")

.build();

return new InMemoryUserDetailsManager(user, admin);

}

This is a quick way to test security without a database.

IV. Example of Spring Boot Security in Action

Protecting a REST API:

@RestController

@RequestMapping("/admin")

public class AdminController {

@GetMapping("/dashboard")

public String dashboard() {

return "Admin Dashboard";

}

When accessing /admin/dashboard:

If not logged in → redirected to login page
If logged in with a user without ADMIN role → 403Forbidden
If logged in as admin → access granted

V. Benefits of Spring Boot Security

Secure by default: Adding the dependency provides login and basic security.
Flexible authentication and authorization: Role-based, permission-based, JWT, OAuth2 support.
Protection against common attacks: CSRF, XSS, session fixation.
Highly customizable: Form login, REST API security, method-level security (@PreAuthorize).
Easy integration with DB or OAuth2 providers: JDBC, LDAP, Keycloak, Google, Facebook.

VI. Conclusion

Spring Boot Security allows you to secure web applications easily, with minimal configuration and robust features. It not only protects your endpoints but also scales for complex authentication and authorization needs, letting developers focus more on business logic rather than security boilerplate.

Whether you need scalable software solutions, expert IT outsourcing, or a long-term development partner, ISB Vietnam is here to deliver. Let’s build something great together—reach out to us today. Or click here to explore more ISB Vietnam's case studies.

[References]

https://docs.spring.io/spring-boot/docs/current/reference/html/security.html

https://docs.spring.io/spring-security/reference/index.html

https://www.baeldung.com/spring-boot-security

https://spring.io/guides/gs/securing-web/

https://www.baeldung.com/spring-security-jwt

Written by

Engineering Core