Loading published curriculum…

16 · Spring Security in depth / LESSON 75 OF 102

FilterChainProxy, authentication, and authorization

Authentication establishes an identity; authorization decides whether that identity may perform an action.

Before this lesson: Sessions, CSRF, CORS, and tokens

Understand the topic

Spring Security uses servlet filters selected through FilterChainProxy. A SecurityFilterChain defines which requests it handles and which controls apply. Multiple chains are evaluated by priority; the first matching chain handles the request, so overly broad matchers can shadow later policies.

An Authentication contains principal and authorities plus authentication state. SecurityContext exposes the current authentication to application infrastructure. Do not trust a user ID header as authentication unless a separately trusted boundary verifies and controls it.

EXAMPLE · JAVA

Policy fragment inside a SecurityFilterChain bean

http.authorizeHttpRequests(auth -> auth
 .requestMatchers("/health/public").permitAll()
 .requestMatchers("/admin/**").hasRole("ADMIN")
 .anyRequest().authenticated());

What to expect

This configures authorization rules inside an existing chain; it does not by itself choose login, session, or token authentication.

YOUR TURN

Put it into practice

  1. 01Draw the request path through authentication and authorization.
  2. 02Test a public route, an authenticated route, and an admin route using anonymous, user, and admin identities.
  3. 03Verify: The resulting access matrix matches the declared policy for every route class.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

Authentication establishes an identity; authorization decides whether that identity may perform an action.

  1. 01Spring Security uses servlet filters selected through FilterChainProxy. A SecurityFilterChain defines which requests it handles and which controls apply. Multiple chains are evaluated by priority; the first matching chain handles the request, so overly broad matchers can shadow later policies.
  2. 02An Authentication contains principal and authorities plus authentication state. SecurityContext exposes the current authentication to application infrastructure. Do not trust a user ID header as authentication unless a separately trusted boundary verifies and controls it.
  3. 03Trace the example: This configures authorization rules inside an existing chain; it does not by itself choose login, session, or token authentication.

A mistake worth avoiding

A restrictive chain never handles the intended URL.

DEBUGGING ROOM

Something broke. Where do you look?

A restrictive chain never handles the intended URL.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Does successful authentication grant access to every resource?

Choose one answer

BUILD IT YOURSELF

Draw the request path through authentication and authorization.

  1. 1.Draw the request path through authentication and authorization.
  2. 2.Test a public route, an authenticated route, and an admin route using anonymous, user, and admin identities.
  3. 3.Reproduce this failure, then repair it: A restrictive chain never handles the intended URL.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Does successful authentication grant access to every resource?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

The resulting access matrix matches the declared policy for every route class.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references