15 · Security / LESSON 72 OF 102

Authentication and filter chains

Declare access rules before requests reach controllers.

Before this lesson: Optimistic locking, pessimistic locking, and auditing

Understand the topic

Add Spring Security. Its filters run before MVC. Authentication establishes a principal; authorization checks permissions. This course configuration uses form login and retains CSRF protection.

Without a custom user store, Boot provides temporary development credentials. Do not use that setup as a production identity system. Rules are evaluated in order; public health should expose minimal detail.

EXAMPLE · JAVA

src/main/java/com/example/tasks/SecurityConfig.java

package com.example.tasks;
import org.springframework.context.annotation.*;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
public class SecurityConfig {
    @Bean
    SecurityFilterChain webSecurity(HttpSecurity http) throws Exception {
        return http.authorizeHttpRequests(rules -> rules
                .requestMatchers("/actuator/health").permitAll()
                .anyRequest().authenticated())
            .formLogin(Customizer.withDefaults()).build();
    }
}

What to expect

Protected routes require login. Authenticated mutations without a valid CSRF token remain rejected.

YOUR TURN

Put it into practice

01Visit a protected route in a private window.
02Log in with development credentials.
03Explain why login does not imply ownership of all tasks.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

Security filters establish identity and enforce request-level access before controller logic runs.

01Matcher order matters: a broad permitAll before a narrow protected matcher can defeat the intended policy.
02A redirect to login is appropriate for a browser flow; an API client may need 401 instead. Choose and test the entry-point behavior explicitly.
03Authorization must also protect individual resources. Passing the filter chain does not prove ownership of a task ID.

A mistake worth avoiding

Do not remove security filters from all tests merely to make requests pass.

DEBUGGING ROOM

Something broke. Where do you look?

An endpoint intended to be private is accessible anonymously.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Which rule order is safer?

Permit all paths firstSpecific public paths first, authenticated default lastOnly check authentication in the UI

BUILD IT YOURSELF

Write an access matrix

1.List public, authenticated, and role-restricted endpoints.
2.Test anonymous and authenticated requests.
3.Include unsafe methods and CSRF behavior.

Acceptance checklist

Every endpoint has an intended access policy.Tests fail if a private endpoint becomes public.

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Where does object ownership fit after request authorization?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Explain security filters and authentication versus authorization.

Reading is separate from passing a knowledge check or completing a lab.