Application security protects an application's execution environment, functionality, data, and communications from unauthorized access, misuse, and vulnerabilities that could affect the wider system. It forms one layer in a broader security design alongside networking, storage, and deployment concerns. section 1.2
Spring Security provides a customizable way to implement authentication, authorization, and protection against common attacks in Spring applications. It supports servlet, reactive, and non-web applications, but it does not secure an application automatically or guarantee freedom from vulnerabilities; configuration must reflect functional requirements and architecture. section 1.1
A practical introduction proceeds incrementally:
- Create a Spring Boot project with web and Spring Security dependencies, then observe behavior without explicit configuration. section 2.0
- Inspect convention-based authentication and authorization defaults before replacing them with custom users and passwords. section 2.0
- Customize endpoint protection after observing that the default configuration authenticates all endpoints. section 2.0
- Treat each security layer as necessary: weaknesses in networking, deployment, or application controls can expose data or enable impersonation. section 1.2
Layered microservices deployment
In a multi-zone microservices system, a compromised virtual machine can expose other applications when application-level security is absent. Intercepted cross-zone communication can also enable data theft or user impersonation. section 1.2
Figure 1.3 We implement security in a hierarchical manner, with each layer building on the foundation of the previous one. This book focuses on explaining how to use Spring Security, a framework that provides application-level security at the very top layer.
Shows application security as the top layer in a hierarchical design, built on foundations provided by lower security layers. section 1.2
