Spring Security
Spring Security is a Spring framework for implementing application authentication, authorization, access control, and protection against common security threats.
Spring Security in Action, Second Edition
Spring Security is an open-source framework for securing Spring applications through authentication, authorization, access control, and protection against common attacks.
- How it is used
- Secures Spring applications through authentication, authorization, access control, and protection against common attacks.
- How deep it goes
- Descends from architecture and defaults into configuration, customization, OAuth 2, reactive security, and testing through progressively complex examples.
- Examples
- Uses first Spring applications, authorization servers, OAuth 2 clients, backend calls, reactive apps, mock users, and endpoint tests.
- What you can do after
- Apply Spring Security to practical Spring scenarios, choose suitable configurations, customize defaults, and test security implementations.
Read how Spring Security in Action, Second Edition explains Spring Security →
Software Security for Developers
Spring Security is a Java and Spring framework for authentication, authorization, and protection against common application security threats.
- How it is used
- Applies authentication patterns and endpoint authorization in Java web applications and service integrations.
- How deep it goes
- Demonstrates an OIDC authorization-code flow and configuration, but deliberately stops short of deep framework implementation details.
- Examples
- Uses YAML client configuration, discovery metadata, browser redirection, authorization codes, token requests, and decoded access-token claims.
- What you can do after
- Apply Spring Security by configuring an OIDC client and tracing authorization-code authentication through endpoint protection and token issuance.
Read how Software Security for Developers explains Spring Security →
Spring AI in Action
Spring Security is a Spring framework project that provides authentication, authorization, and protection against common application security threats.
- How it is used
- Secures Spring AI applications by restricting document access, premium content, and LLM-invoked tools.
- How deep it goes
- Configures dependencies, web filters, users, roles, and method annotations while keeping the framework's broader configuration possibilities out of scope.
- Examples
- Demonstrates Board Game Buddy, premium game content, the getGameComplexity tool, and authenticated HTTP requests.
- What you can do after
- Operate/configure Spring applications with HTTP Basic authentication and role-based restrictions on web requests and tool methods.
Spring in Action, Sixth Edition
Spring Security is a Spring framework for securing applications through authentication, authorization, and related security mechanisms.
- How it is used
- Secures Spring Boot applications, administrative servers, APIs, and operational endpoints through authentication and authorization.
- How deep it goes
- Explains starter-based autoconfiguration, login behavior, endpoint matching, roles, HTTP Basic, and CSRF, while deferring the framework’s broader scope.
- Examples
- Uses default login, generated credentials, Actuator role restrictions, EndpointRequest matchers, and Admin server credential configuration.
- What you can do after
- Configure Spring Security with a starter, default credentials, role-based endpoint rules, request matchers, HTTP Basic, and CSRF settings.
Read how Spring in Action, Sixth Edition explains Spring Security →
Related concepts
- authorizationuses · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
- method-level securityuses · Method-level security is authorization enforced on individual method invocations according to the caller’s identity or authorities.
- Spring Boot starterused by · A Spring Boot starter is a curated dependency descriptor that brings together the libraries and configuration commonly needed for a particular application capability.
- Spring Boot Actuatoruses · Spring Boot Actuator is a Spring Boot module that provides production-oriented monitoring, management, operational, and application-metric endpoints.
- application securityaddresses · Application security is the discipline of protecting software applications, their data, functionality, and communications from vulnerabilities, unauthorized access, misuse, modification, and attacks.
- Nimbususes · Nimbus is a Java security library for implementing standards-based cryptographic and authentication protocols.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.