Spring Security is a Spring framework for protecting applications through authentication, authorization, API security, and related security mechanisms. Its scope spans common application security needs, from basic login protection to securing operational endpoints. section 1.4.4
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
Add the Spring Boot security starter to the build; autoconfiguration then supplies a basic security setup and login page. section 5.1
A minimal Spring Boot setup immediately provides:
- Authentication for all HTTP request paths. section 5.1
- A plain login form shown when an unauthenticated user visits the application. section 5.1
- A generated username and password, with the password written to the application log. section 5.1
Protecting Actuator endpoints
Secure operational endpoints with Spring Security rather than Actuator itself. Require ROLE_ADMIN and use EndpointRequest to match Actuator endpoints without hardcoding their base path; selected endpoints can be excluded or targeted. section 15.4
The same approach secures a Spring Boot Admin server. Configure administrative credentials, present the default login form, and disable CSRF when it prevents client registration; richer security schemes remain available. section 16.3.1
Reactive applications use Spring Security 5 with a programming model that remains broadly similar to security for nonreactive Spring MVC applications. section 12.6
