Spring Security is an open-source framework that secures Spring applications at the application layer. It addresses authentication, authorization, access control, and protection against common attacks while helping developers treat security as a cross-cutting concern from the beginning of development. section 1.1 section 1.2
The framework supports standard web servlets, reactive applications, and non-web applications. It simplifies security configuration but does not secure an application automatically; developers must configure and customize it around functional requirements and architecture. section 1.1 section 1.5
Spring Security is used to:
- Implement authentication and authorization for Spring applications. section 1.1
- Apply access-control rules and protect application resources from common attacks. section 1.1
- Secure different application layers using practices suited to each layer. section 1.2
- Support OAuth 2 and OpenID Connect flows, including authorization servers, resource access, and client applications. section 1.4 section 14.0
- Test endpoint, method-level, and reactive security integrations. section 18.0 section 17.0
Incremental Spring application security
Begin with a Spring Boot application using Spring Security’s default configuration, then override the defaults that do not match the application. Extend the same approach to an OAuth 2 authorization server, an OAuth 2 client for backend communication, reactive applications, and automated security tests. section 2.0 section 14.0 section 16.0 section 18.0
Figure 1.3 We implement security in a hierarchical manner, with each layer building on the foundation of the previous one. This book focuses on explaining how to use Spring Security, a framework that provides application-level security at the very top layer.
Security is implemented hierarchically, with Spring Security providing application-level protection at the top layer. section 1.2
