1. Concept library
  2. Java & Spring Boot
  3. Module 9: Spring Security

Concept

The security filter chain

Spring Security sits in front of your controllers as a chain of servlet filters that authenticate the request and decide whether it may proceed. You configure the chain as a bean: which paths are open, which need a login.

What a session covers

The tutor works through these with you, in conversation and code. A session ends when you have shown them, not when a video does.

  1. Explain where the filter chain sits and what each filter decides
  2. Configure a chain with public paths and authenticated paths
  3. Spot the broad matcher placed before the specific one

In practice

A few lines that show The security filter chain doing its job.

Java
@Bean
SecurityFilterChain api(HttpSecurity http) throws Exception {
    return http
        .csrf(csrf -> csrf.disable())                 // stateless API, token auth
        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/public/**", "/actuator/health").permitAll()
            .anyRequest().authenticated())
        .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
        .build();
}

The common mistake

Watch for

Ordering matchers with the broad rule first. requestMatchers("/**").authenticated() before permitAll() for public paths means the public paths are never reached; specific rules go first.

What to know first

Your roadmap puts these before The security filter chain, unless you already know them.

How it stays learned

Once a session shows you understand The security filter chain, it comes back for review. Each review takes a minute and tells the memory model how well you still know it.

  1. Day 3First recall, while it is fresh
  2. Day 7Second, a week on
  3. Day 18Last, when it has settled

Where it leads

Topics that build on The security filter chain.