Spring Security Study Material

Authentication vs Authorization

Two Different Questions

Every secure application answers two questions for every request:

	Authentication (AuthN)	Authorization (AuthZ)
Question	Who are you?	What are you allowed to do?
Happens	first	after authentication
Example	logging in with email + password, OTP, Google login	only an ADMIN can delete a product
Failure status	`401 Unauthorized`	`403 Forbidden`
Real life	showing your ID card at the office gate	your card opens floor 3 but not the server room

Note: The HTTP name 401 Unauthorized is confusing: it really means unauthenticated ("I do not know who you are"). 403 Forbidden means "I know who you are, but you may not do this".

Example

A tiny plain-Java model of both checks. Authentication finds the user from the credentials; authorization checks a permission:

import java.util.*;

public class Main {
    record User(String username, String password, Set<String> roles) {}

    static final Map<String, User> USERS = new LinkedHashMap<>();

    static User authenticate(String username, String password) {
        User u = USERS.get(username);
        if (u == null || !u.password().equals(password)) return null;   // demo only: never store plain passwords
        return u;
    }

    static String handle(String username, String password, String action, String requiredRole) {
        User user = authenticate(username, password);
        if (user == null) return action + " -> 401 Unauthorized (who are you?)";
        if (!user.roles().contains(requiredRole)) return action + " -> 403 Forbidden (" + user.username() + " lacks " + requiredRole + ")";
        return action + " -> 200 OK for " + user.username();
    }

    public static void main(String[] args) {
        USERS.put("asha", new User("asha", "asha123", Set.of("CUSTOMER")));
        USERS.put("ravi", new User("ravi", "ravi123", Set.of("CUSTOMER", "ADMIN")));

        System.out.println(handle("asha", "wrong", "View orders", "CUSTOMER"));
        System.out.println(handle("asha", "asha123", "View orders", "CUSTOMER"));
        System.out.println(handle("asha", "asha123", "Delete product", "ADMIN"));
        System.out.println(handle("ravi", "ravi123", "Delete product", "ADMIN"));
    }
}

Output

View orders -> 401 Unauthorized (who are you?)
View orders -> 200 OK for asha
Delete product -> 403 Forbidden (asha lacks ADMIN)
Delete product -> 200 OK for ravi

Principal, Credentials, Authorities

Spring Security uses a few words you will see everywhere:

Principal: the logged-in user (usually a UserDetails object or the username).
Credentials: the proof of identity, such as the password. Spring clears it after login.
Authorities: what the user may do, such as ROLE_ADMIN or product:write.
Authentication: the object that holds all three, plus an authenticated flag.

Exercise: A logged-in customer calls DELETE /api/products/7, which only admins may call. Which status code should the API return, 401 or 403? What if the request had no credentials at all?

Show answer

Logged-in customer, missing permission  -> 403 Forbidden  (authorization failed)
No credentials at all                   -> 401 Unauthorized (authentication missing)