The Big Picture · Spring Security Architecture in Spring Security | Spring Security

The Big Picture

Security Lives in Filters

Spring Security does not touch your controllers. It sits in front of them as a chain of servlet filters. A filter sees every request before the DispatcherServlet and can let it through, change it, or stop it with 401/403.

HTTP request
    |
    v
+------------------------- Servlet container (Tomcat) -------------------------+
|  Filter  ->  Filter  ->  DelegatingFilterProxy  ->  Filter  ->  ...          |
|                               |                                              |
|                               v                                              |
|                     FilterChainProxy  (bean "springSecurityFilterChain")    |
|                               |  picks the first matching chain             |
|                               v                                              |
|                     SecurityFilterChain                                      |
|                     [ SecurityContextHolderFilter -> CsrfFilter ->           |
|                       LogoutFilter -> UsernamePasswordAuthenticationFilter ->|
|                       BasicAuthenticationFilter -> AnonymousAuthentication-  |
|                       Filter -> ExceptionTranslationFilter ->               |
|                       AuthorizationFilter ]                                  |
+-------------------------------|----------------------------------------------+
                                v
                       DispatcherServlet -> ProductController

The Main Pieces

Component	Job
`DelegatingFilterProxy`	a normal servlet filter registered with Tomcat that hands the request to a Spring bean
`FilterChainProxy`	the Spring bean that holds all `SecurityFilterChain`s and picks one per request
`SecurityFilterChain`	an ordered list of security filters for matching URLs (you define it as a `@Bean`)
`AuthenticationManager`	takes a login attempt and returns an authenticated user or throws
`AuthenticationProvider`	does the actual check for one login type (e.g. username + password against the DB)
`UserDetailsService`	loads a user by username
`PasswordEncoder`	hashes and verifies passwords
`SecurityContextHolder`	stores the logged-in user for the current request