Careeroza
Why Spring Security
What Is Spring Security?
Spring Security is the standard security framework for Spring applications. It plugs into every HTTP request through servlet filters and gives you authentication, authorization and protection against common attacks with very little code.
- Many login styles: form login, HTTP Basic, JWT, OAuth2/OpenID Connect (Google login), LDAP, SAML.
- Authorization: rules per URL and per method (
@PreAuthorize). - Password storage: BCrypt, Argon2, PBKDF2, SCrypt encoders.
- Attack protection by default: CSRF tokens, session fixation protection, secure headers (clickjacking, MIME sniffing, HSTS).
- Well tested: maintained by the Spring team and used by banks, telecoms and governments.
Why Not Write It Yourself?
| Hand-written security | Spring Security |
|---|---|
if (session.getAttribute("user") == null) in every controller | one central rule list, nothing to forget |
| passwords hashed with MD5 or SHA-1 (or not at all) | BCrypt with salt and cost factor |
| no CSRF protection | CSRF token on by default |
| custom bugs nobody reviewed | years of security reviews and CVE fixes |
Tip: Security is the one area where "I will build my own" is almost always the wrong choice. Use the framework, learn how it works, and customise it.
Where It Is Used
Almost every Spring Boot backend you will work on uses Spring Security: banking and UPI backends (login, OTP, transaction APIs), e-commerce sites like ShopEase (customer accounts, admin panels), internal HR and payroll portals (SSO with the company identity provider), and microservices that validate JWTs from Keycloak or Auth0.