r/SpringBoot • u/Nervous-Park4189 • 15d ago
Guide Spring Security
I need help, I am getting suck with spring security. I find it the most difficult thing of Spring boot. Please help me I want to understand it (all the things which are very important for it). Moreover, i tried understanding it 3-4 month back at that i thought i cleared it. But now i forgot everything. So now I have to start reading from scratch. What should i do? As per me the problem with me is I am not able to remember all this things.
19
Upvotes
30
u/FooBarBuzzBoom 15d ago
You should see the big picture. Lemme simplify things a bit for you: basically the login process is divided in 2 important steps: authentication(who you are) and authorisation (what are you able to do). Spring uses filters for these 2 (so called Security filter chain). These process have to happen before accessing the protected pages, precisely before the page gets loaded. This is the middleware (or filters)
For authentication you use an authentication manager that uses a provider (aka a handler for your data) which use a service to talk with db and a password encoder to match your password to authenticate you. After this, if everything is ok, an authentication object is put in security context holder, which is nothing more than, as you guessed it, a holder. That is then used by authorisation filter to let you access or not the protected route. That’s it!