Fundamentos de Spring Security
Configure Spring Security, comprenda su arquitectura e implemente una autenticación básica en memoria.
Fundamentos de Spring Security es una lección gratuita de Spring Boot 4 Complete Guide en CoddyKit. Esta es la lección 1 de 4. Puedes leer la lección completa abajo gratuitamente — luego la practicas en el navegador con un editor de código integrado y un tutor de IA 24/7. Forma parte de la ruta de aprendizaje de Spring Boot 4 Complete Guide, y tu progreso se sincroniza en la web y la app de CoddyKit. El curso de Spring Boot 4 Complete Guide incluye 4 lecciones en total.
Partes de esta lección aún no han sido traducidas y se muestran en inglés.
Welcome to Spring Security!
Securing web applications is crucial in today's digital world. Spring Security is a powerful and highly customizable authentication and access-control framework for Spring applications.
It provides robust security features, allowing you to protect your application from common vulnerabilities and control who can access what.
Why Spring Security?
Imagine building an online store. You need to:
- Authenticate users: Verify a user's identity (login).
- Authorize actions: Determine what a user can do (e.g., only admins can delete products).
- Protect against threats: CSRF, XSS, session fixation.
Spring Security handles all these complex tasks, letting you focus on your application's core logic.
Adding the Security Dependency
To get started, you just need to add the spring-boot-starter-security dependency to your project. This starter brings in all necessary Spring Security modules.
For Maven, add this to your pom.xml:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>Default Security in Action
Once the dependency is added, Spring Boot automatically configures basic security. Try running this simple application:
package com.coddykit;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@SpringBootApplication
@RestController
public class SecurityApp {
public static void main(String[] args) {
SpringApplication.run(SecurityApp.class, args);
}
@GetMapping("/hello")
public String hello() {
return "Hello, Secured World!";
}
}Default Login & Password
When you run the previous code with the Spring Security dependency, you'll notice something:
- Accessing
/helloredirects you to a login page. - Spring Security generates a random password, printed in the console at startup.
The username is typically user, and the password is the generated one. This is basic, out-of-the-box security!
AuthN vs. AuthZ
Let's clarify two fundamental concepts:
- Authentication (AuthN): Verifying who you are. This is typically done with credentials like username/password.
- Authorization (AuthZ): Determining what you are allowed to do once authenticated. For example, a user might be authenticated, but only an 'admin' role can delete data.
Spring Security handles both!
The Security Filter Chain
At its core, Spring Security works by intercepting HTTP requests. It uses a series of filters, called the Security Filter Chain, to apply security logic.
When a request comes in, these filters perform tasks like authentication, authorization, session management, and more, before the request even reaches your controller.
Basic In-Memory Authentication
For simple applications or testing, you can define users directly in your application's memory. This is called in-memory authentication.
You'll configure a UserDetailsService bean that provides user details. Let's see how to define a custom user with a specific role.
Configuring In-Memory Users
Here's how to define a user 'john' with password 'pass' and role 'USER'. Remember to encode passwords!
package com.coddykit;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@SpringBootApplication
@RestController
@EnableWebSecurity
public class SecurityConfigApp {
public static void main(String[] args) {
SpringApplication.run(SecurityConfigApp.class, args);
}
@GetMapping("/public")
public String publicAccess() {
return "This is a public page!";
}
@GetMapping("/user")
public String userAccess() {
return "Welcome, authenticated user!";
}
@Configuration
static class WebSecurityConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.requestMatchers("/public").permitAll()
.requestMatchers("/user").hasRole("USER")
.anyRequest().authenticated()
)
.formLogin(login -> login
.permitAll()
);
return http.build();
}
@Bean
public UserDetailsService userDetailsService(PasswordEncoder passwordEncoder) {
UserDetails user = User.builder()
.username("john")
.password(passwordEncoder.encode("pass"))
.roles("USER")
.build();
return new InMemoryUserDetailsManager(user);
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
}Testing In-Memory Users
Run the previous application. Now try accessing:
http://localhost:8080/public: Should be accessible without login.http://localhost:8080/user: Should redirect to login. Use username 'john' and password 'pass'.http://localhost:8080/admin: Should redirect to login, then show 403 Forbidden even after logging in as 'john', because 'john' doesn't have the 'ADMIN' role.
Quick Check: Spring Security
You've learned about the basics of Spring Security and in-memory authentication. Let's test your understanding.
Lesson Summary
Great job! In this lesson, you've taken your first steps with Spring Security:
- Understood its purpose and core concepts (AuthN, AuthZ).
- Added the necessary dependency and observed default behavior.
- Learned about the Security Filter Chain.
- Implemented basic in-memory authentication with custom users and role-based URL protection.
Next, we'll explore how to handle authentication and authorization using databases and more advanced techniques!
Aprende Java con un tutor de IA — gratis
Escribe y ejecuta código real en tu navegador, obtén ayuda instantánea de un tutor de IA disponible 24/7 y continúa donde lo dejaste en la web o en la aplicación.
- Cursos
- 21
- Lecciones
- 84
Preguntas frecuentes
¿La lección «Fundamentos de Spring Security» es gratis?
Sí — el texto completo de «Fundamentos de Spring Security» es gratis para leer aquí en la web. Para practicarla de forma interactiva (editor de código integrado y tutor de IA 24/7) y desbloquear el resto del curso de Spring Boot 4 Complete Guide, actualiza a CoddyKit PRO. El curso de Spring Boot 4 Complete Guide incluye 4 lecciones en total.
¿Qué aprenderé en «Fundamentos de Spring Security»?
Configure Spring Security, comprenda su arquitectura e implemente una autenticación básica en memoria. Practicas Spring Boot 4 Complete Guide con código real que ejecutas directamente en el navegador, y un tutor de IA 24/7 responde tus preguntas mientras trabajas en la lección.
¿Necesito experiencia previa para empezar Spring Boot 4 Complete Guide?
No se requiere experiencia previa. Spring Boot 4 Complete Guide en CoddyKit está estructurado para principiantes hasta estudiantes avanzados, así que puedes empezar aquí o desde el inicio y avanzar a tu ritmo. Esta es la lección 1 de 4.
¿Cuánto tiempo toma la lección «Fundamentos de Spring Security»?
La mayoría de las lecciones de CoddyKit toman alrededor de 5–10 minutos. Cada una es compacta e interactiva, así que avanzas constantemente y retomas exactamente por donde dejaste en la web y la app.
¿Puedo escribir y ejecutar código en esta lección de Spring Boot 4 Complete Guide?
Sí. Cada lección de Spring Boot 4 Complete Guide incluye un editor de código integrado, así que escribes y ejecutas código real directamente en tu navegador y obtienes retroalimentación instantánea de IA — sin configuración local necesaria.
Todas las lecciones de este curso
- Fundamentos de Spring Security
- Autenticación y autorización
- Seguridad basada en JWT
- Integración de OAuth2 e inicio de sesión social