Securing APIs with Spring Security Basics

Introduction

An API with no security is one bad day away from a serious incident. Spring Security is the standard way to add authentication and authorization to a Spring Boot application, and Boot's auto-configuration makes it remarkably easy to get a reasonable baseline of protection with almost no code. In this lesson you will add the security starter, see what happens by default the moment it is on the classpath, and write your own SecurityFilterChain to control access explicitly.

Adding the Security Starter

Add spring-boot-starter-security to your dependencies. Unlike most starters, this one changes application behavior immediately - simply having it on the classpath locks down every endpoint by default.

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Default Login Behavior

With no configuration at all, Spring Boot generates a random password at startup, prints it to the console, and secures every endpoint with HTTP Basic and a form login, using a default username of user.

curl -u user:8f2c1a9e-4b77-4e5a-9c31-77a0c9a441de http://localhost:8080/api/tasks

This default is only ever meant as a signal that security is active and working - it is never something to rely on beyond initial testing. Real applications define their own users (or delegate to an identity provider) and their own access rules.

A Basic SecurityFilterChain

Modern Spring Security configuration is done by declaring a SecurityFilterChain bean rather than extending a base configuration class. The example below allows public access to authentication endpoints while requiring a valid login for everything else.

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/actuator/health").permitAll()
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults())
            .csrf(csrf -> csrf.disable());

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Password Encoding

Passwords must never be stored in plain text. Spring Security's PasswordEncoder abstraction hashes passwords with a strong, salted algorithm; BCryptPasswordEncoder is the standard default choice.

@Service
public class UserRegistrationService {

    private final UserRepository userRepository;
    private final PasswordEncoder passwordEncoder;

    public UserRegistrationService(UserRepository userRepository, PasswordEncoder passwordEncoder) {
        this.userRepository = userRepository;
        this.passwordEncoder = passwordEncoder;
    }

    public User register(String username, String rawPassword) {
        User user = new User();
        user.setUsername(username);
        user.setPassword(passwordEncoder.encode(rawPassword));
        return userRepository.save(user);
    }
}

CSRF and Stateless APIs

CSRF (Cross-Site Request Forgery) protection is designed for browser-based, session-authenticated applications where a form submission could be forged by another site. A stateless REST API authenticated with tokens (such as JWT) rather than cookies is not vulnerable to CSRF in the same way, which is why the example above disables it - but that decision should be deliberate, not accidental.

Common Mistakes

Best Practices

Frequently Asked Questions

Key Takeaways

Summary

Spring Security gives Boot applications a secure-by-default posture the moment the starter is added, and a SecurityFilterChain bean is where you take explicit control of what is public and what requires authentication. The next lesson builds on this foundation with a real login and authentication flow.