Chapter plan
What you will complete
01Trace a Request Through the Security Filter ChainUnderstand chain matching, authentication filters, exception translation, and `AuthorizationFilter` ordering.Define component-based `SecurityFilterChain` beansInspect the active filters for one requestPlace custom filters intentionally rather than guessing an order 50 min02Choose Sessions, JWTs, and Refresh Tokens by Threat ModelCompare server-side sessions with self-contained bearer access tokens and design refresh rotation.Hash passwords with an adaptive one-way functionKeep access tokens short lived and validate all required claimsTreat refresh tokens as high-value credentials with replay detection 50 min03Enforce Permissions, CORS, and CSRF CorrectlySeparate origin policy, cross-site request forgery defenses, URL rules, and method-level authorization.Return 401 for missing or invalid authentication and 403 for insufficient authorityKeep CSRF enabled for browser flows using automatically attached credentialsModel authorities around actions, not UI labels 45 min04Use OAuth 2.0 and OpenID Connect Without Reinventing LoginUnderstand authorization servers, clients, resource servers, scopes, ID tokens, and access tokens.Use OIDC for user identity and OAuth2 access tokens for APIsValidate issuer and audience at the resource serverKeep provider-specific claims behind an application mapping 50 min05Production Implementation: Protected Task APIShip the security slice end to end: stateless filter chain, bcrypt hashing, scoped authorities, and tests that pin every denied path.Declare one lambda-style SecurityFilterChain with ordered matchersHash passwords with a delegating bcrypt encoderProve 401 versus 403 paths in MockMvc 50 min
Module outcome
Secure an API with least-privilege rules and explain every trust boundary.
Mental model
Filters establish an `Authentication`; authorization rules decide whether that authenticated principal may cross a boundary.
Module checkpoint
Protected task API
Add account login, short-lived access tokens, refresh rotation, and permission checks.
- Password hashing
- 401 versus 403 tests
- Revocation and refresh threat model
Final module assessment
Ready to prove mastery?
Complete all 50 questions after finishing the module lessons and checkpoint.