Spring Security Fundamentals
Fast recall
Quick revision
Core answer
Whether you understand Spring Security as a servlet filter chain that does authentication then authorization, and can name the core components (SecurityFilterChain, AuthenticationManager, UserDetailsService, SecurityContext).
Memorizing annotations (@PreAuthorize) without explaining the filter chain, the authentication-vs-authorization flow, or the SecurityContext that ties them.
Frame Spring Security as a servlet filter chain: a series of filters authenticates the request (producing an Authentication stored in the SecurityContext), then authorization (filters, annotations, method security) decides what that authenticated principal may do — name the components and the flow.
Interview-ready guide
Interview answer
Spring Security is the Spring ecosystem's framework for authentication and authorization, and it's implemented as a servlet filter chain that intercepts every request before the DispatcherServlet.
It exists because security is hard and easy to get wrong — hand-rolling password hashing, token validation, and per-endpoint access control is repetitive and bug-prone, and a single mistake compromises the whole app.
The flow I always describe is two steps: authentication first, where a filter reads credentials, the AuthenticationManager with a UserDetailsService and PasswordEncoder verifies them, and the resulting Authentication is stored in the SecurityContext; then authorization, where URL matchers in HttpSecurity and method security like @PreAuthorize decide what that authenticated principal may do. The SecurityContext is thread-local via SecurityContextHolder, so any layer can see who's calling.
The tension I'm honest about is security versus convenience — strict rules are safer but can break legitimate flows, so I match the security to the surface: a stateless API uses JWT or OAuth2 and usually disables CSRF, while a browser app keeps CSRF and sessions. And I always stress that authentication and authorization are distinct — confusing them is exactly what produces privilege bugs.
Spring Security Fundamentals
Direct Answer
Spring Security is the Spring ecosystem's authentication and authorization framework — a configurable servlet filter chain that intercepts requests to authenticate the caller, enforce authorization, and protect against common exploits (CSRF, session fixation). It exists because security is hard and easy to get wrong: hand-rolling authentication, password hashing, token validation, and per-endpoint authorization is repetitive and bug-prone, and a single mistake can compromise the whole app. Spring Security centralizes these concerns behind a tested, configurable filter chain with a clear extension model.
Common Mistakes & Pitfalls
Memorizing annotations (@PreAuthorize) without explaining the filter chain, the authentication-vs-authorization flow, or the SecurityContext that ties them.
Check your understanding
Answer these without looking back at the article.
- How does the SecurityFilterChain relate to the DispatcherServlet, and why is security a filter?
- What is the authentication flow from a filter to the SecurityContext, and which components cooperate?
- What is the difference between URL-level authorization (HttpSecurity) and method-level (@PreAuthorize)?
- When should CSRF be disabled, and what does that imply about the authentication model?
- How do you add a custom JWT filter to the chain, and where must it sit?
Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.