How Spring Security Handles Authentication – Java Fresher

Direct Answer

Spring Security authenticates through a SecurityFilterChain chosen for the request. A filter or another authentication mechanism creates an Authentication request and passes it to an AuthenticationManager, commonly ProviderManager. A matching AuthenticationProvider validates it; DaoAuthenticationProvider uses UserDetailsService and PasswordEncoder for username/password authentication. On success, Spring stores the authenticated result in a SecurityContext. Failure handling depends on the mechanism: an API may return 401, while form login commonly redirects to a failure page.

Deep Dive & Architecture

The filter chain does not contain one universal authentication filter. Spring selects a SecurityFilterChain and each configured mechanism contributes its own filter or request converter. UsernamePasswordAuthenticationFilter handles a form-login style request; BasicAuthenticationFilter handles HTTP Basic; BearerTokenAuthenticationFilter handles bearer tokens when Resource Server is configured.

The Authentication object initially carries the supplied credential in an unauthenticated form. ProviderManager asks providers that support its token type. DaoAuthenticationProvider loads UserDetails and validates the password through PasswordEncoder. A successful provider returns an authenticated object whose authorities can be used by authorization.

A SecurityContextRepository decides whether the context is saved between requests. A session-based login can persist it in an HTTP session. With a stateless bearer API, the context is normally rebuilt for each request and cleared afterward. Failure is handed to the mechanism's configured handler, so it is not universally a 401 response.

Code Example

@Service
public class JpaUserDetailsService implements UserDetailsService {
    private final UserRepository repo;
    JpaUserDetailsService(UserRepository repo) { this.repo = repo; }

    @Override
    public UserDetails loadUserByUsername(String username) {
        User u = repo.findByUsername(username)
            .orElseThrow(() -> new UsernameNotFoundException(username));
        return org.springframework.security.core.userdetails.User
            .withUsername(u.getUsername())
            .password(u.getPasswordHash())          // BCrypt hash from DB
            .authorities("ROLE_" + u.getRole())
            .build();
    }
}

@Bean
PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder(); // DaoAuthenticationProvider uses this to verify
}

You supply how to load a user and how to check the password; Spring orchestrates the rest.

Common Mistakes & Pitfalls

• Authenticating in the controller: identity verification belongs in the filter chain, not your handler.
• No PasswordEncoder bean: causes There is no PasswordEncoder mapped for the id "null" at runtime.
• Comparing raw passwords: never equals() passwords — use PasswordEncoder.matches.
• Returning null from loadUserByUsername: throw UsernameNotFoundException instead.
• Confusing AuthenticationManager and AuthenticationProvider: the manager delegates; the provider does the actual check.