Securing Spring Boot Applications
Secure a Spring Boot REST API through seven progressive layers: HTTP Basic, form login, JWT, RBAC, method security, OAuth2, and audit logging. Build a real Task Management API called Vaultly.
View badge details
About This Course
Incrementally harden a Spring Boot Task Management API called Vaultly through seven security layers. You will start with an unsecured CRUD API and progressively add HTTP Basic authentication, form-based login with database-backed users, stateless JWT token authentication, role-based access control (RBAC) with ADMIN and USER roles, method-level security using @PreAuthorize and @PostAuthorize with SpEL expressions, and OAuth2/OpenID Connect resource server configuration using Keycloak. The capstone adds a full audit trail that records every authentication success and failure event. By the end you will have a deeply-secured, production-quality REST API that demonstrates every major Spring Security pattern.
Course Curriculum
14 Lessons
Spring Security Architecture
The Spring Security filter chain, SecurityFilterChain bean, DelegatingFilterProxy, authentication vs authorization, Authentication object, SecurityContextHolder, and why auto-configuration is both helpful and dangerous.
Security Architecture - Lab Exercises
Add spring-boot-starter-security to Vaultly, define a SecurityFilterChain with HTTP Basic, configure InMemoryUserDetailsManager with BCrypt-encoded passwords, and verify all endpoints require authentication.
Authentication — HTTP Basic and Form Login
When to use HTTP Basic vs form login, UserDetailsService contract, loading users from a database, BCryptPasswordEncoder, CSRF tokens, and session management.
Authentication - Lab Exercises
Replace InMemoryUserDetailsManager with a database-backed CustomUserDetailsService, create the User entity with passwordHash, implement /auth/register with BCrypt encoding, and configure form login.
JWT Token Authentication
Stateless vs stateful authentication, JWT structure (header.payload.signature), signing with HMAC-SHA256, jjwt library, JwtAuthenticationFilter placement, token expiry, and signing secret security.
JWT - Lab Exercises
Role-Based Access Control
GrantedAuthority, roles vs authorities in Spring Security, requestMatchers with hasRole(), @Secured, @RolesAllowed, and proper role seeding.
RBAC - Lab Exercises
Method-Level Security
@EnableMethodSecurity, @PreAuthorize with SpEL expressions, @PostAuthorize for ownership checks, @PreFilter/@PostFilter, accessing the principal in SpEL, and why method security complements URL security.
Method-Level Security - Lab Exercises
OAuth2 and OpenID Connect
OAuth2 flows (authorization code, client credentials), OpenID Connect ID tokens, JWT resource server validation, spring-boot-starter-oauth2-resource-server, jwk-set-uri, issuer-uri, and scopes as authorities.
OAuth2 Resource Server - Lab Exercises
Capstone Briefing: Vaultly Security Audit
Capstone Project: Implement Vaultly Audit Logging
This course includes:
- 24/7 AI Instructor Support
- Live Lab Environments
- 7 Hands-on Lessons
- Completion Badge
Earn Your Badge
Complete all lessons to unlock the Spring Security and Authentication achievement badge.
Spring Security and Authentication
Awarded for completing the Spring Security course, demonstrating mastery of authentication, JWT tokens, OAuth2, and role-based access control in Spring applications.
Skills You'll Earn
Complete all lessons in this course to earn this badge