Spring Security and Authentication

Detailed Description

Spring Security is a powerful and highly customizable authentication and access-control framework for Java applications. As the de facto standard for securing Spring-based applications, it provides comprehensive security services for both web applications and RESTful web services. At its core, Spring Security addresses two fundamental security concerns: authentication (verifying who you are) and authorization (determining what you're allowed to do). The framework integrates seamlessly with Spring Boot and other Spring projects, offering declarative security configurations that can protect your application from common vulnerabilities such as session fixation, clickjacking, cross-site request forgery (CSRF), and more.

In today's interconnected digital landscape, securing applications is not optional—it's a critical requirement. Real-world applications handling sensitive user data, financial transactions, personal health information, or proprietary business data must implement robust security mechanisms. Spring Security is used by major enterprises worldwide, from banking systems processing millions of transactions daily to e-commerce platforms managing customer accounts and payment information. Healthcare applications rely on Spring Security to ensure HIPAA compliance, while government portals use it to protect citizen data. Understanding Spring Security is essential for any Java developer building production-grade applications, as security breaches can result in devastating financial losses, legal liabilities, and irreparable damage to an organization's reputation.

The framework operates on several key concepts and principles. Authentication is the process of verifying the identity of a user, typically through credentials like username and password, tokens, or certificates. Authorization determines what an authenticated user can access, based on their assigned roles and permissions. Spring Security uses a chain of filters that intercept HTTP requests before they reach your application controllers, examining each request for security credentials and making authorization decisions. The SecurityContext holds the security information of the current user, accessible throughout the application. UserDetails represents the user information retrieved from your data source, while UserDetailsService defines how to load this information. The framework supports various authentication mechanisms including in-memory authentication, JDBC authentication, LDAP authentication, and custom authentication providers.

Common use cases for Spring Security span a wide range of application requirements. Form-based login is perhaps the most familiar, where users enter credentials through a web form. However, Spring Security also excels at securing RESTful APIs using JWT (JSON Web Tokens) or OAuth2, enabling stateless authentication for microservices architectures. Method-level security allows you to protect individual service methods with annotations, ensuring fine-grained access control. Role-based access control (RBAC) enables different user types—administrators, managers, regular users—to access different features. Remember-me functionality keeps users logged in across sessions, while password encoding ensures credentials are never stored in plain text. The framework also handles cross-cutting concerns like preventing brute-force attacks through account locking mechanisms and providing audit trails for security events.

By mastering this lesson, you will gain comprehensive skills in implementing enterprise-grade security for your Spring applications. You'll learn to configure Spring Security from scratch, creating custom authentication providers that integrate with your database. You'll understand how to define user roles and permissions, implementing sophisticated authorization rules that protect different parts of your application. You'll become proficient in creating secure login and logout functionality, managing sessions, and preventing common security vulnerabilities. Additionally, you'll learn to implement password encoding, configure CSRF protection, and create custom security expressions. Whether you're building a traditional web application or a modern REST API, these skills will enable you to confidently secure your applications against unauthorized access and common security threats.

Why Spring Security Matters

The importance of Spring Security extends beyond mere technical implementation—it represents a comprehensive approach to application security that has been battle-tested across millions of applications worldwide. The framework embodies security best practices accumulated over years of development and real-world feedback from the security community. By leveraging Spring Security, developers benefit from continuous security updates, vulnerability patches, and improvements without having to become security experts themselves. This is crucial because security is an ever-evolving field where new threats emerge constantly, and attempting to build custom security solutions often leads to vulnerabilities that attackers can exploit.

Practical Examples

Example 1: Basic Spring Security Configuration with In-Memory Authentication

This example demonstrates the fundamental setup of Spring Security with in-memory user authentication. This approach is excellent for learning, testing, and small applications where user data doesn't need to persist.


package com.example.security.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

/**
 * Basic Spring Security configuration class
 * This demonstrates fundamental security setup with in-memory users
 */
@Configuration
@EnableWebSecurity  // Enables Spring Security's web security support
public class SecurityConfig {
    
    /**
     * Configure the security filter chain
     * This method defines which endpoints are secured and which are public
     */
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            // Configure authorization rules for HTTP requests
            .authorizeHttpRequests(authorize -> authorize
                // Allow public access to home page and registration
                .requestMatchers("/", "/home", "/register").permitAll()
                // Require ADMIN role for admin endpoints
                .requestMatchers("/admin/**").hasRole("ADMIN")
                // Require USER or ADMIN role for user endpoints
                .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
                // All other requests require authentication
                .anyRequest().authenticated()
            )
            // Configure form-based login
            .formLogin(form -> form
                .loginPage("/login")           // Custom login page URL
                .defaultSuccessUrl("/dashboard", true)  // Redirect after successful login
                .permitAll()                    // Allow everyone to access login page
            )
            // Configure logout functionality
            .logout(logout -> logout
                .logoutUrl("/logout")           // URL to trigger logout
                .logoutSuccessUrl("/login?logout")  // Redirect after logout
                .invalidateHttpSession(true)    // Invalidate session on logout
                .deleteCookies("JSESSIONID")    // Delete session cookie
                .permitAll()
            );
        
        return http.build();
    }
    
    /**
     * Create in-memory user details service
     * This defines users stored in application memory (not persistent)
     */
    @Bean
    public UserDetailsService userDetailsService() {
        // Create a regular user with USER role
        UserDetails user = User.builder()
            .username("john")
            .password(passwordEncoder().encode("password123"))
            .roles("USER")
            .build();
        
        // Create an admin user with ADMIN role
        UserDetails admin = User.builder()
            .username("admin")
            .password(passwordEncoder().encode("admin123"))
            .roles("ADMIN", "USER")  // Admin has both ADMIN and USER roles
            .build();
        
        // Return an in-memory user details manager with both users
        return new InMemoryUserDetailsManager(user, admin);
    }
    
    /**
     * Password encoder bean
     * BCrypt is a strong hashing algorithm designed for passwords
     */
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Step-by-Step Explanation:

@EnableWebSecurity: This annotation enables Spring Security's web security support and provides the Spring MVC integration.
SecurityFilterChain: Replaces the older WebSecurityConfigurerAdapter pattern, providing a more flexible configuration approach.
authorizeHttpRequests: Defines which URLs are accessible to which users. We use role-based access control here.
formLogin: Configures the traditional username/password login form.
BCryptPasswordEncoder: Uses BCrypt hashing algorithm, which is computationally expensive and includes a built-in salt, making it resistant to rainbow table attacks.

Expected Output: When you start your application, Spring Security automatically protects all endpoints. Accessing "/admin/dashboard" without logging in redirects to the login page. Logging in as "john" and trying to access "/admin/dashboard" results in a 403 Forbidden error, but "admin" user can access it successfully.

Best Practice: Never hardcode passwords in production code. Use environment variables or external configuration for sensitive credentials. In-memory authentication should only be used for development and testing purposes.

Example 2: Database-Based Authentication with Custom UserDetailsService

This example demonstrates how to implement authentication using a database to store user credentials, which is the standard approach for production applications.


package com.example.security.model;

import jakarta.persistence.*;
import java.util.Set;

/**
 * User entity representing application users
 * This maps to a database table storing user information
 */
@Entity
@Table(name = "users")
public class User {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(unique = true, nullable = false)
    private String username;
    
    @Column(nullable = false)
    private String password;
    
    @Column(nullable = false)
    private String email;
    
    private boolean enabled = true;
    
    // Many-to-Many relationship with roles
    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(
        name = "user_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id")
    )
    private Set roles;
    
    // Constructors, getters, and setters
    public User() {}
    
    public User(String username, String password, String email) {
        this.username = username;
        this.password = password;
        this.email = email;
    }
    
    // Getters and setters omitted for brevity
}

/**
 * Role entity representing user roles
 */
@Entity
@Table(name = "roles")
class Role {
    
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    
    @Column(unique = true, nullable = false)
    private String name;  // e.g., "ROLE_USER", "ROLE_ADMIN"
    
    // Constructors, getters, and setters
}


package com.example.security.service;

import com.example.security.model.User;
import com.example.security.repository.UserRepository;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.core.userdetails.UsernameNotFoundException;
import org.springframework.stereotype.Service;

import java.util.Set;
import java.util.stream.Collectors;

/**
 * Custom UserDetailsService implementation
 * This loads user-specific data from the database
 */
@Service
public class CustomUserDetailsService implements UserDetailsService {
    
    @Autowired
    private UserRepository userRepository;
    
    /**
     * Load user by username from database
     * This method is called by Spring Security during authentication
     */
    @Override
    public UserDetails loadUserByUsername(String username) 
            throws UsernameNotFoundException {
        
        // Find user in database
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> 
                new UsernameNotFoundException("User not found: " + username));
        
        // Convert our User entity to Spring Security's UserDetails
        return org.springframework.security.core.userdetails.User.builder()
            .username(user.getUsername())
            .password(user.getPassword())  // Should already be encoded
            .authorities(getAuthorities(user))
            .accountExpired(false)
            .accountLocked(!user.isEnabled())
            .credentialsExpired(false)
            .disabled(!user.isEnabled())
            .build();
    }
    
    /**
     * Convert user roles to Spring Security authorities
     * Authorities are used for authorization decisions
     */
    private Set getAuthorities(User user) {
        return user.getRoles().stream()
            .map(role -> new SimpleGrantedAuthority(role.getName()))
            .collect(Collectors.toSet());
    }
}


package com.example.security.config;

import com.example.security.service.CustomUserDetailsService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.dao.DaoAuthenticationProvider;
import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

/**
 * Security configuration using database authentication
 */
@Configuration
public class DatabaseSecurityConfig {
    
    @Autowired
    private CustomUserDetailsService userDetailsService;
    
    /**
     * Configure authentication provider to use our custom UserDetailsService
     */
    @Bean
    public DaoAuthenticationProvider authenticationProvider() {
        DaoAuthenticationProvider authProvider = new DaoAuthenticationProvider();
        authProvider.setUserDetailsService(userDetailsService);
        authProvider.setPasswordEncoder(passwordEncoder());
        return authProvider;
    }
    
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authenticationProvider(authenticationProvider())
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .requestMatchers("/api/user/**").hasAnyRole("USER", "ADMIN")
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .loginProcessingUrl("/perform_login")
                .defaultSuccessUrl("/dashboard", true)
                .failureUrl("/login?error=true")
                .permitAll()
            )
            .logout(logout -> logout
                .logoutSuccessUrl("/login?logout")
                .permitAll()
            );
        
        return http.build();
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
    
    @Bean
    public AuthenticationManager authenticationManager(
            AuthenticationConfiguration authConfig) throws Exception {
        return authConfig.getAuthenticationManager();
    }
}

Step-by-Step Explanation:

User Entity: Represents a user in the database with a many-to-many relationship to roles, allowing flexible role assignments.
CustomUserDetailsService: Implements Spring Security's UserDetailsService interface to load user data from the database.
DaoAuthenticationProvider: Uses our custom UserDetailsService and password encoder to authenticate users against database credentials.
Authorities Conversion: Transforms our custom Role objects into Spring Security's GrantedAuthority objects required for authorization.

Expected Output: User credentials are now persisted in the database. When a user logs in, Spring Security queries the database through your UserDetailsService, retrieves the user, verifies the password, and loads their roles for authorization decisions throughout the application.

Common Mistake: Forgetting to prefix role names with "ROLE_" in the database. Spring Security's hasRole() method automatically adds this prefix, so if your database stores "ADMIN", hasRole("ADMIN") looks for "ROLE_ADMIN" and fails. Either store "ROLE_ADMIN" in the database or use hasAuthority("ADMIN") instead.

Example 3: JWT-Based Authentication for REST APIs

This example demonstrates stateless authentication using JSON Web Tokens (JWT), ideal for securing REST APIs and microservices.


package com.example.security.jwt;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.security.Keys;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.stereotype.Component;

import java.security.Key;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;
import java.util.function.Function;

/**
 * JWT Utility class for token generation and validation
 * Handles all JWT-related operations
 */
@Component
public class JwtTokenUtil {
    
    // Secret key should be at least 256 bits for HS256
    @Value("${jwt.secret}")
    private String secret;
    
    // Token validity duration (5 hours in milliseconds)
    private static final long JWT_TOKEN_VALIDITY = 5 * 60 * 60 * 1000;
    
    /**
     * Generate JWT token for a user
     */
    public String generateToken(UserDetails userDetails) {
        Map claims = new HashMap<>();
        // Add custom claims if needed
        claims.put("roles", userDetails.getAuthorities());
        
        return createToken(claims, userDetails.getUsername());
    }
    
    /**
     * Create JWT token with specified claims and subject
     */
    private String createToken(Map claims, String subject) {
        Date now = new Date();
        Date expirationDate = new Date(now.getTime() + JWT_TOKEN_VALIDITY);
        
        return Jwts.builder()
            .setClaims(claims)              // Set custom claims
            .setSubject(subject)            // Set username as subject
            .setIssuedAt(now)               // Set issue time
            .setExpiration(expirationDate)  // Set expiration time
            .signWith(getSigningKey(), SignatureAlgorithm.HS256)  // Sign with secret
            .compact();
    }
    
    /**
     * Get signing key from secret
     */
    private Key getSigningKey() {
        byte[] keyBytes = secret.getBytes();
        return Keys.hmacShaKeyFor(keyBytes);
    }
    
    /**
     * Extract username from token
     */
    public String getUsernameFromToken(String token) {
        return getClaimFromToken(token, Claims::getSubject);
    }
    
    /**
     * Extract expiration date from token
     */
    public Date getExpirationDateFromToken(String token) {
        return getClaimFromToken(token, Claims::getExpiration);
    }
    
    /**
     * Extract specific claim from token
     */
    public  T getClaimFromToken(String token, Function claimsResolver) {
        final Claims claims = getAllClaimsFromToken(token);
        return claimsResolver.apply(claims);
    }
    
    /**
     * Parse and retrieve all claims from token
     */
    private Claims getAllClaimsFromToken(String token) {
        return Jwts.parserBuilder()
            .setSigningKey(getSigningKey())
            .build()
            .parseClaimsJws(token)
            .getBody();
    }
    
    /**
     * Check if token has expired
     */
    private Boolean isTokenExpired(String token) {
        final Date expiration = getExpirationDateFromToken(token);
        return expiration.before(new Date());
    }
    
    /**
     * Validate token against user details and expiration
     */
    public Boolean validateToken(String token, UserDetails userDetails) {
        final String username = getUsernameFromToken(token);
        return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }
}


package com.example.security.jwt;

import com.example.security.service.CustomUserDetailsService;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import java.io.IOException;

/**
 * JWT Request Filter
 * Intercepts every request to validate JWT token
 */
@Component
public class JwtRequestFilter extends OncePerRequestFilter {
    
    @Autowired
    private CustomUserDetailsService userDetailsService;
    
    @Autowired
    private JwtTokenUtil jwtTokenUtil;
    
    /**
     * Filter logic executed for each request
     */
    @Override
    protected void doFilterInternal(HttpServletRequest request, 
                                    HttpServletResponse response, 
                                    FilterChain chain)
            throws ServletException, IOException {
        
        // Extract Authorization header
        final String requestTokenHeader = request.getHeader("Authorization");
        
        String username = null;
        String jwtToken = null;
        
        // JWT Token is in the form "Bearer token"
        if (requestTokenHeader != null && requestTokenHeader.startsWith("Bearer ")) {
            // Remove "Bearer " prefix
            jwtToken = requestTokenHeader.substring(7);
            try {
                // Extract username from token
                username = jwtTokenUtil.getUsernameFromToken(jwtToken);
            } catch (Exception e) {
                logger.error("Unable to get JWT Token or token has expired");
            }
        }
        
        // Validate token and authenticate user
        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);
            
            // If token is valid, configure Spring Security to manually set authentication
            if (jwtTokenUtil.validateToken(jwtToken, userDetails)) {
                
                UsernamePasswordAuthenticationToken authToken = 
                    new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                
                // Set authentication in security context
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        
        // Continue filter chain
        chain.doFilter(request, response);
    }
}


package com.example.security.config;

import com.example.security.jwt.JwtRequestFilter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

/**
 * JWT Security Configuration
 * Configures stateless authentication using JWT
 */
@Configuration
public class JwtSecurityConfig {
    
    @Autowired
    private JwtRequestFilter jwtRequestFilter;
    
    @Bean
    public SecurityFilterChain jwtFilterChain(HttpSecurity http) throws Exception {
        http
            // Disable CSRF for stateless API
            .csrf(csrf -> csrf.disable())
            // Configure authorization
            .authorizeHttpRequests(authorize -> authorize
                .requestMatchers("/api/auth/login", "/api/auth/register").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            // Set session management to stateless
            .sessionManagement(session -> session
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
            );
        
        // Add JWT filter before UsernamePasswordAuthenticationFilter
        http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);
        
        return http.build();
    }
}

Step-by-Step Explanation:

JwtTokenUtil: Handles JWT creation, parsing, and validation using the JJWT library. Uses HMAC-SHA256 algorithm for signing.
JwtRequestFilter: A custom filter that runs before Spring Security's authentication filter, extracting and validating JWT from the Authorization header.
Stateless Session: Sets session creation policy to STATELESS, meaning no HTTP session is created or used.
Token Structure: JWT contains header (algorithm), payload (claims including username and roles), and signature for verification.

Expected Output: After successful login at "/api/auth/login", the server returns a JWT token. Clients include this token in the Authorization header ("Bearer ") for subsequent requests. The server validates the token on each request without maintaining session state.

Security Tip: Store JWT secret in environment variables, not in code. Use sufficiently long secrets (at least 256 bits for HS256). Consider implementing token refresh mechanisms for long-lived applications and token blacklisting for logout functionality.

Example 4: Method-Level Security with Annotations

This example demonstrates fine-grained security at the method level, allowing you to protect individual service methods with annotations.


package com.example.security.config;

import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;

/**
 * Enable method-level security
 * This allows using security annotations on methods
 */
@Configuration
@EnableMethodSecurity(
    prePostEnabled = true,      // Enable @PreAuthorize and @PostAuthorize
    securedEnabled = true,       // Enable @Secured
    jsr250Enabled = true         // Enable @RolesAllowed
)
public class MethodSecurityConfig {
    // Configuration class to enable method security
}


package com.example.security.service;

import com.example.security.model.Document;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.access.prepost.PostAuthorize;
import org.springframework.security.access.annotation.Secured;
import org.springframework.stereotype.Service;

import java.util.List;

/**
 * Document service with method-level security
 * Demonstrates various security annotations
 */
@Service
public class DocumentService {
    
    /**
     * Only users with ADMIN role can create documents
     * @PreAuthorize checks authorization BEFORE method execution
     */
    @PreAuthorize("hasRole('ADMIN')")
    public Document createDocument(String title, String content) {
        Document document = new Document();
        document.setTitle(title);
        document.setContent(content);
        // Save document logic
        return document;
    }
    
    /**
     * Users can only update their own documents
     * Uses SpEL (Spring Expression Language) to check ownership
     */
    @PreAuthorize("hasRole('USER') and #document.owner == authentication.principal.username")
    public Document updateDocument(Document document) {
        // Update document logic
        return document;
    }
    
    /**
     * Users can view documents, but sensitive content is filtered
     * @PostAuthorize checks authorization AFTER method execution
     * Can filter returned data based on conditions
     */
    @PostAuthorize("returnObject.owner == authentication.principal.username or hasRole('ADMIN')")
    public Document getDocument(Long documentId) {
        // Retrieve document logic
        Document document = new Document();
        // ... fetch from repository
        return document;
    }
    
    /**
     * Delete operation requires ADMIN or MANAGER role
     * @Secured is simpler but less flexible than @PreAuthorize
     */
    @Secured({"ROLE_ADMIN", "ROLE_MANAGER"})
    public void deleteDocument(Long documentId) {
        // Delete document logic
    }
    
    /**
     * Complex authorization logic using custom SpEL expression
     * Checks if user is document owner OR has ADMIN role
     */
    @PreAuthorize("@documentSecurityService.canAccessDocument(#documentId, authentication.principal.username)")
    public Document viewDocument(Long documentId) {
        // View document logic
        return new Document();
    }
    
    /**
     * Filter returned list based on user permissions
     * Each element is checked against the expression
     */
    @PreAuthorize("hasRole('USER')")
    public List getAllDocuments() {
        // This would typically use @PostFilter to filter results
        // @PostFilter("filterObject.owner == authentication.principal.username or hasRole('ADMIN')")
        return List.of();
    }
    
    /**
     * Filter method parameters before execution
     * Removes documents user doesn't own from the input list
     */
    // @PreFilter("filterObject.owner == authentication.principal.username")
    public void processDocuments(List documents) {
        // Process only documents that pass the filter
    }
}


package com.example.security.service;

import org.springframework.stereotype.Service;

/**
 * Custom security service for complex authorization logic
 * Separates security logic from business logic
 */
@Service("documentSecurityService")
public class DocumentSecurityService {
    
    /**
     * Custom method to check document access permission
     * Can include complex business logic
     */
    public boolean canAccessDocument(Long documentId, String username) {
        // Complex logic here - could check database, cache, etc.
        // Example: check if user is document owner or in shared user list
        
        // Pseudo-code:
        // Document doc = documentRepository.findById(documentId);
        // return doc.getOwner().equals(username) || 
        //        doc.getSharedUsers().contains(username);
        
        return true; // Simplified for example
    }
    
    /**
     * Check if user can modify document
     */
    public boolean canModifyDocument(Long documentId, String username) {
        // Similar complex logic for modification permissions
        return true;
    }
}

Step-by-Step Explanation:

@EnableMethodSecurity: Activates method-level security annotations throughout the application.
@PreAuthorize: Evaluates expressions before method execution. Method only executes if expression returns true.
@PostAuthorize: Evaluates expressions after method execution. Can access return value using 'returnObject'.
Sp

Java Beginner to Advanced

Module 1: Java Fundamentals and Development Setup

Module 2: Object-Oriented Programming in Java

Module 3: Data Structures, Algorithms, and Error Handling

Module 4: Database Programming and Web Development

Module 5: Testing, Performance, and Deployment

Module 6: Advanced Topics and Real-World Projects