Your cart is empty.
Keep shopping
Teach on Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn MoreSpring Security Zero to Master along with JWT,OAUTH2
Spring Security Zero to Master along with JWT,OAUTH2
Spring Security , SpringBoot Security, CORs,CSRF,JWT, OAUTH2, OpenID Connect, KeyCloak, Spring Authorization Server
Bestseller
Role Play
Created byEazy Bytes, Madan Reddy
Last updated 1/2026
English
Arabic [Auto],Bulgarian [Auto],
What you'll learn
- Spring Security framework details and it features.
- How to adapt security for a Java web application using Spring Security
- What is CSRF, CORS, JWT, OAUTH2
- Applying authorization rules using roles, authorities inside a web application using Spring Security
- Method level security in web/non-web applications
Explore related topics
Course content
17 sections • 161 lectures • 24h 37m total length
- Course Introduction8:23
Welcome to this course ! Let me explain what is the agenda of this course
- Details of Source Code, PDF Content & other instructions for the course1:01
- IntelliJ IDEA Ultimate0:59
- Creating a simple Spring Boot app with out security - Part 19:49
Build a Spring Boot web application and secure backend APIs with Spring Security, exploring start.spring.io setup, Java versions, Maven, dev tools, and essential IDE workflows.
- Creating a simple Spring Boot app with out security - Part 29:11
Create a simple spring boot rest API by renaming the main class to EasyBankBackendApplication, adding WelcomeController with a /welcome get endpoint, and configure logging patterns and port 8080.
- Securing Spring Boot basic app using Spring Security & static credentials15:04
Add the spring security starter, then configure static credentials in application properties to secure a spring boot web app; define spring.security.user.name and spring.security.user.password for login.
- Funny memes on Security5:42
Learn why security matters for web applications, explore encryption, hashing, and base64 encoding, understand different securities, and see how spring security helps, with memes illustrating common pitfalls.
- What is Security & Why it is important12:36
In this video, we will discuss on what is security and why it is important for any web application
- Quick introduction to Servlets & Filters6:33
- Introduction to Spring Security Internal flow - Theory16:00
This video will explain how Spring Security process a income request internally every time and the architecture associated to it
- Demo of Spring Security internal flow - Part 19:35
This lecture demonstrates Spring Security internal flow with a Spring Boot app, showing how the authorization filter blocks unauthenticated access and redirects to a generated login page.
- Demo of Spring Security internal flow - Part 215:00
- Sequence flow of the Spring Security default behaviour4:25
Discover the default Spring Security sequence flow: client, filters, UsernamePasswordAuthenticationFilter, ProviderManager, DaoAuthenticationProvider, InMemoryUserDetailsManager, PasswordEncoder, and the security context enabling the rest API.
- Understanding on how multiple requests work with out credentials5:06
In this video, we will see how spring security framework works in the case of multiple requests after authentication where it will not ask for credentials again and again.
- "Getting started with Spring Security" quiz
- Understanding about UI part of the EazyBank application9:20
- Creating backend services needed for the EazyBank application12:34
Build and rename the EasyBank backend APIs with Spring Security, creating controllers for account, balance, cards, loans, contact, and notices, and securing endpoints while planning public versus secure configurations.
- Checking the default configuration inside the spring security framework8:29
Examine the default spring security configuration and its http security filter chain. Learn to customize with a security filter chain bean, including form login, http basic, and oauth2 login.
- Modifying the security config code as per our custom requirements11:24
Learn to balance api security by using requestMatchers with authenticated() and permitAll() for apis like myAccount, myBalance, myLoans, and myCards, while notices, contact, and /error remain accessible.
- How to disable formLogin and httpBasic authentication12:38
Learn how to disable formLogin and httpBasic in a Spring Boot web app, switch to lambda-based configuration, and understand the role of BasicAuthenticationFilter and UsernamePasswordAuthenticationFilter when securing REST APIs.
- httpBasic authentication testing using postman10:15
- Quiz related to "Understanding & Changing the default security configurations"
- Configuring users using InMemoryUserDetailsManager15:02
Learn to configure multiple in-memory users in a Spring Boot security app using InMemoryUserDetailsManager and UserDetailsService, including user and admin credentials, authorities, and no password encoder for quick demos.
- Configuring PasswordEncoder using PasswordEncoderFactories12:45
- Demo of CompromisedPasswordChecker8:37
- Deep Dive of UserDetailsService & UserDetailsManager Interfaces14:59
Explore how Spring Security models end users with UserDetails and manages them via UserDetailsService and UserDetailsManager, including loadUserByUsername, createUser, updateUser, deleteUser, changePassword, and userExists, with InMemoryUserDetailsManager, JdbcUserDetailsManager, and LdapUserDetailsManager implementations.
- Deep Dive of UserDetails & Authentication interfaces17:04
- Design Discussion: Securing the Demo App with out a database
- Quiz related to "Defining & Managing Users using InMemoryUserDetailsManager"
- Quick revision of enhancements done so far1:42
Review enhancements to the spring boot app: add security dependency and configure users in properties. Use in-memory authentication with multiple users via InMemoryUserDetailsManager and prepare for database-backed authentication.
- Creating MySQL Database using Docker10:07
- Understanding JdbcUserDetailsManager & creating Users inside the DB9:35
- Using JdbcUserDetailsManager to perform authentication11:25
- Creating our own custom tables for Authentication5:57
Create a custom authentication table named customer with an auto-increment id, email as username, PWD for passwords, and a role, then update Spring Security to use it.
- Creating JPA Entity and repository classes for new table14:14
- Creating our own custom implementation of UserDetailsService14:30
- Building a new REST API to allow the registration of new User17:01
- Quiz related to "Defining & Managing Users using a database"
- How our passwords validated with out PasswordEncoders7:46
Learn how passwords are hashed with a bcrypt PasswordEncoder in Spring Security, using a delegating PasswordEncoder, and why plain text storage is dangerous.
- What is Encoding, Decoding & why it is not suitable for passwords management8:03
Explore encoding, decoding, encryption, and hashing. Understand why encoding is unsuitable for password management while discussing data masking and privacy.
- What is Encryption, Decryption & why it is not suitable for passwords management10:29
- Demo of Encryption, Decryption5:50
Demonstrate encryption and decryption with openssl aes-256-cbc, using secret key 12345 and pbkdf2, illustrating plain.txt to encrypted.txt and decrypt.txt, plus base64 encoding and a note on hashing.
- Introduction to Hashing9:43
- Drawbacks of Hashing & what are Brute force attacks, Dictionary or Rainbow tab13:15
Explore hashing drawbacks for password management, including identical hashes for identical inputs and the speed of attacks. See how brute force, dictionary, and rainbow table attacks threaten security.
- How to overcome Hashing drawbacks, Brute force and Dictionary table attacks14:17
- Introduction to PasswordEncoders in Spring Security8:15
Understand how password encoders add random salt and slow hashing to secure passwords. Learn about bcrypt, scrypt, argon2, and pbkdf2, and how encode, matches, and upgradeEncoding manage credentials.
- Deep dive of PasswordEncoder implementation classes15:14
- Demo of registration and login with Bcrypt password encoder10:32
- Security Design Review – Password Storage Strategy for HealthBridge App
- Quiz related to Password Management in Spring Security
- Why should we consider creating our own AuthenticationProvider8:51
- Understanding AuthenticationProvider methods10:29
- Implementing and Customizing the AuthenticationProvider inside our application13:14
- Environment specific Security configurations using Profiles - Part 14:03
Leverage Spring Boot profiles to conditionally load security configurations and authentication rules across production and lower environments, including conditional login behavior for testers and developers.
- Environment specific Security configurations using Profiles - Part 213:15
Learn to configure environment-specific properties in Spring Boot with profiles and multiple property files, activate prod via spring.profiles.active or environment variables, and apply external overrides for logs and credentials.
- Environment specific Security configurations using Profiles - Part 37:01
Activate prod and non-prod security configurations with @Profile based beans like EazyBankProdUsernameAuthenticationProvider and EazyBankUsernamePwdAuthenticationProvider, enforcing password validation in prod and bypassing it otherwise.
- Authentication Logic by Environment: Your Strategy
- Quiz related to AuthenticationProvider in Spring Security
- Accepting only HTTPS Traffic using Spring Security9:08
- Exception Handling in Spring Security framework12:26
- Defining Custom AuthenticationEntryPoint - Part 113:59
Define a custom authentication entry point for http basic to handle 401 errors in microservices, adding a bespoke header ezaybank-error-reason and a customizable json response.
- Defining Custom AuthenticationEntryPoint - Part 24:27
Configure authentication entry points in Spring Security using httpBasic and global exceptionHandling with a CustomBasicAuthenticationEntryPoint; learn why formLogin bypasses global entry points and when to apply global configuration.
- Defining Custom AccessDeniedHandler7:17
Implement a custom access denied handler in Spring Security 6 by creating CustomAccessDeniedHandler, overriding handle() to return 403 with an ezbank-denied-reason header, and configure it globally.
- Session Timeout & invalid session configurations11:00
- Concurrent Session Control configurations9:45
Control concurrent sessions in Spring Security by configuring maximumSessions and maximumSessionsPreventsLogin, demonstrating one or multiple sessions, session expiry, and optional expiredURL handling.
- Session Fixation Attack protection with Spring Security15:43
Explore session hijacking and session fixation, and learn how Spring Security protects sessions by default with changeSessionId and how to configure session fixation strategies.
- Listening Authentication Events - Theory4:21
Listen to how Spring Security publishes authentication events, including AuthenticationSuccessEvent and AuthenticationFailureEvent, and implement event listeners with @EventListener to log, email, or audit login outcomes.
- Listening Authentication Events - Demo10:16
Learn how spring security publishes authentication success and failure events via the provider manager and the default event publisher, and how to listen with event listeners to log login outcomes.
- Form Login Configurations for MVC or monolithic apps - Part 17:03
Master formLogin() customization in Spring Security to define a custom login page and post authentication flow, as demonstrated in the EazySchool MVC app.
- Form Login Configurations for MVC or monolithic apps - Part 210:25
Configure form login in spring security 6 mvc apps, including disabling csrf and permitting static assets. Route to a custom login page to secure the dashboard and avoid redirect loops.
- Form Login Configurations for MVC or monolithic apps - Part 311:14
- Form Login Configurations for MVC or monolithic apps - Part 412:12
Configure form login in MVC apps with defaultSuccessUrl and failureUrl, then implement custom authentication success and failure handlers to redirect to dashboard or show login errors.
- Logout Configurations for MVC or monolithic apps5:29
Configure logout behavior in Spring Security with http.logout(), show 'you have been successfully logged out' via the logout success URL, and clear session, authentication, and delete J Session ID cookie.
- Spring Security Thymeleaf integration10:44
Learn how to integrate Spring Security with Thymeleaf to conditionally render header navigation. Use the Thymeleaf security dialect to check isAuthenticated and isAnonymous, and retrieve authentication and principal details.
- Role of SecurityContext & SecurityContextHolder11:32
- Load login user details in Spring Security5:15
Learn how to load the current authenticated user in Spring Security using SecurityContextHolder or a method parameter, and access name and authorities in controllers or services.
- Quiz related to "Spring Security customizations for most common use cases"
- Setting up the EazyBank UI project11:15
Setting up the EazyBank UI project
- Understanding and walkthrough of the Angular code - Part 116:05
- Understanding and walkthrough of the Angular code - Part 215:30
Explore how an Angular frontend calls backend APIs via observables, implements login, session storage, and route guards, and uses an HTTP interceptor to attach credentials for Spring Security.
- Creating new DB schema for EazyBank scenarios11:41
- Updating Backend project based on the latest DB schema19:13
Update backend to reflect the latest db schema with entity models and repositories, including findByCustomerId and jpql queries for notices, and implement cache control for responses.
- Testing registration of the new user with latest changes7:19
- Taste of CORs error5:43
- Introduction to CORs8:18
- Possible options to fix the CORs issue9:11
Explore cross-origin communication fixes for the ui and backend, using @CrossOrigin with specified origins and then spring security cors configuration to handle preflight requests and headers.
- Fixing CORs issue using Spring Security8:27
- Demo of default CSRF protection inside Spring Security5:14
- Introduction to CSRF attack8:37
- Solution to handle CSRF attacks8:10
- Implementing CSRF token solution inside backend application - Part 112:08
Learn how Spring Security represents and generates CSRF tokens with CsrfToken and CookieCsrfTokenRepository, storing in cookies via a custom CSRF cookie filter exposing XSRF-TOKEN and X-XSRF-TOKEN.
- Implementing CSRF token solution inside backend application - Part 210:58
Configure the backend to generate a CSRF token at login and expose it as a cookie read by CSRF filter via CsrfTokenRequestAttributeHandler. Validate requests with the X-XSRF-TOKEN header and jsessionId.
- Implementing CSRF token solution inside UI application9:46
- Ignoring CSRF protection for public APIs6:13
- Quiz related to CORs & CSRF
- Authentication Vs Authorization8:15
- How Authorities stored inside Spring Security7:35
Explain how Spring Security stores authorities with GrantedAuthority and SimpleGrantedAuthority, and how UserDetails and Authentication carry these authorities through unmodifiable collections and UsernamePasswordAuthenticationToken.
- Creating new table authorities to store multiple roles or authorities4:15
- Making backend changes to load authorities from new DB table12:06
- Configuring Authorities inside web application using Spring Security12:32
- Authority Vs Role in Spring Security6:52
- Configuring Roles Authorization inside web application using Spring Security6:29
Define and assign user roles for role-based authorization in a Spring Security web app, and use hasRole/hasAnyRole without ROLE_ prefix in ProjectSecurityConfig.
- Listening to the Authorization events7:45
- Securing Endpoints with Roles – Your Plan ?
- Quiz related to Authentication & Authorization
- Demo of Inbuilt Filters of Spring Security framework12:46
- How to create and configure our own custom filter13:17
- Adding a custom filter using addFilterBefore() method14:41
- Adding a custom filter using addFilterAfter() method5:56
Create and configure a custom post-authentication filter, AuthoritiesLoggingAfterFilter, using addFilterAfter() to log the authenticated user and authorities after the BasicAuthenticationFilter.
- Adding a custom filter using addFilterAt() method6:20
- Quiz related to Filters in Spring Security
Requirements
- Java
- Basics of Spring framework
Description
'Spring Security Zero to Master' course will help in understanding the Spring Security Architecture, important packages, interfaces, classes inside it which handles authentication and authorization requests in the web applications. It also covers most common security related topics like CORs, CSRF, JWT, OAUTH2, password management, method level security, user, roles & authorities management inside web applications.
Below are the important topics that this course covers,
Spring Security framework details and it features
How to adapt security for a Java web application using Spring Security
Password Management in Spring Security with PasswordEncoders
Deep dive about encoding, encryption and hashing
What is CSRF, CORS and how to address them
What is Authentication and Authorization. How they are different from each other.
Filters in Spring Security and how to write own custom filters
Deep dive about JWT (JSON Web Tokens) and the role of them inside Authentication & Authorization
Deep dive about OAUTH2 and various grant type flows inside OAUTH2.
Deep dive about OpenID Connect & how it is related to OAUTH2
Applying authorization rules using roles, authorities inside a web application using Spring Security
Method level security in web/non-web applications
Social Login integrations into web applications
Set up of Authorization Server using KeyCloak, Spring Authorization Server
The pre-requisite for the course is basic knowledge of Java, Spring, SpringBoot and interest to learn.
Who this course is for:
- Beginner students who are learning Spring framework and interested in security as well
- Developers who already know developing web applications using Spring framework
- Java Architects