Spring Security

Spring Security is the official security framework for the Spring ecosystem, covering authentication, authorization, and protection against common exploits like CSRF and session fixation. Spring Boot's spring-boot-starter-security auto-configures a working, secured application the moment the dependency is added: every endpoint requires login by default until access rules are defined.

It supports form login, HTTP Basic, OAuth2 and OpenID Connect login, SAML 2.0, passkeys (WebAuthn), and one-time-token login, and applications can act as OAuth2 resource servers that validate JWTs. Multi-factor authentication, added in Spring Security 7, treats each factor as an authority, so a rule can require a password plus a one-time token or a passkey with little more than an annotation. Method security annotations (@PreAuthorize, @Secured) keep authorization rules next to the code they protect.

Because it is built around a filter chain, custom authentication providers or token schemes plug in alongside the built-in ones rather than replacing the framework. The same security model applies whether an app uses Spring MVC, WebFlux, or Spring Cloud Gateway, which keeps authorization logic portable across a Spring-based stack as it grows.