Spring Security

Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();
Collection<? extends GrantedAuthority> authorities = auth.getAuthorities();
Object principal = auth.getPrincipal();  // UserDetails or JWT claims object

@Service
class DatabaseUserDetailsService implements UserDetailsService {
  private final UserRepository userRepository;

  DatabaseUserDetailsService(UserRepository userRepository) {
    this.userRepository = userRepository;
  }

  @Override
  public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
    return userRepository.findByEmail(username)
        .map(u -> User.builder()
            .username(u.getEmail())
            .password(u.getPasswordHash())
            .roles(u.getRoles().toArray(new String[0]))
            .disabled(!u.isActive())
            .build())
        .orElseThrow(() -> new UsernameNotFoundException(username));
  }
}

@Bean
PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder(12);
}

// Registration — hash before save
String hash = passwordEncoder.encode(rawPassword);
user.setPasswordHash(hash);

// Login — AuthenticationProvider calls passwordEncoder.matches(raw, hash)

@Bean
SecurityFilterChain formLoginChain(HttpSecurity http) throws Exception {
  return http
      .authorizeHttpRequests(auth -> auth
          .requestMatchers("/login", "/css/**").permitAll()
          .anyRequest().authenticated()
      )
      .formLogin(form -> form
          .loginPage("/login")
          .successHandler((req, res, authentication) -> {
            res.sendRedirect("/dashboard");
          })
          .failureHandler((req, res, ex) -> {
            res.sendRedirect("/login?error");
          })
      )
      .build();
}

http.httpBasic(Customizer.withDefaults());

http.rememberMe(remember -> remember
    .key("unique-and-secret-remember-me-key")
    .tokenValiditySeconds(86400 * 14)
    .userDetailsService(userDetailsService)
);

@Bean
SecurityFilterChain apiSecurity(HttpSecurity http) throws Exception {
  return http
      .securityMatcher("/api/**")
      .authorizeHttpRequests(auth -> auth
          .requestMatchers(HttpMethod.GET, "/api/public/**").permitAll()
          .requestMatchers("/api/admin/**").hasRole("ADMIN")
          .requestMatchers("/api/orders/**").hasAnyAuthority("orders:read", "orders:write")
          .anyRequest().authenticated()
      )
      .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
      .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
      .build();
}

@Configuration
@EnableMethodSecurity(prePostEnabled = true, securedEnabled = true)
class MethodSecurityConfig {}

@Service
class OrderService {
  @PreAuthorize("hasAuthority('orders:read') or #customerId == authentication.name")
  public OrderDto getOrder(long orderId, String customerId) { /* ... */ }

  @PreAuthorize("hasRole('ADMIN')")
  public void deleteOrder(long orderId) { /* ... */ }

  @PostAuthorize("returnObject.owner == authentication.name")
  public OrderDto getAndVerifyOwner(long orderId) { /* ... */ }
}

@Component
class JwtAuthenticationFilter extends OncePerRequestFilter {
  private final JwtService jwtService;
  private final UserDetailsService userDetailsService;

  @Override
  protected void doFilterInternal(
      HttpServletRequest request,
      HttpServletResponse response,
      FilterChain filterChain
  ) throws ServletException, IOException {
    String header = request.getHeader(HttpHeaders.AUTHORIZATION);
    if (header == null || !header.startsWith("Bearer ")) {
      filterChain.doFilter(request, response);
      return;
    }
    String token = header.substring(7);
    try {
      String username = jwtService.extractUsername(token);
      if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
        UserDetails user = userDetailsService.loadUserByUsername(username);
        if (jwtService.isTokenValid(token, user)) {
          var auth = new UsernamePasswordAuthenticationToken(user, null, user.getAuthorities());
          auth.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
          SecurityContextHolder.getContext().setAuthentication(auth);
        }
      }
    } catch (JwtException ex) {
      SecurityContextHolder.clearContext();
      response.sendError(HttpServletResponse.SC_UNAUTHORIZED, "Invalid token");
      return;
    }
    filterChain.doFilter(request, response);
  }
}

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://auth.acme.com/realms/production

spring:
  security:
    oauth2:
      client:
        registration:
          keycloak:
            client-id: order-service
            client-secret: ${KEYCLOAK_CLIENT_SECRET}
            scope: openid,profile,email
            authorization-grant-type: authorization_code
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
        provider:
          keycloak:
            issuer-uri: https://auth.acme.com/realms/production

@Service
class DownstreamClient {
  private final WebClient webClient;

  OrderDto fetchOrder(
      @RegisteredOAuth2AuthorizedClient("keycloak") OAuth2AuthorizedClient client,
      long orderId
  ) {
    String token = client.getAccessToken().getTokenValue();
    return webClient.get()
        .uri("/orders/{id}", orderId)
        .headers(h -> h.setBearerAuth(token))
        .retrieve()
        .bodyToMono(OrderDto.class)
        .block();
  }
}

@Bean
SecurityFilterChain statelessApi(HttpSecurity http) throws Exception {
  return http
      .csrf(csrf -> csrf.disable())  // OK when no session cookie auth
      .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
      .authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
      .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
      .build();
}

http.headers(headers -> headers
    .contentSecurityPolicy(csp -> csp
        .policyDirectives("default-src 'self'; frame-ancestors 'none'; script-src 'self'")
    )
    .frameOptions(HeadersConfigurer.FrameOptionsConfig::deny)
    .httpStrictTransportSecurity(hsts -> hsts
        .includeSubDomains(true)
        .maxAgeInSeconds(31536000)
    )
);

@Bean
CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration config = new CorsConfiguration();
  config.setAllowedOrigins(List.of("https://app.acme.com"));
  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE", "OPTIONS"));
  config.setAllowedHeaders(List.of("*"));
  config.setAllowCredentials(true);
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/api/**", config);
  return source;
}

@Bean
SecurityFilterChain chain(HttpSecurity http, CorsConfigurationSource cors) throws Exception {
  return http.cors(c -> c.configurationSource(cors)).build();
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
class SecurityConfig {

  @Bean
  SecurityFilterChain defaultChain(HttpSecurity http) throws Exception {
    return http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/actuator/health").permitAll()
            .requestMatchers("/api/public/**").permitAll()
            .anyRequest().authenticated()
        )
        .formLogin(Customizer.withDefaults())
        .httpBasic(Customizer.withDefaults())
        .csrf(Customizer.withDefaults())
        .build();
  }

  @Bean
  PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
  }
}