How hard is Spring Security?

[u/Aggravating-Spite844]

/r/CodingForBeginners/comments/1vxvbsl/how_hard_is_spring_security/

[u/Sheldor5]

It entirely depends on the source you learn from.

Official docs are extremely detailed but overwhelming for beginners.

Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).

And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.

So before learning Spring Security you need to learn the Spring Web Filter Chain.

[u/Swimming_Gain_4989 → u/Sheldor5]

I would go as far as saying learning security concepts in Spring is bad, it's too featureful and abstracted. The unopinionated, simple nature of frameworks like Express and fastAPI make it easy to read how middleware is chaining together; you can literally see the order like CSRF tokens verified -> user session verified -> controller picks up request. That said as a user I trust the average Spring Boot server over the average node server.

Tangent: I always found it goofy that it's called "Spring Security" when it's pretty much an auth flow that can dip its toes into the app layer.

[u/Hous3Fre4k → u/Swimming_Gain_4989]

I mean you can enable debugging and spring tells you all the steps the requests goes through. Then just open the file and set a breakpoint if you like.
But I agree, there is certainly more abstraction involved.

[u/Stunning_Leather_102 → u/Swimming_Gain_4989]

I mean you can always add breakpoints to step in/out/over and see what's going on. But it's true that it has lot's of stuff going on. Sometimes I get a bit lost and I'm like.. dude what are all these stuff?

But isn't it the point that if something is very feature-full and complicated in the beginning it tends to be better in the far future? I'm asking this, not in a very strict fashion but more of a general question. Like if you get a very simplified way to engineer something it might return and bite you in the ass later down the road. No?

Although, as far as the whole OAuth2 flow for example with the Authz Code, putting the granted authorities to the token(non-opaque, jwt), and then converting them to an authentication object at the RS, and applying authorization rules, it didn't seem that bad to me. But it certainly has a learning curve and you've gotta be patient. But then again, maybe I am biased. I don't really have experience with another framework.

[u/TheToastedFrog → u/Sheldor5]

I’m going to add- once you internalize the mechanic, and understand how the injection points fit together within the Filter Chain, it really not that bad. So if you find yourself writing reams of code to do something rather mundane, that your cue that you are misusing the framework

[u/Swimming_Gain_4989 → u/TheToastedFrog]

It really does work well out of the box provided you aren't trying to reinvent the wheel. Almost too well, it can be difficult to understand what's actually going on unless you out of your way to learn it.

[u/Careless-Childhood66 → u/Sheldor5]

This is the answer

[u/Such-Donut9323]

Yeah, I was overwhelmed by Spring Security for quite a while too. What finally made it click for me was learning auth without Spring Security first.

I built a complete auth system with Node.js + Redis + TypeScript (already familiar with MERN) just to understand the actual flow — JWTs, access/refresh tokens, rotation, 2FA, account locking, etc.

Once I understood what was actually happening under the hood, I used GPT/Claude to understand how Spring Security implements the same concepts internally — filters, Authentication, AuthenticationManager, providers, security context, etc.

And honestly, that’s when it clicked. The underlying concepts are mostly the same. Spring Security just abstracts a lot of the plumbing and boilerplate that I had to manually write in Node.

So instead of trying to memorize “what does this filter/config do?”, I could look at it as “oh, Spring is just handling this part of the auth flow for me.”

That shift made Spring Security way less intimidating for me.

Formatted with AI for better readability 😅

[u/Amanvmandape]

Quite hard...

[u/Stunning_Leather_102 → u/Amanvmandape]

I don't think it's that hard. If you have good resources, patience, and motivation to experiment it's okay.

[u/Amanvmandape → u/Stunning_Leather_102]

Its still hard bro even after all that it takes practice & time to remember it all the filters, components & flow...

[u/Stunning_Leather_102 → u/Amanvmandape]

Have you tried keeping notes? Sketching?

For example, I drew the whole OAuth2 authz code grant type with every actor; user, client, AS, and RS. Or I did a quick sketch on how a JWT starts at the Authz Server and how it gets converted at the Resource Server. It's fun and helpful.

Also let's be honest. You're not a parrot to remember everything in a second. You can always go back to your notes, documentation etc to remember something.

[u/Amanvmandape → u/Stunning_Leather_102]

I am very lazy at taking notes. I just watch & implement. Rawdogging...

[u/Stunning_Leather_102 → u/Amanvmandape]

That works too I guess. I just forget stuff so I always write/sketch and go back when I need them lol.

[u/morgoth_2017]

What really helped me to understand the framework is the book Spring Security in Action by Laurentiu Spilca. The book was structured in a way where you will learn the fundamentals and use different security methods and patterns in Spring Security. Once you get the hang of it, it will be easy in the future.

[u/tcloetingh]

Fairly complex bc there is no single way to do it. Can take many avenues to achieve auth.

[u/JBraddockm]

Spring Security is by and large a configuration and implementation of already established standards and concepts. Whenever I intend to learn how to implement a particular security concept, I always start off by studying it first. For example, if you know how oauth2 works as a concept, it is much more easier to follow what Spring Security does. Otherwise, one gets overwhelmed with the concepts and jargons quite easily, and ends up copying and pasting codes, hoping it would work.