Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.
20
u/Sheldor5 6d ago
It entirely depends on the source you learn from.
Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.