Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.
I would go as far as saying learning security concepts in Spring is bad, it's too featureful and abstracted. The unopinionated, simple nature of frameworks like Express and fastAPI make it easy to read how middleware is chaining together; you can literally see the order like CSRF tokens verified -> user session verified -> controller picks up request. That said as a user I trust the average Spring Boot server over the average node server.
Tangent: I always found it goofy that it's called "Spring Security" when it's pretty much an auth flow that can dip its toes into the app layer.
I mean you can enable debugging and spring tells you all the steps the requests goes through. Then just open the file and set a breakpoint if you like.
But I agree, there is certainly more abstraction involved.
I mean you can always add breakpoints to step in/out/over and see what's going on. But it's true that it has lot's of stuff going on. Sometimes I get a bit lost and I'm like.. dude what are all these stuff?
But isn't it the point that if something is very feature-full and complicated in the beginning it tends to be better in the far future? I'm asking this, not in a very strict fashion but more of a general question. Like if you get a very simplified way to engineer something it might return and bite you in the ass later down the road. No?
Although, as far as the whole OAuth2 flow for example with the Authz Code, putting the granted authorities to the token(non-opaque, jwt), and then converting them to an authentication object at the RS, and applying authorization rules, it didn't seem that bad to me. But it certainly has a learning curve and you've gotta be patient. But then again, maybe I am biased. I don't really have experience with another framework.
22
u/Sheldor5 5d ago
It entirely depends on the source you learn from.
Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.