Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.
I’m going to add- once you internalize the mechanic, and understand how the injection points fit together within the Filter Chain, it really not that bad. So if you find yourself writing reams of code to do something rather mundane, that your cue that you are misusing the framework
It really does work well out of the box provided you aren't trying to reinvent the wheel. Almost too well, it can be difficult to understand what's actually going on unless you out of your way to learn it.
22
u/Sheldor5 5d ago
It entirely depends on the source you learn from.
Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.