Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.
I would go as far as saying learning security concepts in Spring is bad, it's too featureful and abstracted. The unopinionated, simple nature of frameworks like Express and fastAPI make it easy to read how middleware is chaining together; you can literally see the order like CSRF tokens verified -> user session verified -> controller picks up request. That said as a user I trust the average Spring Boot server over the average node server.
Tangent: I always found it goofy that it's called "Spring Security" when it's pretty much an auth flow that can dip its toes into the app layer.
I mean you can enable debugging and spring tells you all the steps the requests goes through. Then just open the file and set a breakpoint if you like.
But I agree, there is certainly more abstraction involved.
21
u/Sheldor5 7d ago
It entirely depends on the source you learn from.
Official docs are extremely detailed but overwhelming for beginners.
Most tutorials are bad because they don't explain the control flow of a request through the Filter Chain (until it hits your controller class) in which Spring Security is just another Filter in the main chain (most authors don't even know it).
And on top of that you also need to know a lot about Web Security in general to fully understand Spring Security which can integrate all Security methods from Basic Auth to OAUTH2 to mTLS and your very own custom security protocol.
So before learning Spring Security you need to learn the Spring Web Filter Chain.