Spring Security: a first look

Right now anyone can delete someone else's post. Spring Security is the module that answers two questions: who came (authentication, logging in) and what they may do (authorization, permissions). It sits in front of the controllers as a chain of filters and checks every request before it reaches your code.

Setup

<!-- pom.xml -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Nothing else needs writing to see how it works.

What changed

At startup the log shows a warning:

WARN ... UserDetailsServiceAutoConfiguration :
Using generated security password: 823d91a9-120b-4e1f-8732-9e5dce83ab92
This generated password is for development use only. Your security configuration must be updated before running your application in production.

Spring Boot created one user named user with a random password — it changes on every start. And all the application's addresses are now closed:

curl -i http://localhost:8080/api/posts

HTTP/1.1 401
WWW-Authenticate: Basic realm="Realm", charset="UTF-8"
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Cache-Control: no-cache, no-store, max-age=0, must-revalidate

Code 401 means "login required". The WWW-Authenticate: Basic header hints at the way: HTTP Basic — the name and password in a request header. Spring Security adds the other headers to protect against common attacks in browsers.

Logging in with curl

The -u flag sends the name and password the HTTP Basic way:

curl -u user:823d91a9-120b-4e1f-8732-9e5dce83ab92 "http://localhost:8080/api/posts?size=1"

{"content":[{"id":2,"title":"From the form","body":"Written in the browser","author":"oleg","createdAt":"2026-10-04T09:02:04.450432Z"}],"page":{"size":1,"number":0,"totalElements":2,"totalPages":2}}

With the password the data arrived. In a browser http://localhost:8080/ redirects to the built-in login page /login — you can enter the same user and password there.

What comes next

One user with a random password is only good for a first look. In the next lessons we will:

1. Store the blog's users in the database with hashed passwords.
2. Open reading posts to everyone and changes only to logged-in users.
3. Build our own login page for the site.

The /h2-console is closed too once Spring Security is added — look at the database before this step or through tests.

Common mistake

Even with the right password a POST request fails:

curl -i -u user:823d91a9-120b-4e1f-8732-9e5dce83ab92 -X POST http://localhost:8080/api/users \
  -H "Content-Type: application/json" -d '{"username":"ivan"}'

HTTP/1.1 401

The reason is protection against CSRF (cross-site request forgery): by default Spring Security requires a special token on every request that changes something. The refusal goes to the /error page, which is closed as well, so curl sees 401. For an API without cookies this protection is switched off — in the lesson on access rules.