Welcome to Day 6 of my Spring Boot learning journey! 🔐💚
After building a complete Product Management System with a modern UI, it was time to make the application secure.
A real-world application isn't just about displaying data—it also needs to ensure that only authorized users can access sensitive features. Today, I explored Spring Security and learned how to implement Authentication and Authorization in a Spring Boot application.
🛡️ Adding Spring Security
The first step was adding the Spring Security dependency to my project.
Once added, Spring Boot automatically secured the entire application by providing a default login page.
This was my first introduction to how easily Spring Boot can protect web applications with minimal configuration.
🔑 Understanding Authentication
Authentication answers one simple question:
"Who are you?"
Spring Security provides multiple ways to authenticate users.
1️⃣ Default Authentication (Auto Generated)
This is Spring Boot's default behavior.
- Username: user
- Password: Automatically generated and printed in the console.
Every time the application restarts, a new password is generated.
While useful for testing, this isn't suitable for real applications because the password changes every time.
2️⃣ Username & Password in Properties File
The second approach is to configure credentials directly inside the application's properties file.
This allows developers to define a fixed username and password without relying on randomly generated credentials.
It's simple and useful for small demo projects but still not ideal for production systems.
3️⃣ Custom Authentication
Today I explored two custom authentication strategies:
✅ In-Memory Authentication
With In-Memory Authentication, users are stored directly inside the application.
I created multiple users with different roles such as:
- ADMIN
- USER
Passwords were encrypted using BCryptPasswordEncoder, ensuring they were stored securely rather than in plain text.
This approach is great for learning, testing, and small applications.
✅ DAO Authentication
The most exciting part of today's session was implementing DAO Authentication.
Instead of hardcoding users, authentication now happens using data stored inside the database.
The application fetches user details dynamically through a custom UserDetailsService.
This approach is much closer to how authentication works in production applications.
🔒 Understanding Authorization
Authentication identifies the user.
Authorization decides what that user is allowed to do.
Using Spring Security, I configured role-based access control.
For example:
👤 USER
- View Products
- Add Products
👨💼 ADMIN
- View Products
- Add Products
- Update Products
- Delete Products
This ensures that sensitive operations are restricted to authorized users only.
🔑 Password Encryption
One important lesson today was never storing passwords in plain text.
I used BCryptPasswordEncoder, which hashes passwords before saving or comparing them.
This is one of the most important security practices in modern web applications.
👥 Custom UserDetailsService
To connect Spring Security with the database, I implemented a custom UserDetailsService.
Its responsibilities include:
- Searching users in the database
- Validating usernames
- Returning user information to Spring Security
- Loading user roles and permissions
This allows Spring Security to authenticate users using database records instead of hardcoded values.
🗃️ Role-Based Database Design
To support multiple roles, I designed separate database tables for:
- Users
- Roles
These tables are connected through a relationship table, allowing a user to have one or more roles.
This design is flexible and scalable for real-world applications where permissions may grow over time.
🔄 Security Flow
User Opens Application
⬇️
Spring Security Login Page
⬇️
Authentication
⬇️
Database Verification
⬇️
Load User & Roles
⬇️
Authorization Check
⬇️
Grant or Deny Access
⬇️
Application Dashboard
📚 What I Learned Today
✅ Spring Security
✅ Authentication
✅ Authorization
✅ Default Login Page
✅ In-Memory Authentication
✅ DAO Authentication
✅ UserDetailsService
✅ UserDetails
✅ AuthenticationProvider
✅ BCrypt Password Encoding
✅ Role-Based Authorization
✅ SecurityFilterChain
✅ Access Control
💡 My Biggest Takeaway
Today's session completely changed my understanding of backend development.
Building APIs and beautiful user interfaces is important, but without proper security, an application isn't ready for real users.
Learning how Spring Security handles authentication and authorization gave me a glimpse into how enterprise applications protect sensitive data and manage user access.
With database-backed authentication and role-based authorization, my application now feels much closer to a production-ready system.
🚀 What's Next?
In the next stage of my journey, I plan to explore:
- Registration Module
- User Signup
- Custom Login Page
- JWT Authentication
- OAuth2
- Session Management
- Remember Me
- Email Verification
- Password Reset
Every new concept brings me one step closer to becoming a full-stack Java developer. 💚
#SpringBootJourney Day 6
Today's Achievements:
✔ Spring Security Integration
✔ Authentication
✔ Authorization
✔ Default Login Page
✔ In-Memory Authentication
✔ DAO Authentication
✔ BCrypt Password Encoding
✔ Database Users & Roles
✔ Role-Based Access Control
✔ Secure Product Management System
Security isn't an extra feature—it's the foundation of every modern application. 🔐🚀
Top comments (0)