DEV Community: sonali kumari shahi

# Why Do We Use PasswordEncoder in Spring Security?

sonali kumari shahi — Sun, 14 Jun 2026 08:13:30 +0000

When I first started learning Spring Security, I had a simple question:

"If Spring Security can authenticate users using usernames and passwords, why do we need a PasswordEncoder?"

The answer lies in one important principle:

Passwords should never be stored in plain text.

Imagine if passwords were stored like this in the database:

Username: sonali
Password: sonali123

If the database gets leaked, attackers can immediately see users' actual passwords.

That's a huge security risk.

The Better Approach: Hashing Passwords

Instead of storing the original password, Spring Security allows us to store an encoded version of it.

For example:

sonali123
↓
$2a$10$k9Y...

Even if someone gains access to the database, they cannot easily determine the original password.

Enter PasswordEncoder

Spring Security provides the PasswordEncoder interface to handle password encoding and verification.

A commonly used implementation is:

BCryptPasswordEncoder

To tell Spring Security to use BCrypt, we can define a bean like this:

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

Encoding a Password

Before saving a user's password to the database, we encode it.

String rawPassword = "sonali123";

String encodedPassword = passwordEncoder.encode(rawPassword);

System.out.println(encodedPassword);

The output might look something like this:

$2a$10$X3YwL...

Interestingly, BCrypt generates a different encoded value each time, making it even more secure.

But How Does Login Work?

A common question is:

"If the encoded value changes every time, how does Spring Security verify passwords during login?"

When a user logs in:

The user enters a password.
Spring Security retrieves the encoded password from the database.
PasswordEncoder.matches() is used to compare them securely.

boolean isMatch = passwordEncoder.matches(
        "sonali123",
        encodedPassword
);

System.out.println(isMatch);

Output:

true

What Actually Happens During Authentication?

User enters password
          ↓
Spring fetches encoded password from database
          ↓
PasswordEncoder.matches()
          ↓
Authentication Success / Failure

One thing that surprised me while learning Spring Security was that it never compares plain text passwords directly.

Instead, it uses PasswordEncoder to securely verify whether the entered password matches the encoded password stored in the database.

The Big Takeaway

Using PasswordEncoder isn't just a Spring Security feature—it's a security best practice.

As developers, we should never store passwords in plain text.

Instead, we should always encode them before saving them to the database.

Because protecting user data starts with protecting their passwords. 🔐

10 Spring Security Configurations Every Beginner Should Know

sonali kumari shahi — Wed, 10 Jun 2026 07:37:53 +0000

While learning Spring Security, I found myself searching for the same configurations again and again.

Questions like:

How do I make an endpoint public?
How do I restrict an API to admin users?
How do I disable CSRF for REST APIs?
How do I add a JWT filter?

So, I decided to create a small cheatsheet containing some of the Spring Security configurations I use most often while building projects.

If you're getting started with Spring Security, I hope this saves you some time.

1. Allow Public Endpoints

Use permitAll() when an endpoint should be accessible without authentication.

.requestMatchers("/login", "/signup").permitAll()

2. Require Authentication

Use authenticated() when users must log in before accessing an endpoint.

.anyRequest().authenticated()

3. Restrict Access Based on Roles

Allow only ADMIN users to access specific APIs.

.requestMatchers("/admin/**").hasRole("ADMIN")

4. Allow Multiple Roles

When more than one role should have access:

.requestMatchers("/dashboard/**")
.hasAnyRole("USER", "ADMIN")

5. Disable CSRF for REST APIs

In stateless REST APIs, CSRF protection is often disabled.

http.csrf(csrf -> csrf.disable());

6. Define a Password Encoder

Never store passwords in plain text.

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

7. Enable HTTP Basic Authentication

Useful while learning or testing APIs.

http.httpBasic(Customizer.withDefaults());

8. Use Stateless Sessions (JWT)

When building JWT-based applications:

http.sessionManagement(session ->
    session.sessionCreationPolicy(SessionCreationPolicy.STATELESS)
);

9. Add a Custom JWT Filter

http.addFilterBefore(
    jwtAuthFilter,
    UsernamePasswordAuthenticationFilter.class
);

10. Get the Currently Logged-in User

Access details of the authenticated user.

Authentication authentication =
    SecurityContextHolder.getContext().getAuthentication();

String username = authentication.getName();

Putting It All Together

A beginner-friendly security configuration might look like this:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http)
        throws Exception {

    http
        .csrf(csrf -> csrf.disable())

        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/login", "/signup")
            .permitAll()

            .requestMatchers("/admin/**")
            .hasRole("ADMIN")

            .anyRequest()
            .authenticated()
        )

        .httpBasic(Customizer.withDefaults());

    return http.build();
}

Final Thoughts

Spring Security can feel overwhelming at first because there are so many configurations to remember.

The good news?

You don't need to memorize everything.

Over time, you'll notice that you keep using the same patterns again and again.

I created this cheatsheet mainly for myself, but I hope it helps other developers who are starting their Spring Security journey as well.

Which Spring Security configuration do you use most often? Let me know in the comments! 😊

Security Filter Chain Explained: The Heart of Spring Security

sonali kumari shahi — Fri, 05 Jun 2026 12:25:55 +0000

After learning about Authentication and Authorization, I came across another important term in Spring Security:

Security Filter Chain

Almost every request in a Spring Security application passes through it.

But what exactly is it, and why is it so important?

Let's understand it with a simple example.

What is the Security Filter Chain?

The Security Filter Chain is a collection of filters that process every incoming request before it reaches your controller.

Client Request
↓
Security Filter Chain
↓
Controller
↓
Response

Think of it as a security checkpoint.

Before allowing a request to enter your application, Spring Security performs multiple checks.

Why Do We Need It?

Imagine a shopping mall without security guards.
Anyone could walk in and access restricted areas.
Similarly, without security checks, anyone could access your APIs.

The Security Filter Chain helps Spring Security:

Identify users
Verify credentials
Check permissions
Handle security-related exceptions

What Happens Inside the Filter Chain?

When a request enters the application, multiple filters examine it one by one.

For example:

Is the user authenticated?
Does the request contain a valid JWT token?
Does the user have the required role?
Is access allowed for this endpoint?

Each filter has a specific responsibility.

If any check fails, the request is stopped immediately.

A Simple Example

Suppose a user tries to access:

GET /api/customers

The request first enters the Security Filter Chain.

Request
↓
Filter 1: Authentication Check
↓
Filter 2: Authorization Check
↓
Controller

If authentication fails:
Request
↓
Authentication Failed ❌
↓
Access Denied

The controller is never reached.

Defining a Security Filter Chain

In modern Spring Security, we configure security using a SecurityFilterChain bean.

@Bean 
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { 

http 
     .authorizeHttpRequests(auth -> auth
        .requestMatchers("/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated() 
     )
     .formLogin(); 

  return http.build(); 
}

In this configuration:

/admin/** can only be accessed by ADMIN users.
All other requests require authentication.
Spring automatically creates the required security filters.

What Happens Internally?

When a request comes in:

The request enters the Security Filter Chain.
Authentication filters verify the user.
Authorization filters check permissions.
If everything is valid, the request reaches the controller.

Client Request
↓
Security Filter Chain
↓
Authentication
↓
Authorization
↓
Controller
↓
Response

Why Is It Important?

One thing I found interesting is that Spring Security doesn't protect controllers directly.
Instead, it protects the application by intercepting requests before they reach the controller.
This is why even if your controller exists, unauthorized users cannot access it.
The Security Filter Chain acts as the first line of defense.

The Big Takeaway

The Security Filter Chain is the backbone of Spring Security.

Whenever a request enters your application:

✅ It passes through multiple security filters

✅ Authentication is verified

✅ Authorization is checked

✅ Only valid requests reach the controller

A simple way to remember it is:

The Security Filter Chain is the gatekeeper of your application.

Understanding this concept made many Spring Security features easier for me to understand, and I hope it helps you too. 🚀

Authentication vs Authorization: Understanding the Difference in Spring Security

sonali kumari shahi — Wed, 03 Jun 2026 11:36:03 +0000

When I started learning Spring Security, I kept seeing two terms everywhere:

Authentication and Authorization

At first, they sounded almost the same to me.
But as I learned more, I realized they answer two completely different questions.
Understanding this difference is important because these concepts are at the heart of every secure application.
Let's break them down in the simplest way possible.

Authentication: Who Are You?

Authentication is the process of verifying a user's identity.
In simple words, the application asks: "Who are you?"

For example, when you log in using your username and password:

   Username: sonali
   Password: ********

The application checks whether these credentials are correct.
If they are correct, you are authenticated.

Think of it like entering a college campus.
The security guard checks your ID card to confirm that you are actually a student.
That's authentication.
✅ Identity Verified

Authorization: What Are You Allowed To Do?

After authentication, another question is asked: "What are you allowed to do?"
This is authorization.
Even if two users are logged in, they may not have the same permissions.

For example:

Admin can manage users
Employee can view data
Customer can access only their own account

Authorization decides what resources a user can access.

Using the same college example:
The security guard verified your identity at the gate.
But that doesn't mean you can enter every room on campus.
Some rooms may be restricted to staff members only.
That's authorization.
✅ Permission Check

How Spring Security Uses Them

Whenever a request enters a Spring Boot application:
Request
↓
Authentication
↓
Authorization
↓
Controller

First, Spring Security verifies the user.
Then it checks whether the user has permission to access the requested resource.
Only after both checks pass does the request reach the controller.

The Big Takeaway

Authentication and Authorization work together, but they solve different problems.

Authentication confirms your identity.
Authorization determines your permissions.

A simple way to remember:
Authentication = Who are you?
Authorization = What can you do?

Once I understood this difference, many Spring Security concepts became much easier to understand. I hope this explanation helps you too.

What Happens Before Your API Receives a Request in Spring Security?

sonali kumari shahi — Tue, 02 Jun 2026 11:22:32 +0000

When I first added Spring Security to my Spring Boot project, something surprising happened.
All my APIs were suddenly protected, and I could no longer access them without authentication.
At first, it felt like magic. 😄

But then I wondered:

What actually happens when a request enters a Spring Security application?

In this blog, we'll follow the complete journey of a request and understand how Spring Security protects our application behind the scenes.

A Request's Journey Through Spring Security

Let's say a user sends a request to access:

GET /api/customers

You might think the request goes directly to the controller.
But that's not true.
Before your controller sees the request, Spring Security steps in and starts asking a few important questions.

First Question: "Who Are You?"

The request arrives at Spring Security's filter chain.

At this point, Spring Security tries to identify the user.

It looks for credentials such as:

Username and Password
JWT Token
OAuth Credentials

If no credentials are found, Spring Security stops the request right there.

The controller never gets a chance to handle it.

Second Question: "Are These Credentials Valid?"

If credentials are present, Spring Security verifies them.

For example:

Is the username correct?
Does the password match?
Is the JWT token valid and not expired?

If the verification fails, the request is rejected.

Only valid users can move to the next stage.

Third Question: "What Are You Allowed To Access?"

Now Spring Security knows who the user is.

But being authenticated doesn't automatically mean you can access everything.

Suppose a user tries to access an admin endpoint:

/admin/users

Spring Security checks the user's roles and permissions.

If the user has the required authority, the request moves forward.

Otherwise, access is denied.

Finally, The Request Reaches The Controller

Only after passing all security checks does the request reach your controller.

Request
↓
Spring Security
↓
Authentication
↓
Authorization
↓
Controller

At this point, your business logic starts executing and a response is generated.

The Big Takeaway

One thing that surprised me while learning Spring Security was that the controller is actually the last stop in the journey.

Before a request reaches your API, Spring Security has already:

✅ Identified the user

✅ Verified the credentials

✅ Checked permissions

✅ Decided whether the request should be allowed

That's why Spring Security is such an important part of modern backend applications.

It acts as a protective layer between users and your business logic, making sure only the right people can access the right resources.

What Spring Security topic would you like to see next?

🔹 Authentication vs Authorization
🔹 Security Filter Chain
🔹 JWT Authentication
🔹 UserDetailsService

Let me know in the comments! 🚀