Authorization with Spring Security: Permissions, Roles and More
summary
Covers how to implement authorization in Spring Boot using Spring Security, focusing on permissions and roles beyond simple .hasRole checks. Explains extracting and storing user info at login, placing policy-decision and enforcement points in request handling, and concrete coding patterns (with live-coding examples) to apply different access-control mechanisms and their trade-offs.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:27Session overview
- 4:18Quick demo: Spring Boot + Security
- 15:23Roles and permissions basics
- 28:37Auth and Security Context
- 33:31HTTP request authorization
- 56:35Break
- 1:08:22Method auth with @PreAuthorize
- 1:33:31Object-level auth with @AuthorizeReturnObject
- 1:50:54MFA in Spring Security
- 2:08:21Multiple Security Filter Chains
- 2:12:19Security testing
- 2:21:03Advanced auth models: RBAC, ABAC, ReBAC
- 2:34:10Summary
related talks
50mAuthorization in Spring Security: permissions, roles and beyond
51mAuthorization beyond @RolesAllowed
51mServers, OAuth Client, SecurityFilterChain and More with Spring Security
01h 52mSpring Security: The Good Parts
54mSpring Security Patterns
41mSpring Security: the everyday and the non-obvious
33mSpring Security Patterns
51mEnterprise Security with Spring Authorization Server 1.0