SpringBoot_Angular_FullStackWebApp VS Spring Security

NOTE: For reference, please visit the following GitHub repository: https://github.com/VishalPawar1010/SpringBoot_Angular_FullStackWebApp

GraphQLController.java

Comprehensive details are available in the release notes.

At its core, Spring Security provides a comprehensive solution to secure Java applications, leveraging the principles of transparency and openness. Under the permissive Apache 2.0 License, the framework not only encourages widespread adoption but also supports modifications to meet evolving security demands. This strict adherence to open source best practices has attracted both individual developers and large enterprises, resulting in an ecosystem that thrives on mutual collaboration. The evolution of Spring Security is tightly interwoven with its funding strategy. The project benefits from a balanced model that integrates community contributions with significant corporate backing. Companies like VMware provide essential financial and strategic resources which help to ensure that the framework remains agile, innovative, and resilient against emerging security challenges. At the same time, the strong engagement on platforms such as GitHub has been instrumental in driving rapid development and continuous improvement.

Diving into the details of every filter in the chain would take us too far, but here are explanations for a few key filters. For a deeper understanding of the others, you can explore Spring Security’s source code.

It took me several days to get it working! I got the idea from Spring Security project issue discussion, and Keycloak documentation.

Spring security has long had great OAuth2.0 support from both the server and client elements. Recently spring security added support for the private_key_jwt client authentication method as part of the authorization code grant flow. Spring Security GitHub ref

To be fair there were quite some unexpected surprises in the past with Spring and Kotlin (e.g. the Cachable annotation did not work with suspend functions, not all Spring security annotations were supported with coroutines), but most of them were ironed out already.

They recently updated all the examples in the javadocs if you wanna bump your Spring Security version to 5.7.3 (see here). Otherwise the reference docs all reflect the non-deprecated approach that uses SecurityFilterChain and supporting beans.

Spring Security 5.7