{"id":50440962,"url":"https://github.com/amigoscode/spring-security","last_synced_at":"2026-05-31T19:02:24.885Z","repository":{"id":355237177,"uuid":"1227323565","full_name":"amigoscode/spring-security","owner":"amigoscode","description":null,"archived":false,"fork":false,"pushed_at":"2026-05-02T14:28:44.000Z","size":1186,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-05-02T16:26:10.350Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://amigoscode.com/courses/spring-security","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/amigoscode.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-05-02T14:23:29.000Z","updated_at":"2026-05-02T14:32:35.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/amigoscode/spring-security","commit_stats":null,"previous_names":["amigoscode/spring-security"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/amigoscode/spring-security","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amigoscode%2Fspring-security","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amigoscode%2Fspring-security/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amigoscode%2Fspring-security/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amigoscode%2Fspring-security/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/amigoscode","download_url":"https://codeload.github.com/amigoscode/spring-security/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/amigoscode%2Fspring-security/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33744447,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-31T02:00:06.040Z","response_time":95,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-05-31T19:02:21.859Z","updated_at":"2026-05-31T19:02:24.879Z","avatar_url":"https://github.com/amigoscode.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Spring Security\n\n![Spring Security Architecture](Spring%20Security%20Architecture.png)\n\nA hands-on course that walks through Spring Security from first principles up to JWT-secured REST APIs. Each section builds directly on the previous one, ending with a working Spring Boot application that authenticates users, authorizes requests, and issues JWTs.\n\n\u003e Course: [amigoscode.com/courses/spring-security](https://amigoscode.com/courses/spring-security)\n\n## What you'll build\n\nA Spring Boot app (Java 25, Spring Boot 4) that:\n\n- Authenticates users via form login, HTTP Basic, and JWT\n- Loads users from a database with a custom `UserDetailsService`\n- Stores hashed passwords with BCrypt\n- Models roles and permissions with JPA and `GrantedAuthority`\n- Authorizes requests using `@PreAuthorize` and request matchers\n- Reacts to authentication events (success, failure, lockout)\n- Issues and validates JWTs as a Spring resource server\n\n## Prerequisites\n\n- Java 25\n- Maven (the Maven wrapper is included — use `./mvnw`)\n- Basic Spring Boot familiarity (controllers, beans, JPA)\n\n## Run the app\n\n```bash\n./mvnw spring-boot:run\n```\n\n## Branches\n\nEach section has a matching branch. Check out the `*-start` branch to follow along, or the section branch to see the finished state.\n\n| Section branch              | Starter branch                  |\n| --------------------------- | ------------------------------- |\n| `form-login`                | `starter`                       |\n| `basic-authentication`      | `basic-authentication-starter`  |\n| `authentication`            | `authentication-starter`        |\n| `user-details-service`      | `user-details-service-start`    |\n| `security-context-holder`   | `security-context-holder-start` |\n| `roles-and-permission`      | `roles-and-permissions-start`   |\n| `security-events`           | `security-events-starter`       |\n| `jwt`                       | `jtw-starter`                   |\n\n## Course outline\n\n### 1. Intro\n- What is Spring Security\n\n### 2. Form Login\n- Form login intro, implementation, and testing\n- `JSESSIONID` and storing it in Redis / JDBC\n- Form login configuration\n- Inspecting the filter chain\n\n### 3. Basic Auth\n- Configuring HTTP Basic\n- Basic Auth in the browser vs server-to-server\n- Configuration and CSRF\n\n### 4. Authentication\n- `AuthenticationProvider` and `UserDetailsService`\n- Noop passwords, hashing, and BCrypt\n- Custom `DaoAuthenticationProvider`\n- Using the `AuthenticationManager`\n\n### 5. User Details Service\n- Custom `UserDetailsService`\n- The `ApplicationUser` entity and its annotations\n- Inspecting tables, persisting users, and fixing `loadByUsername`\n\n### 6. Security Context Holder\n- Reading from `SecurityContextHolder`\n- Injecting `Authentication` as a controller parameter\n\n### 7. Roles and Permissions\n- Role and permission entities and ERD\n- Saving roles and permissions through repositories\n- Mapping authorities with `SimpleGrantedAuthority`\n\n### 8. Authorization\n- `@PreAuthorize` and `hasAuthority`\n- Request matchers and other authorization methods\n\n### 9. Security Events\n- Capturing authentication events\n- Async event handling\n- Exercise\n\n### 10. JWT\n- Intro to JWT and required dependencies\n- Enabling the resource server\n- Encoding/decoding with a secret key\n- `JwtTokenService` and `JwtDecoder`\n- Inspecting tokens, the auth controller, and JWT in action\n- Embedding roles and permissions in the token\n- `JwtAuthenticationConverter`\n\n## How to use this repo\n\n1. Check out `starter` to begin.\n2. Watch a lesson, then implement it on the matching `*-start` branch.\n3. Compare your work against the section branch when you're done.\n4. Move to the next section.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famigoscode%2Fspring-security","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Famigoscode%2Fspring-security","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Famigoscode%2Fspring-security/lists"}