Spring Security Zero to Master along with JWT,OAUTH2

Name: Spring Security Zero to Master along with JWT,OAUTH2
Rating: 4.6 (10920 reviews)

Spring Security , SpringBoot Security, CORs,CSRF,JWT, OAUTH2, OpenID Connect, KeyCloak, Spring Authorization Server

Bestseller

Role Play

Created byEazy Bytes, Madan Reddy

Last updated 1/2026

English

What you'll learn

Spring Security framework details and it features.
How to adapt security for a Java web application using Spring Security
What is CSRF, CORS, JWT, OAUTH2
Applying authorization rules using roles, authorities inside a web application using Spring Security
Method level security in web/non-web applications

Course content

17 sections • 161 lectures • 24h 37m total length

Course Introduction8:23
Welcome to this course ! Let me explain what is the agenda of this course
Details of Source Code, PDF Content & other instructions for the course1:01
IntelliJ IDEA Ultimate0:59
Creating a simple Spring Boot app with out security - Part 19:49
Creating a simple Spring Boot app with out security - Part 29:11
Securing Spring Boot basic app using Spring Security & static credentials15:04
Add the spring security starter, then configure static credentials in application properties to secure a spring boot web app; define spring.security.user.name and spring.security.user.password for login.
Funny memes on Security5:42
What is Security & Why it is important12:36
In this video, we will discuss on what is security and why it is important for any web application
Quick introduction to Servlets & Filters6:33
Introduction to Spring Security Internal flow - Theory16:00
This video will explain how Spring Security process a income request internally every time and the architecture associated to it
Demo of Spring Security internal flow - Part 19:35
Demo of Spring Security internal flow - Part 215:00
Sequence flow of the Spring Security default behaviour4:25
Understanding on how multiple requests work with out credentials5:06
In this video, we will see how spring security framework works in the case of multiple requests after authentication where it will not ask for credentials again and again.
"Getting started with Spring Security" quiz

Understanding about UI part of the EazyBank application9:20
Creating backend services needed for the EazyBank application12:34
Checking the default configuration inside the spring security framework8:29
Examine the default spring security configuration and its http security filter chain. Learn to customize with a security filter chain bean, including form login, http basic, and oauth2 login.
Modifying the security config code as per our custom requirements11:24
How to disable formLogin and httpBasic authentication12:38
Learn how to disable formLogin and httpBasic in a Spring Boot web app, switch to lambda-based configuration, and understand the role of BasicAuthenticationFilter and UsernamePasswordAuthenticationFilter when securing REST APIs.
httpBasic authentication testing using postman10:15
Quiz related to "Understanding & Changing the default security configurations"

Configuring users using InMemoryUserDetailsManager15:02
Configuring PasswordEncoder using PasswordEncoderFactories12:45
Demo of CompromisedPasswordChecker8:37
Deep Dive of UserDetailsService & UserDetailsManager Interfaces14:59
Explore how Spring Security models end users with UserDetails and manages them via UserDetailsService and UserDetailsManager, including loadUserByUsername, createUser, updateUser, deleteUser, changePassword, and userExists, with InMemoryUserDetailsManager, JdbcUserDetailsManager, and LdapUserDetailsManager implementations.
Deep Dive of UserDetails & Authentication interfaces17:04
Design Discussion: Securing the Demo App with out a database
Quiz related to "Defining & Managing Users using InMemoryUserDetailsManager"

Quick revision of enhancements done so far1:42
Creating MySQL Database using Docker10:07
Understanding JdbcUserDetailsManager & creating Users inside the DB9:35
Using JdbcUserDetailsManager to perform authentication11:25
Creating our own custom tables for Authentication5:57
Create a custom authentication table named customer with an auto-increment id, email as username, PWD for passwords, and a role, then update Spring Security to use it.
Creating JPA Entity and repository classes for new table14:14
Creating our own custom implementation of UserDetailsService14:30
Building a new REST API to allow the registration of new User17:01
Quiz related to "Defining & Managing Users using a database"

How our passwords validated with out PasswordEncoders7:46
Learn how passwords are hashed with a bcrypt PasswordEncoder in Spring Security, using a delegating PasswordEncoder, and why plain text storage is dangerous.
What is Encoding, Decoding & why it is not suitable for passwords management8:03
Explore encoding, decoding, encryption, and hashing. Understand why encoding is unsuitable for password management while discussing data masking and privacy.
What is Encryption, Decryption & why it is not suitable for passwords management10:29
Demo of Encryption, Decryption5:50
Introduction to Hashing9:43
Drawbacks of Hashing & what are Brute force attacks, Dictionary or Rainbow tab13:15
Explore hashing drawbacks for password management, including identical hashes for identical inputs and the speed of attacks. See how brute force, dictionary, and rainbow table attacks threaten security.
How to overcome Hashing drawbacks, Brute force and Dictionary table attacks14:17
Introduction to PasswordEncoders in Spring Security8:15
Deep dive of PasswordEncoder implementation classes15:14
Demo of registration and login with Bcrypt password encoder10:32
Security Design Review – Password Storage Strategy for HealthBridge App
Quiz related to Password Management in Spring Security

Why should we consider creating our own AuthenticationProvider8:51
Understanding AuthenticationProvider methods10:29
Implementing and Customizing the AuthenticationProvider inside our application13:14
Environment specific Security configurations using Profiles - Part 14:03
Leverage Spring Boot profiles to conditionally load security configurations and authentication rules across production and lower environments, including conditional login behavior for testers and developers.
Environment specific Security configurations using Profiles - Part 213:15
Learn to configure environment-specific properties in Spring Boot with profiles and multiple property files, activate prod via spring.profiles.active or environment variables, and apply external overrides for logs and credentials.
Environment specific Security configurations using Profiles - Part 37:01
Authentication Logic by Environment: Your Strategy
Quiz related to AuthenticationProvider in Spring Security

Accepting only HTTPS Traffic using Spring Security9:08
Exception Handling in Spring Security framework12:26
Defining Custom AuthenticationEntryPoint - Part 113:59
Defining Custom AuthenticationEntryPoint - Part 24:27
Configure authentication entry points in Spring Security using httpBasic and global exceptionHandling with a CustomBasicAuthenticationEntryPoint; learn why formLogin bypasses global entry points and when to apply global configuration.
Defining Custom AccessDeniedHandler7:17
Implement a custom access denied handler in Spring Security 6 by creating CustomAccessDeniedHandler, overriding handle() to return 403 with an ezbank-denied-reason header, and configure it globally.
Session Timeout & invalid session configurations11:00
Concurrent Session Control configurations9:45
Control concurrent sessions in Spring Security by configuring maximumSessions and maximumSessionsPreventsLogin, demonstrating one or multiple sessions, session expiry, and optional expiredURL handling.
Session Fixation Attack protection with Spring Security15:43
Listening Authentication Events - Theory4:21
Listening Authentication Events - Demo10:16
Form Login Configurations for MVC or monolithic apps - Part 17:03
Master formLogin() customization in Spring Security to define a custom login page and post authentication flow, as demonstrated in the EazySchool MVC app.
Form Login Configurations for MVC or monolithic apps - Part 210:25
Configure form login in spring security 6 mvc apps, including disabling csrf and permitting static assets. Route to a custom login page to secure the dashboard and avoid redirect loops.
Form Login Configurations for MVC or monolithic apps - Part 311:14
Form Login Configurations for MVC or monolithic apps - Part 412:12
Configure form login in MVC apps with defaultSuccessUrl and failureUrl, then implement custom authentication success and failure handlers to redirect to dashboard or show login errors.
Logout Configurations for MVC or monolithic apps5:29
Configure logout behavior in Spring Security with http.logout(), show 'you have been successfully logged out' via the logout success URL, and clear session, authentication, and delete J Session ID cookie.
Spring Security Thymeleaf integration10:44
Learn how to integrate Spring Security with Thymeleaf to conditionally render header navigation. Use the Thymeleaf security dialect to check isAuthenticated and isAnonymous, and retrieve authentication and principal details.
Role of SecurityContext & SecurityContextHolder11:32
Load login user details in Spring Security5:15
Learn how to load the current authenticated user in Spring Security using SecurityContextHolder or a method parameter, and access name and authorities in controllers or services.
Quiz related to "Spring Security customizations for most common use cases"

Setting up the EazyBank UI project11:15
Setting up the EazyBank UI project
Understanding and walkthrough of the Angular code - Part 116:05
Understanding and walkthrough of the Angular code - Part 215:30
Creating new DB schema for EazyBank scenarios11:41
Updating Backend project based on the latest DB schema19:13
Update backend to reflect the latest db schema with entity models and repositories, including findByCustomerId and jpql queries for notices, and implement cache control for responses.
Testing registration of the new user with latest changes7:19
Taste of CORs error5:43
Introduction to CORs8:18
Possible options to fix the CORs issue9:11
Fixing CORs issue using Spring Security8:27
Demo of default CSRF protection inside Spring Security5:14
Introduction to CSRF attack8:37
Solution to handle CSRF attacks8:10
Implementing CSRF token solution inside backend application - Part 112:08
Implementing CSRF token solution inside backend application - Part 210:58
Configure the backend to generate a CSRF token at login and expose it as a cookie read by CSRF filter via CsrfTokenRequestAttributeHandler. Validate requests with the X-XSRF-TOKEN header and jsessionId.
Implementing CSRF token solution inside UI application9:46
Ignoring CSRF protection for public APIs6:13
Quiz related to CORs & CSRF

Authentication Vs Authorization8:15
How Authorities stored inside Spring Security7:35
Explain how Spring Security stores authorities with GrantedAuthority and SimpleGrantedAuthority, and how UserDetails and Authentication carry these authorities through unmodifiable collections and UsernamePasswordAuthenticationToken.
Creating new table authorities to store multiple roles or authorities4:15
Making backend changes to load authorities from new DB table12:06
Configuring Authorities inside web application using Spring Security12:32
Authority Vs Role in Spring Security6:52
Configuring Roles Authorization inside web application using Spring Security6:29
Listening to the Authorization events7:45
Securing Endpoints with Roles – Your Plan ?
Quiz related to Authentication & Authorization

Requirements

Java
Basics of Spring framework

Description

'Spring Security Zero to Master' course will help in understanding the Spring Security Architecture, important packages, interfaces, classes inside it which handles authentication and authorization requests in the web applications. It also covers most common security related topics like CORs, CSRF, JWT, OAUTH2, password management, method level security, user, roles & authorities management inside web applications.

Below are the important topics that this course covers,

Spring Security framework details and it features
How to adapt security for a Java web application using Spring Security
Password Management in Spring Security with PasswordEncoders
Deep dive about encoding, encryption and hashing
What is CSRF, CORS and how to address them
What is Authentication and Authorization. How they are different from each other.
Filters in Spring Security and how to write own custom filters
Deep dive about JWT (JSON Web Tokens) and the role of them inside Authentication & Authorization
Deep dive about OAUTH2 and various grant type flows inside OAUTH2.
Deep dive about OpenID Connect & how it is related to OAUTH2
Applying authorization rules using roles, authorities inside a web application using Spring Security
Method level security in web/non-web applications
Social Login integrations into web applications
Set up of Authorization Server using KeyCloak, Spring Authorization Server

The pre-requisite for the course is basic knowledge of Java, Spring, SpringBoot and interest to learn.

Who this course is for:

Beginner students who are learning Spring framework and interested in security as well
Developers who already know developing web applications using Spring framework
Java Architects

Spring Security Zero to Master along with JWT,OAUTH2

What you'll learn

Explore related topics

Course content

Getting Started14 lectures • 1hr 59min

Changing the default security configurations6 lectures • 1hr 5min

Defining & Managing Users using InMemoryUserDetailsManager6 lectures • 1hr 8min

Defining & Managing Users using a database8 lectures • 1hr 25min

Password Management with PasswordEncoders11 lectures • 1hr 43min

Understanding Authentication Provider and Implementing it7 lectures • 57min

Spring Security customizations for most common use cases18 lectures • 2hr 52min

Understanding CORs & CSRF17 lectures • 2hr 54min

Implementing Authorization using Authorities,Roles9 lectures • 1hr 6min

Custom Filters in Spring Security5 lectures • 53min

Requirements

Description

Who this course is for: