Spring Security Reference Documentation

What Spring Security is

Spring Security is the standard way to add authentication and authorisation to a Spring application. It runs as a chain of servlet filters in front of your controllers, and it handles sign in, sessions, password hashing, role checks, OAuth2, CSRF protection and secure headers. This is its official reference, maintained by the Spring team. The current release in September 2026 is 7.1.1, which requires Java 17 or later.

What the reference covers

For servlet applications, which is what a typical Spring Boot REST API is, the reference is organised into:

• Getting started and architecture: the filter chain, SecurityFilterChain beans and how a request moves through them.
• Authentication: username and password, sessions, remember me, passkeys and one-time tokens.
• Authorisation: request rules with authorizeHttpRequests, method security with @PreAuthorize, and multi-factor rules.
• OAuth2 and SAML2: signing in with an external provider, and protecting an API as a resource server that accepts tokens.
• Protection against exploits: CSRF, including the csrf.spa() setup for single page apps, security headers and the HTTP firewall.
• Integrations: CORS, Jackson, concurrency and more.
• Testing: @WithMockUser and MockMvc support for testing your rules.

Is it worth reading, given how much it covers?

Yes, because Spring Security's defaults are strict on purpose, and the usual reaction to a surprise 401 or 403 is to switch something off. The architecture chapter explains why the error happens, and the rest shows the right setting instead. Security questions answered from old blog posts are especially risky here: the configuration style changed across major versions, and older snippets often no longer compile or quietly weaken protection.

What to read first

1. Architecture, so the filter chain stops being a mystery.
2. Authorisation of HTTP requests, to write your own access rules.
3. Username and password authentication and session management, for a React frontend on your own domain.
4. CSRF and CORS, before the React app talks to the API.
5. Testing, so every rule has a test that proves it.

Prerequisites

A working Spring Boot REST API, comfortable Java, and the basics of HTTP, cookies and status codes. Knowing the difference between authentication (who you are) and authorisation (what you may do) makes every chapter easier.

Common questions

Is it free? Yes. It is open source under the Apache 2.0 licence.

Sessions or JWTs for a React app? The reference supports both. For a browser app on your own domain a session cookie is usually simpler to secure, and the resource server chapter covers tokens for mobile apps and other services.

What can I do after it? Secure a Spring Boot API with clear access rules, CSRF and CORS set up for a single page app, and tests that prove each rule holds.

Best for: Java developers who want to secure a Spring Boot backend with confidence rather than copy configuration they do not understand.