Securing the API with Spring Security

The filter chain, stateless JWT resource servers, method security, password hashing, and the CORS and CSRF decisions you must make.

The filter chain

@Configuration
@EnableMethodSecurity
class SecurityConfig {

  @Bean
  SecurityFilterChain api(HttpSecurity http) throws Exception {
    http
      .securityMatcher("/api/**")
      .csrf(csrf -> csrf.disable())          // stateless, token-authenticated
      .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
      .authorizeHttpRequests(a -> a
          .requestMatchers("/api/public/**").permitAll()
          .requestMatchers(HttpMethod.GET, "/api/books/**").hasAuthority("SCOPE_books.read")
          .anyRequest().authenticated())
      .oauth2ResourceServer(o -> o.jwt(j -> j.jwtAuthenticationConverter(converter())));
    return http.build();
  }

  @Bean
  PasswordEncoder passwords() { return new BCryptPasswordEncoder(); }
}

• Security is a chain of filters: authentication, then authorization, then your controller. Anything that clears the SecurityContext early breaks everything after it.
• With JWT the server validates a signature, so it is stateless and scales horizontally - but tokens cannot be revoked before they expire, so keep lifetimes short and pair them with refresh tokens.
• Rules are evaluated top to bottom. Put specific matchers before anyRequest().

Method security and ownership checks

@PreAuthorize("hasRole('ADMIN') or #ownerId == authentication.name")
public Order getOrder(String ownerId, Long orderId) { ... }

@PostAuthorize("returnObject.owner == authentication.name")
public Order load(Long id) { ... }

@PreAuthorize("@perm.canEdit(authentication, #id)")
public void update(Long id, UpdateDto dto) { ... }

Role checks alone are not authorization. Check ownership too: hasRole('USER') says the caller is logged in, not that the order belongs to them.

Hardening and secrets

spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://login.example.com/realms/main
          # or jwk-set-uri for a static key source

management:
  endpoints:
    web:
      exposure:
        include: health,info
  endpoint:
    health:
      show-details: when-authorized

• Keep signing keys and client secrets in a vault or environment injection, never in application.yml committed to git.
• Validate the issuer and audience, not just the signature - any token from the same key can otherwise be replayed.
• Actuator endpoints bypass your controller security unless the management port or the filter chain covers them.

FAQ

Related

REST controllers and dependency injection Observability with Actuator, logging and metrics

Last refreshed 2026-09-18.