Spring Security Theory¶

Theory pages explain protocols, threats, guarantees, and Spring Security internals without mixing in step-by-step exercises. Labs link back to these pages and contain implementation instructions and executable proof.

Foundations¶

1. Request authorization and filter chains
2. Authentication managers and providers
3. Password storage and migration
4. Method security
5. Security error boundaries
6. Browser sessions and session fixation
7. Cross-site request forgery
8. CORS and security headers
9. JWT resource server
10. Identity provider fundamentals
11. Authorization Code with PKCE
12. Token lifecycle
13. Opaque token introspection
14. Service-to-service and client credentials
15. JWK rotation and multiple issuers
16. API gateway

Federation and distributed systems¶

Existing conceptual references remain grouped under Security until extracted during their implementation sessions:

• OAuth2 and OIDC
• SSO with OIDC and SAML
• JWT and resource-server concepts
• Authorization
• Security use cases

A theory page must not claim a mechanism is implemented. Consult the Coverage Registry for evidence status.