Spring sercurity

• client request -> spring security filter - secure controller

• add maven dependency in pom.xml

• https://dev.to/jps27cse/spring-security-for-beginners-the-easiest-guide-youll-ever-read-2cib

• https://www.marcobehler.com/guides/spring-security
• https://medium.com/@thecodealchemist/spring-security-for-beginners-part-1-a982ca2bffd3
• https://medium.com/@ansgar.nell/spring-boot-security-step-by-step-21ea836499f8
• https://blog.rajugowda.in/spring-security-behind-the-curtain
• https://medium.com/@hansana.etec1216/mastering-spring-security-for-beginners-a-hands-on-guide-with-a-real-world-demo-f2769f22d0fa
• https://www.marcobehler.com/guides/spring-framework

In reality, application servers, particularly those with Servlet containers, introduce additional layers of complexity and security. When a request reaches the server, it first encounters the Servlet container, which manages the servlets. But here's the thing—the servlet container doesn't just accept any request directly. Before a request can reach the servlet, it undergoes a rigorous process of validation and authentication.

This process is known as the Servlet Request Processing Pipeline, which includes a Filter Chain—a series of filters that validate the incoming request from the client. Every request must successfully pass through these filters before being granted access to the application.

• SecurityFilterAutoConfiguration. This auto-configuration class automatically sets up the security infrastructure for your application.

• Here's what happens behind the scenes:

• Automatic Registration: Spring Boot automatically registers a DelegatingFilterProxy filter with the name springSecurityFilterChain
• Request Delegation: When a request arrives, the DelegatingFilterProxy delegates the processing to the FilterChainProxy bean
• Filter Execution: The FilterChainProxy uses SecurityFilterChain to execute a series of security filters for each incoming request
• Authentication, Authorization, Principal, Authority, Role
• you can add your custom filter anywhere in standard in build filter chain using http.addFilterBefore(jwtAuthFilter(customFilterName), UsernamePasswordAuthenticationFilter.clas)
• http.addFilterAfter(customFilterName, CsrfFilter.class)