Spring Security

Practical guidance for Spring Security 6.x (Spring Boot 3.x) and 7.x (Spring Boot 4.x). Details per topic are in references/.

Safety rules

• Never read, print, or commit secrets: .env, application-*.properties with credentials, client secrets, private keys, JWT signing keys. Reference them via environment variables or a secret manager.
• Never disable security (permitAll() on everything, csrf.disable() for browser apps) just to make a test or demo pass.

First: detect the version

1. Find the Boot version (pom.xml parent/BOM, build.gradle(.kts), libs.versions.toml) and run ./mvnw dependency:tree -Dincludes=org.springframework.security or ./gradlew dependencies --configuration runtimeClasspath to see the Spring Security version.
2. Boot 3.x -> Security 6.x; Boot 4.x -> Security 7.x. Do not mix guidance: in 7.x, APIs deprecated in 6.x are removed (for example and() chaining, authorizeRequests, AntPathRequestMatcher/MvcRequestMatcher style matchers; use the lambda DSL and requestMatchers(...)). Check the "What's New" and migration pages on docs.spring.io/spring-security when upgrading.
3. Identify the app type: servlet MVC (SecurityFilterChain) or WebFlux (SecurityWebFilterChain, @EnableWebFluxSecurity); browser app with sessions, or stateless API.

Core configuration

Declare a SecurityFilterChain bean. WebSecurityConfigurerAdapter no longer exists.