Spring Security Testing

Signals: @WithMockUser, @WithUserDetails, csrf(), jwt(), oauth2Login(), mockOidcLogin(), @WithSecurityContext, SecurityMockMvcRequestPostProcessors, AccessDeniedException, SCOPE_

Tested With

• Spring Boot 3.2+ / Spring Boot 4.x
• Spring Security 6.x / 7.x
• Spring Framework 6.x / Spring Framework 7.x
• JUnit 5

Do NOT Use This Skill When

• Testing REST controller HTTP behavior (status codes, JSON body, headers) without security focus → use spring-mvc-testing
• Testing reactive endpoints with security → use spring-webflux-testing
• Testing JPA repositories → use spring-jpa-testing
• Writing pure unit tests for service logic without security context → use spring-testing-fundamentals

When to Read References