Spring Security Configuration, Authorization, and Tokens

Configure security as explicit filter chains with an explicit posture, then place every authorization decision in exactly one of two layers. Most production defects here are not bypasses; they are rules scattered across three layers where only one is tested.

When to use

• One or more SecurityFilterChain beans, their order, and their path scope.
• Stateless bearer API versus cookie session, and the CSRF consequences.
• OAuth2 resource server with JWT, including issuer, audience, and signature validation.
• Mapping scopes, roles, or permissions from claims to Spring authorities.
• @PreAuthorize, custom permission evaluators, or AuthorizationManager beans.
• Password hashing, secret handling, response headers, error leakage, and spring-security-test usage.

When not to use