Learning paths

Spring Core and Spring Security in depth

The IoC container, dependency injection, scopes, configuration, proxies and events; then the security filter chain, authentication, password storage, authorization, JWT, OAuth 2.0 and CSRF/CORS. Every step has a lab or diagram.

  • For: You use Spring Boot and want to understand what the framework is doing for you, and secure an API properly.
  • By the end: You can explain how Spring wires and proxies your beans, debug the classic traps, and design authentication and authorization for a real API.
  • Size: 15 lessons (45 min of reading, plus time to try the code), intermediate to advanced
Start with IoC and dependency injection
  1. Dependency injection in depth: constructor, setter, field, @Qualifier and @PrimarySpring Core and Spring MVC, intermediate, 3 min
  2. Bean scopes and lifecycleSpring Core and Spring MVC, intermediate, 3 min
  3. Java configuration: @Configuration, @Bean, @Import, @Profile and @ConditionalSpring Core and Spring MVC, intermediate, 3 min
  4. Aspect-oriented programmingSpring Core and Spring MVC, advanced, 3 min
  5. How Spring proxies work: JDK dynamic proxies, CGLIB and the self-invocation trapSpring Core and Spring MVC, advanced, 3 min
  6. Application events: decoupling with @EventListenerSpring Core and Spring MVC, intermediate, 3 min
  7. Spring Security: the big pictureSpring Security, advanced, 3 min
  8. Inside Spring Security: DelegatingFilterProxy, SecurityFilterChain and the SecurityContextSpring Security, intermediate, 3 min
  9. Authentication: UserDetailsService, AuthenticationManager and loginSpring Security, intermediate, 3 min
  10. Storing passwords: hashing, salting and BCryptSpring Security, beginner, 3 min
  11. Authorization: URL rules, roles vs authorities and method securitySpring Security, intermediate, 3 min
  12. JWT for stateless APIs: structure, signing, expiry and refresh tokensSpring Security, advanced, 3 min
  13. OAuth 2.0 and OpenID Connect: social login, Keycloak and resource serversSpring Security, advanced, 3 min
  14. CSRF, CORS and security headersSpring Security, intermediate, 3 min

Other paths