Authentication flow in Spring Boot

Introduction

Authentication flow helps check who a user is before letting them use an app. It keeps the app safe by making sure only real users get access.

When you want users to log in to your website or app.

When you need to protect certain pages or data from strangers.

When you want to remember users so they don’t have to log in every time.

When you want to check user identity before allowing actions like buying or editing.

When you want to log out users to keep their accounts safe.

Syntax

Spring Boot

public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            .and()
            .formLogin()
                .loginPage("/login")
                .permitAll()
            .and()
            .logout()
                .permitAll();
    }
}

This is a basic Spring Security setup for authentication flow.

It defines which URLs need login and which don’t.

Examples

Allow anyone to visit /home and /about without login, but require login for all other pages.

Spring Boot

http.authorizeRequests()
    .antMatchers("/home", "/about").permitAll()
    .anyRequest().authenticated();

Use a custom login page and send users to /dashboard after successful login.

Spring Boot

http.formLogin()
    .loginPage("/custom-login")
    .defaultSuccessUrl("/dashboard", true);

Set a custom logout URL and page shown after logout.

Spring Boot

http.logout()
    .logoutUrl("/signout")
    .logoutSuccessUrl("/goodbye");

Sample Program

This Spring Boot app sets up a simple authentication flow. Public URLs under /public are open to all. Other URLs require login. It uses a form login page at /login and allows logout.

Spring Boot

package com.example.demo;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;

@SpringBootApplication
public class DemoApplication {

    public static void main(String[] args) {
        SpringApplication.run(DemoApplication.class, args);
    }

    @EnableWebSecurity
    public static class SecurityConfig {

        @Bean
        public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
            http
                .authorizeHttpRequests(auth -> auth
                    .requestMatchers("/public/**").permitAll()
                    .anyRequest().authenticated()
                )
                .formLogin(form -> form
                    .loginPage("/login")
                    .permitAll()
                )
                .logout(logout -> logout
                    .permitAll()
                );
            return http.build();
        }
    }
}

Important Notes

Spring Security uses filters to check authentication on each request.

Always protect sensitive URLs by requiring authentication.

Customize login and logout pages for better user experience.

Summary

Authentication flow checks user identity before access.

Spring Security configures which pages need login.

Use form login and logout to manage user sessions.