SecurityFilterChain configuration in Spring Boot

Introduction

SecurityFilterChain controls how your app checks and allows user access. It helps keep your app safe by deciding who can see what.

You want to protect certain pages or APIs in your Spring Boot app.

You need to set up login and logout rules for users.

You want to allow some users to access admin features but block others.

You want to add security checks like requiring HTTPS or blocking certain IPs.

You want to customize how your app handles security without using default settings.

Syntax

Spring Boot

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated()
        )
        .formLogin(withDefaults())
        .httpBasic(withDefaults());
    return http.build();
}

This method defines the security rules for your app.

Use requestMatchers to specify which URLs are open or protected.

Examples

This example allows anyone to visit /home and /about without logging in.

Spring Boot

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/home", "/about").permitAll()
            .anyRequest().authenticated()
        )
        .formLogin(withDefaults());
    return http.build();
}

This example requires users to have ADMIN role to access /admin URLs.

Spring Boot

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        )
        .httpBasic(withDefaults());
    return http.build();
}

This example disables CSRF protection and requires login for all pages.

Spring Boot

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf.disable())
        .authorizeHttpRequests(auth -> auth
            .anyRequest().authenticated()
        )
        .formLogin(withDefaults());
    return http.build();
}

Sample Program

This configuration allows anyone to access URLs under /public without login. All other URLs require the user to log in. It supports form login and basic HTTP login.

Spring Boot

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(withDefaults())
            .httpBasic(withDefaults());
        return http.build();
    }
}

Important Notes

Always call http.build() at the end to create the filter chain.

Order of rules matters: more specific URL patterns should come before general ones.

Use permitAll() to allow open access, and authenticated() to require login.

Summary

SecurityFilterChain defines who can access which parts of your app.

Use requestMatchers to set URL rules.

Remember to build and return the chain with http.build().

Practice

1. What is the primary purpose of a SecurityFilterChain in Spring Boot?

easy

A. To handle file uploads

B. To define security rules for web requests and control access

C. To manage application logging levels

D. To configure database connections

Solution

1. Step 1: Understand the role of SecurityFilterChain

   The SecurityFilterChain is used in Spring Security to define how HTTP requests are secured, including which URLs require authentication and what roles can access them.

2. Step 2: Compare with other options

   Database connections, logging, and file uploads are unrelated to SecurityFilterChain's purpose.

3. Final Answer:

   To define security rules for web requests and control access -> Option B

4. Quick Check:

   SecurityFilterChain controls web security = D [OK]

Hint: SecurityFilterChain controls web request security rules [OK]

Common Mistakes:

• Confusing SecurityFilterChain with database or logging config
• Thinking it manages file uploads
• Assuming it handles application-wide settings

2. Which of the following is the correct way to declare a SecurityFilterChain bean in Spring Boot?

easy

A. @Component public void filterChain(HttpSecurity http) { http.build(); }

B. public SecurityFilterChain filterChain() { return new SecurityFilterChain(); }

C. @Bean public void filterChain() { return http.build(); }

D. @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http.build(); }

Solution

1. Step 1: Identify correct bean declaration syntax

   In Spring Boot, a SecurityFilterChain bean must be annotated with @Bean, accept HttpSecurity as a parameter, and return the built chain with http.build().

2. Step 2: Check each option

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http.build(); } correctly uses @Bean, returns SecurityFilterChain, and calls http.build(). Options B and D have wrong return types or missing annotations. @Component public void filterChain(HttpSecurity http) { http.build(); } uses @Component and void return, which is incorrect.

3. Final Answer:

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { return http.build(); } -> Option D

4. Quick Check:

   Correct bean method signature = C [OK]

Hint: Bean method must return SecurityFilterChain and use @Bean [OK]

Common Mistakes:

• Forgetting @Bean annotation
• Using void return type
• Not passing HttpSecurity parameter

3. Given this SecurityFilterChain configuration snippet, what will happen when a user accesses /admin URL?

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
  http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin").hasRole("ADMIN")
    .anyRequest().authenticated()
  ).formLogin();
  return http.build();
}

medium

A. All URLs are open without authentication

B. Anyone can access /admin without login

C. Only users with role ADMIN can access /admin; others must log in

D. Access to /admin is denied to everyone

Solution

1. Step 1: Analyze the authorization rules

   The config states that requests to "/admin" require the user to have role "ADMIN". All other requests require authentication but no specific role.

2. Step 2: Understand formLogin and access control

   Form login is enabled, so users must log in. Only users with ADMIN role can access /admin; others will be blocked or redirected to login.

3. Final Answer:

   Only users with role ADMIN can access /admin; others must log in -> Option C

4. Quick Check:

   /admin requires ADMIN role = A [OK]

Hint: Check requestMatchers roles and formLogin presence [OK]

Common Mistakes:

• Assuming /admin is open to all
• Ignoring role restrictions
• Thinking formLogin disables security

4. Identify the error in this SecurityFilterChain configuration:

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
  http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/user").authenticated()
    .anyRequest().permitAll()
  );
  return http.build();
}

medium

A. Missing throws Exception in method signature

B. Calling http.build() without returning it

C. No error, configuration is correct

D. Using permitAll() before authenticated() causes error

Solution

1. Step 1: Check method signature for exceptions

   The http.build() method can throw a checked exception, so the method should declare throws Exception.

2. Step 2: Verify return statement and method correctness

   The method returns http.build() correctly. The order of authenticated() and permitAll() is valid. So the only issue is missing exception declaration.

3. Final Answer:

   Missing throws Exception in method signature -> Option A

4. Quick Check:

   http.build() may throw Exception = B [OK]

Hint: Add throws Exception when calling http.build() [OK]

Common Mistakes:

• Omitting throws Exception causes compile error
• Misunderstanding order of permitAll and authenticated
• Forgetting to return http.build()

5. You want to configure a SecurityFilterChain that allows anonymous access to /public/**, requires authentication for /user/**, and restricts /admin/** to users with role ADMIN, and denies access to all other requests. Which configuration snippet correctly implements this?

hard

A. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/public/**").permitAll()
.requestMatchers("/user/**").authenticated()
.requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().denyAll()
).formLogin();
return http.build();
}

B. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/admin/**").hasRole("ADMIN")
.requestMatchers("/user/**").authenticated()
.requestMatchers("/public/**").permitAll()
.anyRequest().authenticated()
).formLogin();
return http.build();
}

C. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/public/**").authenticated()
.requestMatchers("/user/**").permitAll()
.requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().denyAll()
).formLogin();
return http.build();
}

D. @Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/public/**").permitAll()
.requestMatchers("/user/**").permitAll()
.requestMatchers("/admin/**").authenticated()
.anyRequest().denyAll()
).formLogin();
return http.build();
}

Solution

1. Step 1: Match access rules to URL patterns

   The requirement is: /public/** open to all (permitAll), /user/** requires authentication, /admin/** requires ADMIN role, and all others denied.

2. Step 2: Check each option's order and rules

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").permitAll() .requestMatchers("/user/**").authenticated() .requestMatchers("/admin/**").hasRole("ADMIN") .anyRequest().denyAll() ).formLogin(); return http.build(); } matches the requirements exactly. @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/admin/**").hasRole("ADMIN") .requestMatchers("/user/**").authenticated() .requestMatchers("/public/**").permitAll() .anyRequest().authenticated() ).formLogin(); return http.build(); } allows anyRequest authenticated (not denyAll). @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").authenticated() .requestMatchers("/user/**").permitAll() .requestMatchers("/admin/**").hasRole("ADMIN") .anyRequest().denyAll() ).formLogin(); return http.build(); } swaps permitAll and authenticated for /public and /user incorrectly. @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").permitAll() .requestMatchers("/user/**").permitAll() .requestMatchers("/admin/**").authenticated() .anyRequest().denyAll() ).formLogin(); return http.build(); } permits /user/** to all and only authenticates /admin/**, which is wrong.

3. Final Answer:

   @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.authorizeHttpRequests(auth -> auth .requestMatchers("/public/**").permitAll() .requestMatchers("/user/**").authenticated() .requestMatchers("/admin/**").hasRole("ADMIN") .anyRequest().denyAll() ).formLogin(); return http.build(); } -> Option A

4. Quick Check:

   Correct URL access rules = A [OK]

Hint: Match URL patterns to correct access methods in order [OK]

Common Mistakes:

• Mixing permitAll and authenticated for URLs
• Forgetting to restrict admin URLs by role
• Using anyRequest().authenticated() instead of denyAll()