SecurityFilterChain configuration in Spring Boot - Step-by-Step Execution

Concept Flow - SecurityFilterChain configuration

Start Application

↓

Create SecurityFilterChain Bean

↓

Configure HttpSecurity

↓

Build Filter Chain

↓

Apply Filters on Requests

↓

Authorize or Deny Access

↓

End

The application starts, creates a SecurityFilterChain bean, configures HTTP security rules, builds the filter chain, applies filters on incoming requests, and then authorizes or denies access.

Execution Sample

Spring Boot

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http.authorizeHttpRequests(auth -> auth
      .requestMatchers("/public/**").permitAll()
      .anyRequest().authenticated()
    ).formLogin();
    return http.build();
  }

Defines a security filter chain that allows public access to '/public/**' URLs and requires authentication for others, enabling form login.

Execution Table

Step	Action	HttpSecurity State	FilterChain State	Result
1	Start application and call filterChain bean	Empty configuration	No filters built	Preparing to configure security
2	Configure authorizeHttpRequests	Rules: '/public/**' permitAll, others authenticated	No filters built	Authorization rules set
3	Enable formLogin	Form login enabled	No filters built	Login page configured
4	Build filter chain	Configuration locked	Filter chain created with filters for auth and login	Filter chain ready
5	Incoming request to '/public/home'	Rules applied	Filter chain processes request	Access granted without login
6	Incoming request to '/user/profile'	Rules applied	Filter chain processes request	Access requires authentication
7	User submits login form	Form login processing	Filter chain processes login	User authenticated
8	Access '/user/profile' after login	Rules applied	Filter chain processes request	Access granted
9	End of flow	Stable security state	Filter chain active	Security enforced on requests

💡 SecurityFilterChain built and applied; requests authorized or denied based on rules.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 9
http.authorizeHttpRequests.rules	empty	'/public/**' permitAll, others authenticated	'/public/**' permitAll, others authenticated	'/public/**' permitAll, others authenticated	'/public/**' permitAll, others authenticated
http.formLogin.enabled	false	false	true	true	true
filterChain.built	false	false	false	true	true

Key Moments - 3 Insights

Why does '/public/home' not require login while '/user/profile' does?

Because the authorizeHttpRequests rule explicitly permits all access to '/public/**' paths (see execution_table step 5), while all other requests require authentication (step 6).

What happens if we forget to call http.build()?

The filter chain is not created or applied, so no security filters run on requests. This is shown in execution_table step 4 where building the chain finalizes configuration.

How does formLogin() affect the filter chain?

Enabling formLogin adds filters to handle login forms and authentication (step 3 and 4). Without it, login pages and processing are not set up.

Visual Quiz - 3 Questions

Look at the execution_table, what is the state of http.formLogin.enabled after step 3?

A true

B false

C null

D undefined

💡 Hint

Check the 'HttpSecurity State' column at step 3 in execution_table.

At which step does the filter chain get created and ready to use?

A Step 2

B Step 6

C Step 4

D Step 1

💡 Hint

Look for 'Filter chain created' in the 'FilterChain State' column.

If we remove the permitAll rule for '/public/**', what will happen at step 5?

A Access denied for all requests

B Access requires authentication

C Access granted without login

D Application crashes

💡 Hint

Refer to the authorization rules in variable_tracker and execution_table step 5.

Concept Snapshot

SecurityFilterChain configuration:
- Define a @Bean method returning SecurityFilterChain
- Use HttpSecurity to set rules (authorizeHttpRequests)
- Permit or require authentication per URL pattern
- Enable login methods (formLogin, etc.)
- Call http.build() to create the chain
- Spring applies filters to incoming requests enforcing rules

Full Transcript

This visual execution trace shows how Spring Boot creates and applies a SecurityFilterChain. The application starts and calls a bean method that configures HttpSecurity. Authorization rules are set to allow public access to '/public/**' and require authentication for others. Form login is enabled to handle user authentication. The filter chain is built and then applied to incoming requests. Requests to public URLs pass without login, while others require authentication. After login, access is granted. Variables track the state of rules and filter chain creation. Key moments clarify why some URLs are public and the importance of building the chain. Quiz questions test understanding of configuration steps and effects.