Spring Security auto-configuration in Spring Boot - Step-by-Step Execution

Concept Flow - Spring Security auto-configuration

Start Spring Boot App

↓

Spring Boot scans classpath

↓

Detect spring-boot-starter-security

↓

Load SecurityAutoConfiguration

↓

Apply default security settings

↓

Create default user & password

↓

Secure all HTTP endpoints

↓

App ready with security

Spring Boot detects the security starter, loads auto-configuration, sets default security rules, and creates a default user automatically.

Execution Sample

Spring Boot

/* spring-boot-starter-security dependency added */
@SpringBootApplication
public class App {
  public static void main(String[] args) {
    SpringApplication.run(App.class, args);
  }
}

This code starts a Spring Boot app with Spring Security auto-configured by default.

Execution Table

Step	Action	Condition/Check	Result/Effect
1	Start Spring Boot app	App main method runs	Spring Boot context starts
2	Classpath scan	spring-boot-starter-security present?	Yes, detected
3	Load SecurityAutoConfiguration	Auto-config enabled?	Yes, loaded
4	Apply default security	No custom security config?	Default security applied
5	Create default user	No user defined?	User 'user' with generated password created
6	Secure HTTP endpoints	All endpoints secured by default	Authentication required for all requests
7	App ready	Security active	App runs with default security
8	Exit	No further config	Auto-configuration complete

💡 Auto-configuration stops after applying default security and creating default user.

Variable Tracker

Variable	Start	After Step 3	After Step 5	Final
securityAutoConfigLoaded	false	true	true	true
defaultUserCreated	false	false	true	true
httpEndpointsSecured	false	false	true	true

Key Moments - 3 Insights

Why does Spring Security create a default user automatically?

Because no custom user is defined, the auto-configuration creates a default user to secure the app by default, as shown in execution_table step 5.

What happens if I add my own security configuration?

The auto-configuration backs off and does not apply defaults, so your config takes priority. This is implied by the condition in step 4.

Are all HTTP endpoints secured by default?

Yes, by default all endpoints require authentication, as shown in step 6 of the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the default user created?

A Step 5

B Step 3

C Step 6

D Step 2

💡 Hint

Check the 'Action' column for 'Create default user' in the execution_table.

According to variable_tracker, what is the value of 'httpEndpointsSecured' after step 5?

A false

B true

C undefined

D null

💡 Hint

Look at the 'httpEndpointsSecured' row and the 'After Step 5' column in variable_tracker.

If you add a custom security configuration, which step in execution_table would likely be skipped?

A Step 5

B Step 6

C Step 4

D Step 2

💡 Hint

Step 4 checks if no custom config exists before applying defaults.

Concept Snapshot

Spring Security auto-configuration:
- Detects spring-boot-starter-security on classpath
- Loads SecurityAutoConfiguration automatically
- Applies default security if no custom config
- Creates default user 'user' with random password
- Secures all HTTP endpoints by default
- Auto-config backs off if custom security config exists

Full Transcript

When you start a Spring Boot app with the spring-boot-starter-security dependency, Spring Boot scans the classpath and detects the security starter. It then loads the SecurityAutoConfiguration class automatically. If you have not defined your own security configuration, Spring applies default security settings. This includes creating a default user named 'user' with a generated password and securing all HTTP endpoints so they require authentication. The app then runs with these default security settings. If you add your own security configuration, the auto-configuration will back off and not apply these defaults. This process ensures your app is secure out of the box with minimal setup.