Spring Boot Security Basics

Adding spring-boot-starter-security secures every endpoint by default — you then configure exactly what should be open or protected.

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/public/**").permitAll()
            .anyRequest().authenticated()
        );
        return http.build();
    }
}

Authentication — who are you? (login, tokens)
Authorization — what are you allowed to do? (roles, permissions)
JWT is the most common token format for stateless REST API security