Spring Security

Spring Security
Developer4
Stable release
6.5.1 / June 16, 2025; 11 months ago (2025-06-16) [1]
Written inJava
Operating systemCross-platform
Typeweb application framework security
LicenseApache License 2.0
Websiteprojects.spring.io/spring-security/

Spring Security is a Java/Java EE framework that provides authentication, authorization and other security features for enterprise applications. The project was started in late 2003 as 'Acegi Security' (pronounced Ah-see-gee /ɑːsiːdʒiː/, whose letters are the first, third, fifth, seventh, and ninth characters from the English alphabet, in order to prevent name conflicts[2]) by Ben Alex, with it being publicly released under the Apache License in March 2004. Subsequently, Acegi was incorporated into the Spring portfolio as Spring Security, an official Spring sub-project. The first public release under the new name was Spring Security 2.0.0 in April 2008, with commercial support and training available from SpringSource.

Authentication flow

Diagram 1 shows the basic flow of an authentication request using the Spring Security system. It shows the different filters and how they interact from the initial browser request, to either a successful authentication or an HTTP 403 error.

Browser submits "authentication credentials"
"Authentication mechanism" collects the details
An "authentication request" object is built
Authentication request sent to an AuthenticationManager
AuthenticationManager (this is responsible for passing requests through a chain of AuthenticationProviders)
"Authentication provider" will ask a UserDetailsService to provide a UserDetails object
The resultant UserDetails object (which also contains the GrantedAuthority[]s) will be used to build the fully populated Authentication object.
If "Authentication mechanism" receives back the fully populated Authentication object, it will deem the request valid, put the Authentication into the SecurityContextHolder; and cause the original request to be retried.
If, on the other hand, the AuthenticationProvider rejected the request, the authentication mechanism will ask the user agent to retry.
AbstractSecurityInterceptor authorizes the regenerated request and throws Java exceptions. (Asks AccessDecisionManager for decision.)
ExceptionTranslationFilter translates the exceptions thrown by AbstractSecurityInterceptor into HTTP related error codes
Error code 403 – if the principal has been authenticated and therefore simply lacks sufficient access
Launch an AuthenticationEntryPoint – if the principal has not been authenticated which is an authentication mechanism

Key authentication features

Key authorization features

Instance-based security features

Other features

Releases

  • 2.0.0 (April 2008)
  • 3.0.0 (December 2009)
  • 3.1.0 (December 7, 2011)
  • 3.1.2 (August 10, 2012)
  • 3.2.0 (December 16, 2013)
  • 4.0.0 (March 26, 2015)
  • 4.1.3 (August 24, 2016)
  • 4.2.0 (November 10, 2016)
  • 3.2.10, 4.1.4, 4.2.1 (December 22, 2016)
  • 4.2.2 (March 2, 2017)
  • 4.2.3 (June 8, 2017)
  • 5.0.0 (November 28, 2017)
  • 5.0.8, 4.2.8 (September 11, 2018)[5]
  • 5.1.0 GA (September 27, 2018)[6]
  • 5.1.1, 5.0.9, 4.2.9 (October 16, 2018)[7]
  • 5.1.2, 5.0.10, 4.2.10 (November 29, 2018)[8]
  • 5.1.3, 5.0.11, 4.2.11 (January 11, 2019)[9]
  • 5.1.4 (February 14, 2019)[10]
  • 5.1.5, 5.0.12, 4.2.12 (April 3, 2019)[11]

Citations

  1. ^ "Spring Security 6.5.1". GitHub. Retrieved June 24, 2025.
  2. ^ "Why the name Acegi?". spring.io.
  3. ^ a b c Deinum et al. 2014.
  4. ^ "Master OAuth: How To Build a Secure Authorization Server". December 29, 2024.
  5. ^ "Spring Security 5.0.8 and 4.2.8 Released". spring.io. Retrieved 2019-06-09.
  6. ^ "Spring Security 5.1 goes GA". spring.io. Retrieved 2019-06-09.
  7. ^ "Spring Security 5.1.1, 5.0.9, and 4.2.9 Released". spring.io. Retrieved 2019-06-09.
  8. ^ "Spring Security 5.1.2, 5.0.10, 4.2.10 Released". spring.io. Retrieved 2019-06-09.
  9. ^ "Spring Security 5.1.3, 5.0.11, 4.2.11 Released". spring.io. Retrieved 2019-06-09.
  10. ^ "Spring Security 5.1.4 Released". spring.io. Retrieved 2019-06-09.
  11. ^ "Spring Security 5.1.5, 5.0.12, 4.2.12 Released". spring.io. Retrieved 2019-06-09.

References

Content Disclaimer

Informasi ini disarikan dari Wikipedia dan disajikan kembali untuk tujuan edukasi. Konten tersedia di bawah lisensi CC BY-SA 3.0. Kami tidak bertanggung jawab atas ketidakakuratan data yang bersumber dari kontribusi publik tersebut.

  1. The information displayed on this website is sourced in part or in whole from Wikipedia and has been adapted for the purpose of restating it. We strive to provide accurate and relevant information, however:
  2. There is no guarantee of absolute accuracy. Wikipedia is an open, collaborative project that can be edited by anyone, so information is subject to change.
  3. It is not intended to constitute professional advice. The content displayed is for informational and educational purposes only. For important decisions (e.g., medical, legal, or financial), please consult a professional.
  4. Content copyright. Wikipedia is licensed under the Creative Commons Attribution-ShareAlike License (CC BY-SA). This means that content may be reused with appropriate attribution and shared under a similar license.
  5. Responsible use. Any risk arising from the use of information from this website is entirely the responsibility of the user.