What does Spring Security do by default when you just add the starter?
Options
- Nothing: you must configure every rule yourself first
- It secures all endpoints, with a generated password (Correct option)
- It encrypts the whole database with a default key
- It blocks only POST requests and leaves GET open
Answer
Secures all endpoints (login form / HTTP Basic with a generated password) until you define your own rules
Why
Adding spring-boot-starter-security is "secure by default": every endpoint needs authentication, a default user user is created with a random password printed in the log, and CSRF protection is on for browser-style requests.
You then define a SecurityFilterChain bean to say which URLs are public, how users authenticate (JWT, OAuth2, form login) and which roles can do what.
Store passwords hashed with BCryptPasswordEncoder, never in plain text.
@Bean
SecurityFilterChain chain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(a -> a
.requestMatchers("/public/**").permitAll()
.requestMatchers("/admin/**").hasRole("ADMIN")
.anyRequest().authenticated())
.oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()));
return http.build();
}Remember
Spring Security: filter chain, authn then authz, BCrypt for passwords.