01_Spring_Web_Security.md

Spring Web Security

To celebrate getting back to developing with SpringBoot after a long time, let's organize this again!

References: bamdule.tistory.com, [Book] Learning Spring Web Project through Code

What is Spring Security?

• A framework responsible for application security in Spring-based applications
• Enables simple implementation of user authentication / authorization / security processing!
• Because it operates based on Filters, it works separately from Spring MVC

Security Terms

1. Principal
   • A user accessing an application where the security system is operating
2. Authentication
   • Identifying the accessing user and checking whether they can access the application
3. Authorize (Authorization)
   • Checking whether an authenticated user can use the application's features

How Spring Security Works?

• Processed using various types of filters and interceptors from Servlet
  • Filter
    • A simple filter as referred to in Servlet
    • A Servlet resource independent of Spring
  • Interceptor
    • Plays the role of a filter in Spring
    • Managed as a Spring Bean and belongs within the Spring Context

• When using Spring Security, a separate Context is created and processed using Interceptor and Filter

• Since Spring Security operates within the current Spring Context, it can be designed to enable various authentication methods by utilizing the various beans already included in the context!