Spring Security

Jump to navigation Jump to search
Spring Security
Developer(s) 4
Stable release
5.0.0 / November 28, 2017 (2017-11-28) [1]
Written in Java
Operating system Cross-platform
Type web application framework security
License Apache License 2.0
Website projects.spring.io/spring-security/

Spring Security is a Java/Java EE framework that provides authentication, authorization and other security features for enterprise applications. The project was started in late 2003 as 'Acegi Security' (pronounced Ah-see-gee, whose letters are characters 1, 3, 5, 7 and 9 from the English alphabet, in order to prevent name conflicts[2]) by Ben Alex, with it being publicly released under the Apache License in March 2004. Subsequently, Acegi was incorporated into the Spring portfolio as Spring Security, an official Spring sub-project. The first public release under the new name was Spring Security 2.0.0 in April 2008, with commercial support and training available from SpringSource.

Authentication flow

Diagram 1 shows the basic flow of an authentication request using the Spring Security system. It shows the different filters and how they interact from the initial browser request, to either a successful authentication or an HTTP 403 error.

Key authentication features

Key authorization features

Instance-based security features

Other features

  • Software localization so user interface messages can be in any language.
  • Channel security, to automatically switch between HTTP and HTTPS upon meeting particular rules.
  • Caching in all database-touching areas of the framework.
  • Publishing of messages to facilitate event-driven programming.
  • Support for performing integration testing via JUnit.
  • Spring Security itself has comprehensive JUnit isolation tests.
  • Several sample applications, detailed JavaDocs and a reference guide.
  • Web framework independence.



External links