Spring Security in practice

Dates and Booking

Securing Your Microservices with Spring Security, OAuth 2.0, and OpenID Connect (OIDC)

Spring Security provides the foundation for authentication and authorization in Spring applications. In a microservices architecture, however, identities, tokens, and access decisions must cross additional system boundaries. This course brings the core concepts of Spring Security together with OAuth 2.0, OpenID Connect (OIDC), and Spring Authorization Server.

Across two intensive training days, you will develop a deep understanding of the essential Spring Security concepts, one step at a time. You will secure an end-to-end sample application, starting with the security filter chain and continuing through an OAuth 2.0 resource server. Along the way, you will work directly with modern authentication and authorization mechanisms.

Practice drives the course. During hands-on sessions, you will configure, test, and observe the application’s security behavior. The exercises cover MFA, passkeys, secure password hashes, JWTs, opaque tokens, and both browser and service-to-service flows.

Agenda

Day 1: Spring Security Foundations and Practice

• Introduction to security
  • Security objectives and threats, standards, authentication, authorization, and auditing
• Spring Security basics
  • Core principles, the security filter chain, ‘SecurityContext’, and secure Spring Boot defaults
• Authentication
  • Authentication building blocks, user stores, HTTP Basic, form login, MFA, passkeys, and session management
• Request and message authorization
  • HTTP access rules, request matchers, roles, custom conditions, auditing, and WebSockets
• Method and domain-object security
  • Security annotations, pre- and post-conditions, return values, and ‘SecurityContext’ propagation
• Security testing and observability
  • Testing with MockMvc, test identities, security events, audit, and metrics

Day 2: Passwords, Web Security, and OAuth 2.0

• Secure password storage
  • Adaptive hashes, ‘PasswordEncoder’, ‘DelegatingPasswordEncoder’, and transparent upgrades
• Protection against common web vulnerabilities
  • Security headers, Content Security Policy, CSRF protection, HTTPS, and HSTS
• OAuth 2.0 and OpenID Connect (OIDC)
  • Roles, grant types, PKCE, different token types, and social login
• Spring Authorization Server
  • Endpoints, client registration, discovery, keys, and token customization
• Protecting and accessing resources with OAuth 2.0
  • Resource server and client, JWTs, opaque tokens, service-to-service access, DPoP, and BFF
• Optional research exercises
  • DPoP, passkey persistence, token trade-offs, and bonus exercises
• What’s next and final security review
  • Staying current, diagnosing misconfigurations, and restoring protections

Your Benefits

Audience

Software developers, architects, and IT professionals who work with Spring or Java and want to deepen their knowledge of security.

Prerequisites

• Experience in developing Spring or Java applications
• Laptop with development environment (IntelliJ, Eclipse, VS Code)
• Maven & current Java version
• Internet access & permission to install software

Training Objectives

Your Trainers