How do you secure a Spring application?

Direct answer

What a strong answer covers

How it works

Spring Security is a filter chain in front of the application. Authentication establishes who the caller is through a session, a JWT, or OAuth2; authorisation decides what they may do, expressed as URL rules in the SecurityFilterChain and as @PreAuthorize on methods so a bypassed controller still cannot reach protected logic. Passwords use a slow adaptive hash such as bcrypt or Argon2, CSRF stays on for cookie-authenticated browsers, headers such as HSTS and content security policy are enabled, input is validated, and login failures and privilege changes are logged.

Example

An API that uses bearer tokens disables CSRF and sets the session to stateless, while the admin UI on the same application keeps sessions and CSRF tokens on a separate filter chain. A method @PreAuthorize("hasRole('ADMIN') or #userId == authentication.name") stops one user from reading another’s profile even through a new endpoint added later.

Common mistakes

• Disabling CSRF globally because a form stopped working, then serving cookie-authenticated pages without it.
• Checking roles only in the controller and leaving service methods callable from anywhere.
• Storing passwords with a fast hash such as SHA-256 and no per-user salt.

A useful answer structure

Answer from your own work.

Do not memorise a script: use only examples you can explain honestly in follow-up questions.