asmhatre
73ab67b171
Companion project for "The Spring Security Filter Chain Explained". A real Spring Boot 4.1.1 servlet application whose scenarios are Spring profiles, plus a diagnostic controller that prints the live FilterChainProxy, the reflected FilterOrderRegistration table, and the servlet container's own registrations. Twelve captured transcripts under docs/output/, nine cross-linked doc chapters, 21 assertions. Also fixes a broken relative link in method-security/docs/01: the cross-module reference to context-propagation/README.md needed two levels up, not one.
3.0 KiB
spring-security-demo
Companion code for the Spring Security series on ankurm.com. Each
directory is a self-contained Maven project for one article, with its own pom.xml, its own
numbered documentation chapters, and its own captured output under docs/output/ — regenerated
by that module's scripts/run-all.sh, never typed by hand.
| Module | Article | What it demonstrates |
|---|---|---|
context-propagation/ |
Spring Security Context Propagation: The Complete Guide | Whether a SecurityContext survives @Async, executors, virtual threads, StructuredTaskScope, Reactor, schedulers and the servlet filter chain |
method-security/ |
Method Security in Spring Security 7: @PreAuthorize, @PostAuthorize and the Proxy Traps |
What the method-security annotations do, the full SpEL surface, and the cases where the check silently does not run |
filter-chain/ |
The Spring Security Filter Chain Explained | Every filter in the default chain and its order number, where a custom filter actually lands, and how to read the TRACE log |
The three are related more closely than they look. filter-chain is about how an
Authentication gets into SecurityContextHolder in the first place and in what order;
context-propagation is about whether it survives leaving the request thread; method-security
reads it back on whatever thread it ends up on. An @Async method carrying @PreAuthorize fails
with AuthenticationCredentialsNotFoundException for reasons that belong to the second module,
not the third — and a custom authentication filter that never populated the context in the first
place fails the same way, for reasons that belong to the first.
Common ground
All three modules target the same verified stack: JDK 25 (Temurin 25.0.4.1+1),
Spring Framework 7.0.9, Spring Security 7.1.1 — the versions Spring Boot 4.1.1
manages. Versions were taken from maven-metadata.xml on Maven Central rather than from
release announcements.
context-propagation additionally needs --enable-preview, because StructuredTaskScope is
still a preview API on JDK 25. method-security does not. filter-chain is the only module
that is a real servlet application: it inherits spring-boot-starter-parent and runs on Tomcat,
because the thing it demonstrates only exists inside a servlet container.
Running a module
cd method-security # or context-propagation, or filter-chain
./scripts/run-all.sh # every demo plus the test suite, regenerating docs/output/
mvn test # just the assertions
filter-chain also has ./scripts/run.sh <profile> and ./scripts/stop.sh, because its
scenarios are a running web application rather than a main() method.
License
MIT — see LICENSE.