What is Spring Security and how does the filter chain work? स्प्रिंग सिक्योरिटी क्या है और फ़िल्टर चेन कैसे काम करती है?

Spring Security is a framework that provides authentication, authorization, and protection against common attacks (CSRF, session fixation, clickjacking) for Spring applications. It works by inserting a chain of servlet filters, FilterChainProxy, in front of the application, with each filter handling one concern — e.g. UsernamePasswordAuthenticationFilter for form login, BasicAuthenticationFilter for HTTP Basic, or a custom JWT filter.

Every incoming request passes through this chain before reaching the controller; a filter can authenticate the request, populate the SecurityContext, or reject the request outright, so by the time a request reaches a controller, Spring Security has already determined who the caller is and what they're allowed to do.

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(auth -> auth
            .requestMatchers("/public/**").permitAll()
            .anyRequest().authenticated());
        return http.build();
    }
}