Security architecture
How Spring Security works internally - the servlet filter chain, SecurityFilterChain configuration, AuthenticationManager and providers, SecurityContext, 401 versus 403, CSRF, CORS and password storage.
JWT
How JSON Web Tokens work, signing algorithms (HS256 vs RS256), what a resource server must validate, access and refresh token design, revocation, storage in browsers, and common attacks.
OAuth2 and OIDC
OAuth2 roles and grant types, Authorization Code with PKCE, client credentials for service-to-service calls, OIDC ID tokens, Spring Security client and resource server setup, and token propagation in microservices.
Method security
Enforce authorization inside services with @EnableMethodSecurity, @PreAuthorize and @PostAuthorize SpEL expressions, custom permission beans, preventing IDOR, and the proxy limits that bypass checks.
Common vulnerabilities
The OWASP Top 10 mapped to Java and Spring - SQL injection, broken access control, XSS, CSRF, SSRF, insecure deserialization, mass assignment, misconfiguration, vulnerable dependencies and secrets, with concrete defences.