Spring Security in Action (Laurentiu Spilca)（Z-Library）

【One-Line Pitch】 A hands-on guide to baking security into Java/Spring applications from the ground up, walking you from basic authentication and authorization through to OAuth2 and OpenID Connect. Best for Spring developers who want to use Spring Security correctly rather than copy-paste configurations they don't understand. 【Book Arc】 - **Opening (~0%–10%)**: Frames security as a layered, cross-cutting concern and surveys common web vulnerabilities (injection, sensitive-data exposure, XSS, CSRF) so you know what you're defending against. - **Early (~10%–30%)**: Gets a first Spring Security app running — default configuration, HTTP Basic, and overriding defaults with custom `UserDetailsService` and `PasswordEncoder` beans. - **Early–Middle (~30%–45%)**: Deepens user management with the `UserDetails`, `UserDetailsService`, and `UserDetailsManager` contracts, plus password encoding strategies including `DelegatingPasswordEncoder`. - **Middle (~45%–60%)**: Explains the authentication architecture — `AuthenticationProvider`, `SecurityContext`, and the `SecurityContextHolder` threading strategies (THREADLOCAL, INHERITABLETHREADLOCAL, GLOBAL). - **Late (~60%–85%)**: Moves to authorization, endpoint protection, and adapting Spring Security to new architectures; excerpts do not cover the exact chapter breakdown here. - **Ending (~85%–100%)**: Advanced OAuth2 and OpenID Connect configuration, plus automated security testing, culminating in a customized configuration. (Excerpts do not cover these chapters in detail.) 【Key Takeaways】 - **Security is layered, and Spring Security handles the application layer** (Opening): it protects the app's environment, data, and the system it runs on — not networking or storage, which have their own practices. - **Know the common vulnerabilities before configuring defenses** (Opening): injection attacks (SQL, LDAP, XPath, OS command) and sensitive-data exposure are recurring, high-impact mistakes that good configuration prevents. - **Spring Security's defaults are a starting point, not a destination** (Early): a default project proves dependencies are wired correctly; real apps override user management and authorization explicitly. - **Separate user management from authorization configuration** (Early): splitting `UserDetailsService`/`PasswordEncoder` beans from `WebSecurityConfigurerAdapter` keeps responsibilities clean and projects readable. - **The `UserDetails` contract describes a user; `UserDetailsService` describes how to obtain one** (Early–Middle): `UserDetailsManager` extends this with create/change/delete, and implementations include in-memory, JDBC, and LDAP variants. - **`DelegatingPasswordEncoder` lets you migrate password schemes safely** (Middle): it picks an encoder based on a hash prefix, defaulting to a chosen implementation (e.g., BCrypt) when no prefix is present. - **Authentication is pluggable via `AuthenticationProvider`** (Middle): when username/password isn't enough (SMS codes, fingerprints, key files), you implement custom providers rather than fighting the framework. - **`SecurityContextHolder` threading strategy matters for async code** (Middle): THREADLOCAL is the default; INHERITABLETHREADLOCAL copies context to `@Async` threads, and manually created threads need explicit context copying. 【Reading Tips】 - **Deep-read the early chapters on `UserDetails`/`UserDetailsService`/`PasswordEncoder`** — these contracts underpin everything later, and the book builds on them repeatedly. - **Skim the vulnerability survey if you already know OWASP basics**, but don't skip it entirely; it frames why each configuration choice exists. - **Pay close attention to the `SecurityContextHolder` threading section** — it's a common source of subtle bugs in async and reactive applications. - **Treat the OAuth2/OpenID Connect material as the payoff** — read it after the authentication architecture clicks, not before. - **Run the code samples**; the book is example-driven, and the cURL/Base64 walkthroughs are meant to be typed, not just read. 【Coverage Limits】 This guide is synthesized from stratified excerpts covering roughly the first half of the book; the authorization, architecture-adaptation, OAuth2/OpenID Connect, and testing chapters are referenced but not detailed in the source material.