A comprehensive and clear table covering the key Spring Security components

🔐 Spring Security Components Cheat Sheet

Component Type Responsibility Common Use / Notes Relations
SecurityContextHolder Class Stores the current SecurityContext per thread (per request). Used to retrieve the authenticated user globally. ➜ Holds SecurityContext → Contains Authentication
SecurityContext Interface Represents the security state of the application (i.e. who is authenticated). Always accessed via SecurityContextHolder.getContext() ➜ Contains Authentication
Authentication Interface Represents the authentication token. Holds principal, credentials, authorities, etc. Returned by authentication mechanisms, set into the SecurityContext. ➜ Contains: Principal, Credentials, Collection<GrantedAuthority>
GrantedAuthority Interface Represents a permission/role. Abstract interface for authorities like "ROLE_ADMIN", "READ_PRIVILEGE" ➜ Implemented by SimpleGrantedAuthority
SimpleGrantedAuthority Class Default implementation of GrantedAuthority with a simple String authority. Most common way to represent roles or permissions. ➜ Constructed from strings like "ROLE_USER"
Principal Interface Represents the user. From java.security.Principal; Authentication extends this interface. ➜ Typically a domain User or UserDetails object
AuthenticationManager Interface Validates the authentication request. Not used directly in OAuth2 Resource Server, but critical in login-based setups. ➜ Calls AuthenticationProvider.authenticate(...)
AuthenticationProvider Interface Performs actual authentication logic. Multiple providers can be chained in ProviderManager. ➜ Returns a valid Authentication object
UserDetails Interface Stores user-specific information (username, password, authorities). Used in login-based security. Not used directly in stateless JWT systems. ➜ Often returned from UserDetailsService
UserDetailsService Interface Loads user details by username. Used in form login + stateful auth scenarios, not required in JWT flows. ➜ Provides UserDetails to AuthenticationProvider
JwtDecoder Interface Decodes and validates JWT tokens. Used in OAuth2 Resource Server to extract claims and validate signature. ➜ Returns a Jwt object that wraps token claims
Jwt Class Represents a decoded JWT token with its claims. Used by JwtAuthenticationConverter to build authentication. ➜ Input to JwtAuthenticationConverter.convert(Jwt jwt)
JwtAuthenticationConverter Class Converts a Jwt object into a Spring Security Authentication token. Core part of customizing how JWT claims are turned into authorities. ➜ Returns a JwtAuthenticationToken
JwtAuthenticationToken Class Authentication object representing a user authenticated via JWT. Used internally as the Authentication in JWT-based flows. ➜ Holds Jwt, authorities, principal
OAuth2ResourceServerConfigurer Configurer Class Configures Spring Boot to act as a resource server that validates JWTs. Enabled via .oauth2ResourceServer().jwt() in SecurityFilterChain. ➜ Registers JwtDecoder and JwtAuthenticationConverter
BearerTokenAuthenticationFilter Filter Extracts Authorization: Bearer ... header and processes the token. Automatically included when using oauth2ResourceServer(). ➜ Delegates to JWT decoder and converters
SecurityFilterChain Bean Interface Defines the filter rules (paths, authentication requirements, etc.) Replaces WebSecurityConfigurerAdapter in modern Spring Security setups. ➜ Registers JWT support, CSRF, CORS, etc.

🔄 How They Work Together in a JWT-based OAuth2 Resource Server Setup

plaintext
CopyEdit
[Incoming Request with JWT in Header]
              │
              ▼
[BearerTokenAuthenticationFilter]
              │
              ▼
     [JwtDecoder] ← Validates and parses token
              │
              ▼
[JwtAuthenticationConverter] ← Converts to Authentication
              │
              ▼
[JwtAuthenticationToken] ← With principal, authorities
              │
              ▼
[SecurityContextHolder]

You can now access the user’s identity anywhere using:


Authentication auth = SecurityContextHolder.getContext().getAuthentication();
String username = auth.getName();
Collection<? extends GrantedAuthority> roles = auth.getAuthorities();

🧠 Tips

Security Flow: Oauth2 Resource Server

Cheat Sheet