Authentication

The logout() DSL wires up a LogoutFilter. When a user POSTs to /logout, the filter clears the logged-in user from the SecurityContext, invalidates the HTTP session, and redirects to a success page (default /login?logout).

AuthenticationManager has one method, authenticate(Authentication). It returns a fully authenticated Authentication if credentials are valid, throws an AuthenticationException if they are invalid, or returns null if it cannot decide.

PasswordEncoder is an interface that turns a raw password into a one-way, salted hash. You store the hash, never the plaintext, so a database leak doesn't expose real passwords. Its matches() method verifies a login attempt.

UserDetailsService is an interface with one method, loadUserByUsername(String), that looks up a user by name and returns a UserDetails object holding the username, encoded password, and authorities (roles). It throws UsernameNotFoundException if no user exists.

permitAll() lets everyone through, logged-in or not. anonymous() allows only not-logged-in (anonymous) users; an authenticated user hitting an anonymous()-only rule is denied. Use permitAll for public pages, anonymous for login/registration pages you want to hide from signed-in users.

Each kind of login failure has its own event, like AuthenticationFailureBadCredentialsEvent or AuthenticationFailureLockedEvent. DefaultAuthenticationEventPublisher maps the thrown exception type to the matching event. Unmapped exceptions fire no event unless you configure a default.

httpBasic() reads credentials from the 'Authorization: Basic' header on every request; formLogin() uses an HTML form and a server session. Basic is stateless and good for APIs/scripts; form login is stateful and good for browsers.

SecurityContextLogoutHandler clears the SecurityContextHolder (removing the current Authentication) and invalidates the HttpSession. It does not delete cookies or remember-me tokens — separate handlers do that.

ProviderManager is the standard AuthenticationManager. It holds a list of AuthenticationProviders and asks each whether it supports the token; the first one that supports it and returns a non-null result wins. If none succeed, it delegates to an optional parent manager.

DelegatingPasswordEncoder stores each hash with a prefix like {bcrypt} or {argon2} that names the algorithm. On matches(), it reads the prefix, picks the matching encoder, and delegates. This lets one bean verify hashes made by different algorithms.

DaoAuthenticationProvider is the AuthenticationProvider for username/password login. It calls UserDetailsService to load the user, then uses a PasswordEncoder to compare the submitted password with the stored hash. If they match and the account is enabled, it returns an authenticated token.

For a request with no login, Spring Security still puts a placeholder 'anonymous' user into the SecurityContext instead of leaving it empty. So code can always assume an Authentication object exists rather than handling null.

When a login succeeds or fails, Spring Security publishes an application event (like AuthenticationSuccessEvent or a failure event). You can listen to these events to log or audit logins without changing the login code.

isAnonymous() is true only when the current user is the anonymous placeholder (not logged in). isAuthenticated() is its opposite for real users. You use these in SpEL, e.g. @PreAuthorize or access() rules, to branch on login state.

Write a Spring bean with @EventListener methods for AuthenticationSuccessEvent and AbstractAuthenticationFailureEvent. Read the username and (for failures) the exception, then persist or log an audit record. No changes to the security config are needed.

The filter reads username/password from the POST, builds an unauthenticated token, and calls the AuthenticationManager. If it returns an authenticated token, the filter saves it to the SecurityContext (and the session) and runs the success handler; otherwise it runs the failure handler.

logoutSuccessUrl sets the redirect target after logout. LogoutSuccessHandler is the full strategy that produces the response. For a REST/SPA client you replace the redirect with HttpStatusReturningLogoutSuccessHandler so logout returns 200 instead of a 302.

Implement AuthenticationProvider with two methods. supports(Class) returns true for the token types you handle. authenticate(Authentication) validates the credentials and returns a new, fully authenticated token with authorities, throws an AuthenticationException on failure, or returns null if it can't handle the request.

The work factor (strength) sets how many hashing rounds BCrypt does: 2^strength iterations. Higher strength means slower hashing and harder brute force. The default is 10; typical range is 10-12. It's stored inside the hash.

InMemoryUserDetailsManager stores users in a Map — good for demos and tests. JdbcUserDetailsManager persists users in a relational schema using a fixed default table layout. A custom UserDetailsService adapts your own user entity/store — the usual choice for real apps with domain-specific user data.

Near the end of the filter chain, AnonymousAuthenticationFilter checks if the SecurityContext already has an Authentication. If not, it builds an AnonymousAuthenticationToken (default principal anonymousUser, ROLE_ANONYMOUS) using a configured key and stores it. The key lets AnonymousAuthenticationProvider verify tokens it created.

Usually the AuthenticationManager has no AuthenticationEventPublisher set — common when you build ProviderManager by hand. Fix it by injecting DefaultAuthenticationEventPublisher (or Boot's autoconfigured one). Also check the failure exception is actually mapped to an event.

They are callbacks invoked after form authentication finishes. AuthenticationSuccessHandler runs on success (default: redirect to the saved request); AuthenticationFailureHandler runs on failure (default: redirect to /login?error). You override them for custom redirects or JSON responses.

The logout() DSL collects all configured LogoutHandlers into a CompositeLogoutHandler, which invokes each in registration order. You add your own cleanup with addLogoutHandler(myHandler) — for example to write an audit log or add a JWT to a denylist.

A ProviderManager can have a parent AuthenticationManager it falls back to when none of its own providers authenticate. This lets multiple filter chains share a common global manager. After a successful authentication, ProviderManager erases the raw credentials from the returned token by default to reduce in-memory exposure.

upgradeEncoding(storedHash) returns true when a hash was made with an older algorithm or lower strength than the current default. After a successful login, DaoAuthenticationProvider checks it and, if true, re-hashes the password with the new settings via a UserDetailsPasswordService.

Implement loadUserByUsername to fetch the entity from a repository and build a UserDetails carrying the encoded password, account flags, and authorities. Map each role to a GrantedAuthority, prefixing ROLE_ if you use hasRole. Throw UsernameNotFoundException when absent, and make sure lazy role collections are loaded.

Spring Security 6 can publish AuthorizationGrantedEvent and AuthorizationDeniedEvent for access-control decisions. Register a SpringAuthorizationEventPublisher bean, then use @EventListener(AuthorizationDeniedEvent.class) to audit denied access — separate from login success/failure events.

An AuthenticationEntryPoint starts authentication when an unauthenticated request hits a protected resource — e.g. redirect to the login page or send a 401. With multiple mechanisms, Spring uses a DelegatingAuthenticationEntryPoint that picks one via request matchers.