$ show spring-projects/spring-security
Spring Security is a comprehensive authentication and authorization library for Spring-based applications, supporting both Servlet (MVC) and Reactive (WebFlux) stacks. In production, it intercepts HTTP requests via a configurable filter chain (SecurityFilterChain for servlet, WebFilterChain for reactive) to enforce authentication, session management, CSRF protection, security headers, CORS, and access control. It provides a pluggable architecture with core abstractions (AuthenticationManager, AuthorizationManager, SecurityContextHolderStrategy) and protocol-specific modules for OAuth2/OIDC, SAML2, LDAP, CAS, WebAuthn, Kerberos, and JWT. The library is configured via annotations (@EnableWebSecurity, @EnableMethodSecurity), a Kotlin DSL, or XML namespace, and integrates deeply with Spring's configuration and dependency injection. The architecture is modular: the 'core' module defines foundational interfaces (Authentication, GrantedAuthority, SecurityContext), 'web' implements servlet and reactive security filters, 'config' provides annotation-driven and XML configuration support, and protocol modules (oauth2, saml2, ldap, webauthn, cas) handle specific authentication/authorization flows. Key entry points include the HttpSecurity/ServerHttpSecurity builders, SecurityFilterChain, and method-security annotations (@PreAuthorize, @Secured). External dependencies include Spring Framework, Jackson (for serialization), Project Reactor (for reactive support), OpenSAML, and LDAP libraries. The codebase demonstrates strong engineering practices: extensive use of strategy, composite, and builder patterns; clean separation of servlet and reactive APIs; and a consistent Jackson mixin pattern for serialization of security objects.
The LLM identified 5 files worth highlighting for reuse:
Pluggable authorization contract with a default `verify` method that throws AccessDeniedException. Used throughout the framework for both servlet and reactive stacks. Demonstrates clean separation of concerns and functional design, enabling easy customization of authorization logic.
Conditionally writes Cache-Control, Pragma, and Expires headers by delegating to StaticHeadersWriter. Avoids overwriting existing headers and respects 304 Not Modified responses. A clean example of the strategy pattern for HTTP security headers, easily extractable for other header-writing needs.
Composable request matcher that negates another matcher. Part of a family of composable matchers (And, Or, Negated) that allow building complex matching logic from simple building blocks. Demonstrates the composite pattern and immutability, reusable in any request-matching context.
Pluggable strategy for storing and retrieving the SecurityContext. Implementations include ThreadLocal, InheritableThreadLocal, and Micrometer context propagation. Enables different context propagation models without changing application code, showcasing a clean strategy pattern for cross-cutting concerns.
Custom Gradle plugin that configures Maven publishing conventions for Spring projects. Handles repository, signing, and artifact coordination. Demonstrates how to encapsulate complex build logic into reusable plugins, applicable to any Gradle-based project needing standardized Maven publishing.