Spring Security is a powerful and highly customizable authentication and access control framework for Java applications. It helps you secure your applications by providing various features such as authentication, authorization, session management, and more. Here's a step-by-step guide to getting started with Java Spring Security:

First Setup a Spring Boot Project

See SpringSecurity2/pom.xml file:

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0
    https://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>3.1.0</version>
        <relativePath/> <!-- lookup parent from repository -->
    </parent>
    <groupId>com.software</groupId>
    <artifactId>SpringSecurity2</artifactId>
    <version>0.0.1-SNAPSHOT</version>
    <name>SpringSecurity2</name>
    <description>spring security demo</description>
    <properties>
        <java.version>17</java.version>
    </properties>
    <dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-
security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-devtools</artifactId>
        <scope>runtime</scope>
        <optional>true</optional>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-test</artifactId>
        <scope>test</scope>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-test</artifactId>
        <scope>test</scope>
    </dependency>
    </dependencies>
    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-
plugin</artifactId>
            </plugin>
        </plugins>
    </build>
</project>

Here we have added spring web, spring security, and spring dev tools dependencies.

Now we will develop a controller. Here I have developed HomeController.java let’s look.

HomeController.java

package com.software.controller;

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class HomeController {

    @GetMapping("/hello")
    public String sayHi()
    {
        return "Welcome to Spring Security!!";
    }

}

Now I will run SpringSecurity2Application.java file , then happily it will run.

You see in console output one password security password generating automatically.

Now we will open a browser and enter localhost:8080/hello
The following output will come to the picture:

Now we will give default user name that is user and password what ever it have generated that password value we will give then we will get the output. That means sayHi() definition in controller class will execute.

Then we will get following output:

Here this is default Spring Security Basic Authentication. That means once spring security dependency that we will add then when we run, default sign in form is coming for authentication and we are providing default user name that is user and generated password value we are giving for getting output.

But our objective is not that. Our objective is we will provide our customized username and password value for authentication and authorization. Then we have to develop security configuration file.

SecurityConfig.java

package com.software.config;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.password.NoOpPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
public class SecurityConfig {

    @Bean
    public UserDetailsService userDetailsService()
    {
        var ud=new InMemoryUserDetailsManager();

        var user=User.withUsername("silan")
        .password("123")
        .authorities("read")
        .build();

        ud.createUser(user);
        return ud;
    }

    @Bean

    public PasswordEncoder passwordEncoder()
    {
        return NoOpPasswordEncoder.getInstance();
    }

}

Now we can run through browser or postman.

Run through browser:

Run through Postman