--- title: "#spring-security articles | Hashnode" description: "Explore 135 articles tagged #spring-security on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/spring-security" --- Tag # #spring-security 135 posts · 273 followers [Gowtham Muthuvel](https://hashnode.com/@GowthamMuthuvel) · [1d ago](https://hashnode.com/posts/spring-security-jwt-refresh-token-rotation-rbac/6af29fea91696569429d27db) ### [JWT + Role-Based Access in Spring Security: Refresh Tokens Without the Footguns](https://gowthammuthuvel.hashnode.dev/spring-security-jwt-refresh-token-rotation-rbac?utm_source=hashnode&utm_medium=feed) Rotation with reuse detection, ROLE\_ vs SCOPE\_ mapping, and the permitAll() trap, all tested on Spring Boot 4.1.2. Replaying an old refresh token revoked 2 tokens and killed the session. 20 min read · [gowthammuthuvel.hashnode.dev](https://gowthammuthuvel.hashnode.dev/spring-security-jwt-refresh-token-rotation-rbac?utm_source=hashnode&utm_medium=feed) [Kumaravel](https://hashnode.com/@dev-kumaravel) · [Aug 27](https://hashnode.com/posts/rest-api-beginners-spring-boot/6a9065fcf27d243b2413d7ca) ### [REST APIs for Beginners: What I Learned While Building a Spring Boot Application](https://buildbreaklearndev.hashnode.dev/rest-api-beginners-spring-boot?utm_source=hashnode&utm_medium=feed) A practical beginner-friendly guide to REST API design, DTOs, JWT authentication, Spring Security, frontend integration, and the lessons I learned while building a real full-stack application. 19 min read · [buildbreaklearndev.hashnode.dev](https://buildbreaklearndev.hashnode.dev/rest-api-beginners-spring-boot?utm_source=hashnode&utm_medium=feed) [Ashutosh Krishna](https://hashnode.com/@ashutoshkrris) · [Aug 6](https://hashnode.com/posts/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-handbook/6a74fe284ef5707f2879423d) ### [CSRF from Scratch: Browser Mechanics, Attacks, and Spring Security Implementation \[Full Handbook\]](https://freecodecamp.org/news/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-handbook?utm_source=hashnode&utm_medium=feed) If you've ever built a web application or configured Spring Security, you've almost certainly encountered Cross-Site Request Forgery (CSRF). In my previous guide, How OAuth 2.0 Works: A Practical Guid 45 min read · [freecodecamp.org](https://freecodecamp.org/news/csrf-from-scratch-browser-mechanics-attacks-and-spring-security-implementation-handbook?utm_source=hashnode&utm_medium=feed) [Kishore K Sharma](https://hashnode.com/@kishoreksharma) · [Jun 25](https://hashnode.com/posts/secure-swagger-actuator-spring-boot/6a3d8dfd001b23cd3a3f1d60) ### [Put a Login on Swagger and Actuator (Before Someone Else Does)](https://blogs.kishorek.dev/secure-swagger-actuator-spring-boot?utm_source=hashnode&utm_medium=feed) Both ship wide open by default. The layered way to lock them down in Spring Boot — expose less, authenticate, role-gate, isolate. 6 min read · [blogs.kishorek.dev](https://blogs.kishorek.dev/secure-swagger-actuator-spring-boot?utm_source=hashnode&utm_medium=feed) [Milan Nikic](https://hashnode.com/@nick79) · [Jun 22](https://hashnode.com/posts/broken-access-control-in-java-and-spring-secure-implementation-patterns-part-2/6a3930a5c7b21ee603e4480e) ### [Broken Access Control in Java and Spring: Secure Implementation Patterns (Part 2)](https://securitydepth.hashnode.dev/broken-access-control-in-java-and-spring-secure-implementation-patterns-part-2?utm_source=hashnode&utm_medium=feed) Defend against vertical privilege escalation in Java and Spring Security 6. RBAC vs ABAC, mass assignment, and access control testing patterns. 27 min read · [securitydepth.hashnode.dev](https://securitydepth.hashnode.dev/broken-access-control-in-java-and-spring-secure-implementation-patterns-part-2?utm_source=hashnode&utm_medium=feed) [Milan Nikic](https://hashnode.com/@nick79) · [Jun 16](https://hashnode.com/posts/broken-access-control-in-java-and-spring-secure-implementation-patterns-part-1/6a3103ac150b6075cdffdf96) ### [Broken Access Control in Java and Spring: Secure Implementation Patterns (Part 1)](https://securitydepth.hashnode.dev/broken-access-control-in-java-and-spring-secure-implementation-patterns-part-1?utm_source=hashnode&utm_medium=feed) How IDOR and horizontal privilege escalation happen in Java and Spring apps, with ownership validation patterns using Spring Security 6. 21 min read · [securitydepth.hashnode.dev](https://securitydepth.hashnode.dev/broken-access-control-in-java-and-spring-secure-implementation-patterns-part-1?utm_source=hashnode&utm_medium=feed) [Sahil Rajput](https://hashnode.com/@SahilRajput) · [May 28](https://hashnode.com/posts/spring-security-explained-a-complete-guide-for-java-developers/6a182a8dbadcd8afcb948af8) ### [Spring Security Explained : A Complete Guide for Java Developers](https://sahilrajput.hashnode.dev/spring-security-explained-a-complete-guide-for-java-developers?utm_source=hashnode&utm_medium=feed) Learn how to secure your Spring Boot applications from scratch - from basic HTTP auth to database based user 4 min read · [sahilrajput.hashnode.dev](https://sahilrajput.hashnode.dev/spring-security-explained-a-complete-guide-for-java-developers?utm_source=hashnode&utm_medium=feed) [Chris Vesters](https://hashnode.com/@cvesters) · [Apr 5](https://hashnode.com/posts/global-state-securitycontextholder/69d2087bc4db47cccdae29b8) ### [Global State SecurityContextHolder](https://cvesters.hashnode.dev/global-state-securitycontextholder?utm_source=hashnode&utm_medium=feed) Relying on the SecurityContextHandler deel inside of your application makes your application brittle. 3 min read · [cvesters.hashnode.dev](https://cvesters.hashnode.dev/global-state-securitycontextholder?utm_source=hashnode&utm_medium=feed) [abhijit maharik](https://hashnode.com/@hivecmky) · [Apr 1](https://hashnode.com/posts/top-30-spring-boot-interview-questions-asked-in-tcs-and-infosys-with-answers-2025/69cd4ae43085402b9c35cf34) ### [Top 30 Spring Boot Interview Questions Asked in TCS and Infosys — With Answers (2025)](https://javaready.hashnode.dev/top-30-spring-boot-interview-questions-asked-in-tcs-and-infosys-with-answers-2025?utm_source=hashnode&utm_medium=feed) I work in government tech in Bhubaneswar and have spent years writing Java backend systems. When my colleagues started preparing for TCS and Infosys interviews, I noticed they were reading 50-page PDFs for answers that should take 3 sentences. So I wrote this — 30 real Spring Boot questions with short, honest answers. No padding. No theory lectures. Just what you actually need. 13 min read · [javaready.hashnode.dev](https://javaready.hashnode.dev/top-30-spring-boot-interview-questions-asked-in-tcs-and-infosys-with-answers-2025?utm_source=hashnode&utm_medium=feed) [IAMDevBox](https://hashnode.com/@IAMDevBox) · [Mar 2](https://hashnode.com/posts/configuring-saml-login-with-spring-security-metadata-location-and-relying-party-setup/69a4d4d40db2eae07500e226) ### [Configuring SAML Login with Spring Security: metadata-location and Relying Party Setup](https://iamdevbox.hashnode.dev/configuring-saml-login-with-spring-security-metadata-location-and-relying-party-setup?utm_source=hashnode&utm_medium=feed) I've configured SAML SSO for 30+ Spring Boot applications. The setup looks simple in docs, but production always throws curveballs - certificate mismatches, signature validation failures, attribute mapping issues. Here's what actually works. Visual... 9 min read · [iamdevbox.hashnode.dev](https://iamdevbox.hashnode.dev/configuring-saml-login-with-spring-security-metadata-location-and-relying-party-setup?utm_source=hashnode&utm_medium=feed)