Content:

- Modern security architecture with Spring Security 6 & 7
... - The importance of security in today’s web and cloud applications
... - The role of Spring Security within the Spring ecosystem
... - Key changes since Spring Security 5 (`SecurityFilterChain`, lambda DSL)

- Authentication and authorisation in Spring Security
... - The difference between authentication and authorisation
... - Understanding `SecurityContext`, `Authentication` and `GrantedAuthority`
... - Designing a clean role and permission model

- Configuring Spring Security
... - Java-based configuration using `SecurityFilterChain`
... - URL/request-based authorisation with the `AuthorizationManager` (e.g. `authorizeHttpRequests`) on the HTTP endpoint level
... - Fine-grained method security with `@PreAuthorize` etc. on the service layer

- User and identity management
... - Managing users via database backends or directory services (e.g. LDAP/Active Directory)
... - `PasswordEncoder` and modern hashing algorithms (e.g. bcrypt)
... - Working with `UserDetails` and authorities

- Sessions, cookies and tokens
... - Session-based security vs. token-based approaches (JWT, opaque tokens)
... - `HttpOnly`, `SameSite`, `Secure` cookies and why they matter
... - Understanding and correctly configuring CSRF protection

- OAuth 2.0 in Spring Security
... - Overview of OAuth 2.0: roles, flows and common use cases
... - Authorization Code Flow (with PKCE), Client Credentials, etc.
... - Using Spring Boot as OAuth2 client and resource server

- OpenID Connect & identity providers
... - OpenID Connect as an identity layer on top of OAuth 2.0
... - Understanding ID tokens, UserInfo endpoint, scopes and claims
... - Integrating an identity provider (e.g. Keycloak) for login and Single Sign-On (SSO)

- Patterns for SPA & APIs: Backend-for-Frontend (BFF)
... - Challenges of Angular/React SPAs (CORS, XSRF, token leakage)
... - BFF with sessions vs. BFF with tokens (e.g. JWT in HttpOnly cookies)
... - Practical implementation of a BFF using Spring Boot and Spring Security

- Migration and upgrade
... - Typical pitfalls when upgrading to Spring Security 6 and 7
... - Strategies for existing projects (legacy code vs. greenfield)

- Best practices and security tips
... - Defense in depth, least privilege, secure defaults
... - Detecting and avoiding common misconfigurations
... - Recommendations for production, monitoring and operations

- Q&A and closing discussion

We will focus on deepening and understanding a specific selection of topics and adjust the emphasis (e.g. more SPA/BFF vs. classic web apps) according to the participants’ needs.

Disclaimer: The actual course content may vary from the above, depending on the trainer, implementation, duration and constellation of participants.

Whether we call it training, course, workshop or seminar, we want to pick up participants at their point and equip them with the necessary practical knowledge so that they can apply the technology directly after the training and deepen it independently.