VMware Spring Security

4.6 out of 5 rating

Jump to dates


2 Days

12 CPD hours

This course is intended for

Application developers who want to increase their understanding of Spring Security with hands-on experience and build secure Spring and Spring Boot applications.


By the end of the course, you should be able to meet the following objectives:
Use Spring Security in Spring and Spring Boot applications
Configure the Spring Security filter chain
Protect HTTP endpoints with expression-based access control and the AuthorizationManager API
Protect method execution
Use different authentication mechanisms
Handle passwords in an efficient way
Integrate Spring Security with Junit 5 and MockMVC to test HTTP and method security
Protect against common vulnerabilities and threats
Understand what OAuth2 is
Use and configure the Spring Authorization Server
Implement a resource server and client


This 2-day course offers hands-on experience with the major features of Spring Security, which includes configuration, authentication, authorization, password handling, testing, protecting against security threats, and the OAuth2 support to secure applications. On completion, participants will have a foundation for securing enterprise and microservices applications.

Security Introduction
  • Need for security
  • Basic security concepts
  • Common security vulnerabilities
Spring Security Basics
  • Introduction to Spring Security
  • High-level architecture
  • Overview of SecurityContext
  • Spring Security with Spring Boot
Customizing Authentication
  • Building blocks for authentication
  • Authentication mechanisms based on user name and password
  • Other authentication mechanisms
  • Authentication events
Securing Web Applications
  • Configuring authorization
  • Using AccessDecisionsManager for authorization
  • Using AuthorizationManager for authorization
  • Bypassing security
Method Security
  • Method security architecture
  • Declarative method security with annotations
Security Testing
  • Spring Security Testing Support
  • Security mock annotations and meta-annotations
  • Using MockMvc to test security
Handling Passwords
  • Password hashing
  • Upgrading passwords
(Optional) Protecting Against Common Vulnerabilities
  • Hardening web applications with security headers
  • Preventing cross-site request forgery
  • Encrypting data in transit
OAuth2 and OIDC Concepts
  • Need for OAuth
  • Overview of OAuth2 and OIDC
  • OAuth2 grant types
  • Types of tokens
  • Spring Security OAuth2 support and OAuth2 login
Spring Authorization Server
  • Introduction to Authorization Server
  • Spring Authorization Server endpoints
  • Spring Authorization Server configuration
Protecting and accessing resources with OAuth2
  • Resource server
  • Using JWT tokens
  • Using opaque tokens
  • Configuring an OAuth2 client
Training Insurance Included!

When you organise training, we understand that there is a risk that some people may fall ill, become unavailable. To mitigate the risk we include training insurance for each delegate enrolled on our public schedule, they are welcome to sit on the same Public class within 6 months at no charge, if the case arises.

What people say about us

Find out more about this course

Interested in alternative dates? Would like to book a private session of this course for your company? Or for any other queries please simply fill out the form below.