Spring Security: 7 levels

Every level follows the same five steps: name the threat, configure the gate, recognise the pattern, trace the user flow, then prove it with a test.

Threat Gate Pattern Flow Proof

Default gate chudu

Threat: Login lekunda access (Spoofing)
Gate: Starter add cheyyi, config emi rayaku
Pattern: Chain of Responsibility, Proxy
Flow: GET /hello→session ledu→AuthorizationFilter deny→ExceptionTranslationFilter→302 /login→POST /login→UsernamePasswordAuthenticationFilter→session lo SecurityContext→302 /hello→200
Proof: TRACE logs lo ee flow prathi filter tho match cheyyi; MockMvc test: anonymous → 302/401

Threat: USER admin pani cheyyadam (Elevation of privilege)
Gate: authorizeHttpRequests + InMemoryUserDetailsManager (USER, ADMIN)
Pattern: Builder (DSL), Strategy (AuthorizationManager)
Flow: USER login→GET /admin→AuthorizationFilter→AccessDeniedException→403|ADMIN→200|anonymous→401/302
Proof: 3 users × 3 URLs = 9 tests matrix (@WithMockUser)

Threat: Password leak, brute force (Spoofing, Repudiation)
Gate: Nee UserDetailsService, BCryptPasswordEncoder, failure event listener
Pattern: Strategy, Adapter (UserDetails), Observer (auth events)
Flow: POST /register→BCrypt hash→DB|login→DaoAuthenticationProvider→loadUserByUsername→matches()→success event|wrong password ×5→listener→account locked→next login 401
Proof: DB lo plaintext ledu; wrong password 401; 6th attempt locked

Threat: Token tampering, expired/stolen token (Tampering, Spoofing)
Gate: First nee OncePerRequestFilter, tarvata oauth2ResourceServer().jwt() tho replace; session STATELESS; CSRF off (cookies levu kabatti)
Pattern: Template Method (own filter), Strategy (JwtDecoder)
Flow: POST /api/login→JWT|GET /api/orders + Bearer→BearerTokenAuthenticationFilter→signature + expiry check→SecurityContext→200|tampered/expired→401 + WWW-Authenticate
Proof: Valid, tampered, expired, missing: 4 tests

Threat: Login unna user vere vaalla data chadavadam (Information disclosure). Real apps lo #1 bug
Gate: @EnableMethodSecurity, @PreAuthorize leda service lo owner check
Pattern: Proxy (AOP)
Flow: User A→GET /api/orders/42 (B di)→filter chain pass (authenticated)→method proxy→owner ≠ A→403/404
Proof: A → B order = 403; A → own order = 200; same-class method call lo @PreAuthorize skip avtundani prove chese test

Threat: Wrong surface ki wrong control (API ki CSRF, web ki JWT); error lo info leak; DoS
Gate: @Order(1) apiChain securityMatcher("/api/**") + @Order(2) webChain (form login + CSRF); custom AuthenticationEntryPoint / AccessDeniedHandler (clean JSON); login rate limit
Pattern: Chain (which chain?), Strategy (error handlers)
Flow: Postman→/api/**→JWT chain|Browser→/web/**→session chain→form POST CSRF token tho→200|token lekunda→403|API ki session cookie matrame→401
Proof: Ee 3 cases + error body lo stack trace ledu

Threat: Password handling ni outsource cheyyadam; redirect/state attacks
Gate: oauth2Login(), custom OAuth2UserService (Google user → local user + roles)
Pattern: Strategy, Adapter (OidcUser)
Flow: /login→Google ki redirect→consent→/login/oauth2/code/google?code&state→OAuth2LoginAuthenticationFilter state check + code exchange→OidcUser→local user map→session→200
Proof: oauth2Login() test post-processor tho role mapping test