Spring Security — Lesson 2: Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling

Learning Objectives

• Identify the architecture and operational choices that shape Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling.
• Run normal and boundary tests and record the outcome in authorization test matrix and denied-access evidence.
• Separate root cause from symptom when investigating a broad request matcher granting access before a restrictive rule is evaluated.

Detailed Topics

• Authorization rules
• Roles and authorities
• Method security
• Request matchers
• Access decisions
• CSRF
• CORS
• Sessions
• Remember-me
• Logout
• And exception handling
• Decision ownership, prerequisites, and acceptance evidence for Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling
• Relevant access, security, capacity, dependency, performance, recovery, and support considerations

Instructor Demonstration

The instructor configures and tests Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling within a scenario aimed at a securely designed Spring application with explicit authentication, authorization, session or token controls, protected endpoints, tested defenses, and auditable security behavior. The walkthrough contrasts a valid setup with a flawed one and uses authorization test matrix and denied-access evidence to make the difference explicit.

Hands-On Exercise

Configure and test Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling with representative infrastructure or application data. Use “a broad request matcher granting access before a restrictive rule is evaluated” as the troubleshooting challenge, compare hypotheses, retest the affected path, and complete authorization test matrix and denied-access evidence for review.

1. Confirm scope, access, sample workloads, and acceptance criteria.
2. Perform the configuration or operation using a controlled sequence.
3. Inspect outputs and downstream effects rather than relying on task status alone.
4. Close with a support note, preventive action, and reproducible validation step.

Scenario Analysis

• Clarify the service trigger, affected components and roles, prerequisites, and acceptable result for Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling.
• Compare at least two implementation or correction choices and identify which evidence would distinguish them.
• Decide how authorization test matrix and denied-access evidence should be reviewed, approved, retained, and handed to the next owner.

Troubleshooting Guidance

When Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling produces an unexpected result, reproduce the issue with the same scope, identity, workload, and time context. Inspect authorization test matrix and denied-access evidence, test whether “a broad request matcher granting access before a restrictive rule is evaluated” explains the evidence, apply the smallest reversible correction, and retest an unaffected path for regression.

Validation Checklist

• The scope of Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling is clear, including what is deliberately excluded from the test.
• Evidence in authorization test matrix and denied-access evidence supports each material decision and outcome.
• A negative test demonstrates that controls reject or expose an invalid condition.
• Open risks, owners, due actions, and production safeguards are documented.

Lesson Outcome

Learners can apply Authorization rules, roles and authorities, method security, request matchers, access decisions, CSRF, CORS, sessions, remember-me, logout, and exception handling, explain the decisions made, and defend the result with authorization test matrix and denied-access evidence.