spring-security-practice-lab

A compact Spring Security practice project for learning and demonstrating common authentication and authorization patterns.

The project is intentionally small: it focuses on clear security rules, runnable examples, and automated tests instead of a large business system.

What This Lab Covers

• Anonymous access with permitAll
• HTTP Basic authentication
• Form login
• Role-based access control
• Method-level authorization with @PreAuthorize
• 401 vs 403 behavior
• Security regression tests with MockMvc

Requirements

• JDK 17 or later
• Maven 3.8 or later

Run

mvn spring-boot:run

Default users:

Username	Password	Roles
reader	reader-pass	USER
admin	admin-pass	USER, ADMIN

Example requests:

curl http://localhost:8080/api/public
curl -u reader:reader-pass http://localhost:8080/api/profile
curl -u admin:admin-pass http://localhost:8080/api/admin/dashboard

Test

mvn test

The tests verify:

• Public endpoints allow anonymous users.
• Protected endpoints reject anonymous users with 401.
• Normal users cannot access admin endpoints.
• Admin users can access admin endpoints.
• Method-level security blocks insufficient roles.

Project Structure

src/main/java/io/github/securitylab/
  SecurityPracticeLabApplication.java
  security/SecurityConfig.java
  web/DemoController.java

src/test/java/io/github/securitylab/
  SecurityRulesTest.java

docs/
  learning-notes.md

Why This Project Exists

This repository is suitable as a small learning and maintenance project. It can be used to practice Spring Security configuration, write security regression tests, and explain authorization rules clearly in code review.

License

MIT