Authentication architecture in Spring Security
The realm of application security essentially involves addressing two largely independent issues: authentication (identifying who you are) and authorization (determining what you are allowed to do).
Occasionally, individuals may use the term access control interchangeably with authorization, adding a layer of potential confusion.
However, framing it as access control can offer clarity, considering the multifaceted use of the term authorization elsewhere.
Spring Security adopts an architecture deliberately crafted to segregate authentication from authorization, providing distinct strategies and extension points for each. We will uncover in this section the main architectural components of Spring Security used for authentication.
The SecurityContextHolder class
At the heart of Spring Security’s authentication model is the SecurityContextHolder. It contains the SecurityContext.
Figure 3.1 ...
