Securing web routes and HTTP verbs

Locking down an application and only allowing authorized users to access it is a big step forward. But, it’s seldom enough.

We must actually confine who can do what. So far, the process we’ve applied where people must prove their identity as part of a closed list of users is known as authentication.

But, the next piece of security that must be applied to any real application is what’s called authorization, that is, what a user is allowed to do.

Spring Security makes this super simple to apply. The first step in customizing our security policy is to add one more bean definition to our SecurityConfig class created earlier in this chapter under the Creating our own users with a custom security policy section.

Up to this point, Spring Boot has had an autoconfigured policy in place. In fact, it may be simpler to show what Spring Boot has inside its own SpringBootWebSecurityConfiguration:

@Bean
SecurityFilterChain defaultSecurityFilterChain...