Learn how to maintain control as a software architect in the age of coding agents.
🔎 Discover our new training: Architecture in the Context of Agentic Development.
socreatory training

Spring Security in practice

Basics
2 Days
12
Seats
German and English
Online and in-person
Available on request

Also available as in-house training

We run this training exclusively for your team, online or on site.
In-house Offerings

Objectives

  • Understand the basic principles of Spring Security.
  • Implement authentication and authorization concepts.
  • Implement security configurations in Spring Boot.
  • Apply session management and CSRF protection.
  • Implement token-based authentication (e.g., JWT).
  • Integrate OAuth 2.0 and OpenID Connect into Spring Security.
  • Apply best practices for secure applications.

Curriculum

Day 1: Spring Security Foundations and Practice

  • Introduction to security
    • Security objectives and threats, standards, authentication, authorization, and auditing
  • Spring Security basics
    • Core principles, the security filter chain, ‘SecurityContext’, and secure Spring Boot defaults
  • Authentication
    • Authentication building blocks, user stores, HTTP Basic, form login, MFA, passkeys, and session management
  • Request and message authorization
    • HTTP access rules, request matchers, roles, custom conditions, auditing, and WebSockets
  • Method and domain-object security
    • Security annotations, pre- and post-conditions, return values, and ‘SecurityContext’ propagation
  • Security testing and observability
    • Testing with MockMvc, test identities, security events, audit, and metrics

Day 2: Passwords, Web Security, and OAuth 2.0

  • Secure password storage
    • Adaptive hashes, ‘PasswordEncoder’, ‘DelegatingPasswordEncoder’, and transparent upgrades
  • Protection against common web vulnerabilities
    • Security headers, Content Security Policy, CSRF protection, HTTPS, and HSTS
  • OAuth 2.0 and OpenID Connect (OIDC)
    • Roles, grant types, PKCE, different token types, and social login
  • Spring Authorization Server
    • Endpoints, client registration, discovery, keys, and token customization
  • Protecting and accessing resources with OAuth 2.0
    • Resource server and client, JWTs, opaque tokens, service-to-service access, DPoP, and BFF
  • Optional research exercises
    • DPoP, passkey persistence, token trade-offs, and bonus exercises
  • What’s next and final security review
    • Staying current, diagnosing misconfigurations, and restoring protections

‍

Audience

Software developers, architects, and IT professionals who work with Spring or Java and want to deepen their knowledge of security.

Prerequisites

  • Experience in developing Spring or Java applications
  • Laptop with development environment (IntelliJ, Eclipse, VS Code)
  • Maven & current Java version
  • Internet access & permission to install software

Description

Securing Your Microservices with Spring Security, OAuth 2.0, and OpenID Connect (OIDC)

Spring Security provides the foundation for authentication and authorization in Spring applications. In a microservices architecture, however, identities, tokens, and access decisions must cross additional system boundaries. This course brings the core concepts of Spring Security together with OAuth 2.0, OpenID Connect (OIDC), and Spring Authorization Server.

‍

Across two intensive training days, you will develop a deep understanding of the essential Spring Security concepts, one step at a time. You will secure an end-to-end sample application, starting with the security filter chain and continuing through an OAuth 2.0 resource server. Along the way, you will work directly with modern authentication and authorization mechanisms.

‍

Practice drives the course. During hands-on sessions, you will configure, test, and observe the application's security behavior. The exercises cover MFA, passkeys, secure password hashes, JWTs, opaque tokens, and both browser and service-to-service flows.

Trainers

Patrick Baumgartner

Founder of 42talents

Main Skills

Java, Spring, Cloud

In-house Training

You can also book this training as an in-house training course exclusively for your team. Please use the enquiry form for more details.

Enquire now

You may also like

iSAQB® training
Certificate

iSAQB® CPSA-A® WEBSEC

20
Technology
10
Methodology
10
Communication
Basics
Advanved
3 days
12
seats
German and English
Online and In-person
from 2,069.00 €
socreatory training

Spring Boot Essentials

Basics
Advanved
4 Days
12
seats
German and English
Online and In-person
Custom Quote

Frequently Asked Questions

What is the maximum number of participants in a training session?

For most training sessions, we limit the maximum number of participants to 12 per instructor. This allows us to ensure that you receive the best possible guidance.

Are meals provided during in-person training sessions?

Of course, we’ll take care of your meals during our in-person training sessions. We usually provide snacks twice a day and lunch. Drinks are also available.

Where can I find information about the training session I've already booked?

You can find all the information about your training in our socreatory Navigator. Here, in addition to useful links and information, you’ll find the specific location of the training for in-person sessions and the link to the video call for online sessions.

When and how will I receive my certificate of attendance after the training?

If you have attended at least 75% of the sessions, you will receive a certificate of attendance from us. You can download it from our socreatory Navigator a few days after the training.

Why socreatory?

Beyond the expertise of our trainers and our wide range of training courses, we offer even more compelling reasons to train with us.

All the benefits at your fingertips – download our program overview!

Unique Variety

We offer you the most comprehensive training program for software architecture in the German-speaking region – accredited and certified by iSAQB®.

Powerful IT expertise

Our experienced trainers are renowned experts in the industry and have co-developed 80 percent of the module curricula, both in terms of content and teaching methodology.

Hands-on learning experience

We are committed to providing interactive and engaging learning experiences, ensuring all participants can directly apply what they've learned.

Fair pricing model

The total price is reduced for as few as two participants from your company. Furthermore, you benefit from early bird pricing and enhanced planning certainty.

Looking for team training?

Unlock your team's potential with our specialized software architecture courses. We offer a variety of options, from in-depth iSAQB® training to customized workshops tailored precisely to your company's needs. Discover how these training programs can enhance your team's skills, and take advantage of attractive group and package discounts to maximize the value of your investment.