Spring Security Third Edition Secure Your Web Applications Restful Services And Microservice Architectures -

Sure, you removed HttpSession and added JWT tokens. But did you accidentally reintroduce state via your database? Every time you query a token_blacklist table or hit Redis to validate a session-like JWT, you’ve created state – and with it, scalability bottlenecks.

Let’s explore three counterintuitive lessons from the book that will change how you think about securing modern applications. The book opens with a provocative claim: Most developers misuse stateless authentication. Sure, you removed HttpSession and added JWT tokens

Consider this common pattern:

Move @PreAuthorize to the service layer and use method security expressions that check both role and ownership: Let’s explore three counterintuitive lessons from the book

True statelessness means the token carries all necessary information. Spring Security 3rd Edition introduces opaque tokens (via OpaqueTokenIntrospector ) as a better default for microservices, paired with signed JWTs only when you absolutely need client-parseable claims. “If you need to revoke a token before it expires, you don’t need JWTs – you need a session or an opaque token.” – Paraphrased from Chapter 8. 2. Method Security is Your Last Line of Defense – And You’re Ignoring It We all secure endpoints with @PreAuthorize("hasRole('ADMIN')") on controllers. But the book demonstrates a terrifying scenario: what if a vulnerability in a service layer method bypasses the controller entirely? Spring Security 3rd Edition introduces opaque tokens (via

@Service public class DocumentService { public Document findById(Long id) { // No security here! return documentRepository.findById(id); } } If any other service calls findById(1) – maybe from a scheduled job, a message listener, or another microservice – the authorization check is gone.