Security Auto-Configuration

Relevant source files

• buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/github/StandardGitHub.java
• module/spring-boot-actuator/build.gradle
• module/spring-boot-actuator/src/main/java/org/springframework/boot/actuate/endpoint/web/WebServerNamespace.java
• module/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/web/WebServerNamespaceTests.java
• module/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/web/annotation/ControllerEndpointDiscovererTests.java
• module/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/web/annotation/ServletEndpointDiscovererTests.java
• module/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/remote/server/HttpStatusHandlerTests.java
• module/spring-boot-security-oauth2-authorization-server/build.gradle
• module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfiguration.java
• module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerJwtAutoConfiguration.java
• module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerPropertiesMapper.java
• module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfiguration.java
• module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfigurationTests.java
• module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerJwtAutoConfigurationTests.java
• module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfigurationTests.java
• module/spring-boot-security-oauth2-client/build.gradle
• module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/OAuth2ClientPropertiesMapperTests.java
• module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/reactive/ReactiveOAuth2ClientWebSecurityAutoConfigurationTests.java
• module/spring-boot-security-oauth2-client/src/test/java/org/springframework/boot/security/oauth2/client/autoconfigure/servlet/OAuth2ClientWebSecurityAutoConfigurationTests.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/ConditionalOnJwkSetUriJwtDecoder.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwkSetUriCondition.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwkSetUriJwtDecoderBuilderCustomizer.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtDecoderConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerAutoConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerProperties.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OpaqueTokenIntrospectionConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/package-info.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveJwtConverterConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveJwtDecoderConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOpaqueTokenIntrospectionClientConfiguration.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/package-info.java
• module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/servlet/package-info.java
• module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwtConverterCustomizationsArgumentsProvider.java
• module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerAutoConfigurationTests.java
• module/spring-boot-security-oauth2-resource-server/src/test/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOAuth2ResourceServerAutoConfigurationTests.java
• module/spring-boot-security-saml2/build.gradle
• module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyProperties.java
• module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyRegistrationConfiguration.java
• module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/package-info.java
• module/spring-boot-security-saml2/src/test/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyAutoConfigurationTests.java
• module/spring-boot-security-saml2/src/test/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyPropertiesTests.java
• module/spring-boot-security-test/src/main/java/org/springframework/boot/security/test/autoconfigure/webmvc/SecurityMockMvcAutoConfiguration.java
• module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/MockMvcSecurityIntegrationTests.java
• module/spring-boot-security-test/src/test/java/org/springframework/boot/security/test/autoconfigure/webmvc/SecurityMockMvcAutoConfigurationTests.java
• module/spring-boot-security/build.gradle
• module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java
• module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java
• module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequest.java
• module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfiguration.java
• module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/StaticResourceRequest.java
• module/spring-boot-security/src/main/java/org/springframework/boot/security/web/reactive/ApplicationContextServerWebExchangeMatcher.java
• module/spring-boot-security/src/main/java/org/springframework/boot/security/web/servlet/ApplicationContextRequestMatcher.java
• module/spring-boot-security/src/test/java/org/springframework/boot/security/autoconfigure/web/servlet/PathRequestTests.java
• module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/actuate/endpoint/web/AbstractWebFluxEndpointHandlerMapping.java
• module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/autoconfigure/error/AbstractErrorWebExceptionHandler.java
• module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/autoconfigure/error/DefaultErrorWebExceptionHandler.java
• module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/error/DefaultErrorAttributes.java
• module/spring-boot-webflux/src/main/java/org/springframework/boot/webflux/error/ErrorAttributes.java
• smoke-test/spring-boot-smoke-test-actuator/src/main/java/smoketest/actuator/SampleRestControllerEndpointWithException.java
• smoke-test/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/ManagementDifferentPortAndEndpointWithExceptionHandlerSampleActuatorApplicationTests.java
• smoke-test/spring-boot-smoke-test-grpc-server-oauth/src/test/java/smoketest/grpcserveroauth/SampleGrpcServerOAuthApplicationTests.java
• smoke-test/spring-boot-smoke-test-oauth2-authorization-server/src/test/java/smoketest/oauth2/server/SampleOAuth2AuthorizationServerApplicationTests.java
• smoke-test/spring-boot-smoke-test-saml2-service-provider/build.gradle
• smoke-test/spring-boot-smoke-test-tomcat/build.gradle
• smoke-test/spring-boot-smoke-test-tomcat/src/test/java/smoketest/tomcat/SampleTomcatApplicationTests.java
• starter/spring-boot-starter-security-saml2/build.gradle

Spring Boot's security auto-configuration provides opinionated defaults for securing web applications, supporting both Servlet and Reactive stacks. It integrates deeply with Spring Security to provide authentication, authorization, OAuth2 support (Client, Resource Server, and Authorization Server), and SAML2 integration.

Core Security Infrastructure

When spring-security-web is on the classpath, Spring Boot applies default security to all endpoints, including Actuator and error pages.

Servlet and Reactive Defaults

The auto-configuration behavior differs slightly between stacks:

• Servlet (MVC): Managed by ServletWebSecurityAutoConfiguration module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfiguration.java26-30 It configures the default SecurityFilterChain when no user-defined filter chain is present.
• Reactive (WebFlux): Managed by ReactiveWebSecurityAutoConfiguration. It sets up the default SecurityWebFilterChain for non-blocking applications.

Default Authentication

By default, Spring Boot configures an in-memory UserDetailsService (or ReactiveUserDetailsService) with a single user named user and a generated password. This behavior is triggered by UserDetailsServiceAutoConfiguration. Authentication can be customized via properties:

• spring.security.user.name
• spring.security.user.password

Request Matchers for Actuator and Static Resources

Spring Boot provides specialized matchers to ease the configuration of common paths:

• EndpointRequest: Creates a RequestMatcher based on the Actuator management.endpoints.web.base-path. It is implemented for both Servlet module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/servlet/EndpointRequest.java1-20 and Reactive module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/actuate/web/reactive/EndpointRequest.java1-20 stacks.
• StaticResourceRequest / PathRequest: Targets common static resource locations (e.g., /css/**, /js/**, /favicon.ico) module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfiguration.java26-27

---

OAuth2 and SAML2 Integration

Spring Boot provides extensive auto-configuration for modern identity protocols. When these modules are configured, the default UserDetailsService typically backs off to allow the external identity provider to manage users.

OAuth2 Resource Server

Supports both JWT and Opaque Token validation. The configuration is driven by OAuth2ResourceServerProperties module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerProperties.java43-44

JWT Support

Auto-configures a JwtDecoder (Servlet) or ReactiveJwtDecoder (Reactive) based on properties like jwk-set-uri, issuer-uri, or a local public-key-location module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerProperties.java58-80

• Conditions: JwkSetUriCondition checks for the presence of the spring.security.oauth2.resourceserver.jwt.jwk-set-uri property module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/JwkSetUriCondition.java32-43
• Customization: Developers can use JwkSetUriJwtDecoderBuilderCustomizer or SpringReactiveOpaqueTokenIntrospectorBuilderCustomizer to refine the decoder or introspector construction module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOpaqueTokenIntrospectionClientConfiguration.java44-58

Opaque Token Support

Configures a ReactiveOpaqueTokenIntrospector (or Servlet equivalent) using the provided introspection-uri, client-id, and client-secret module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/reactive/ReactiveOpaqueTokenIntrospectionClientConfiguration.java41-60

OAuth2 Authorization Server

Managed by OAuth2AuthorizationServerAutoConfiguration. It sets up the necessary endpoints for OIDC and OAuth2 authorization, such as /token, /authorize, and /.well-known/openid-configuration module/spring-boot-security-oauth2-authorization-server/src/main/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerAutoConfiguration.java1-30

• Web Security: Configures the authorizationServerSecurityFilterChain bean to handle OAuth2 protocol endpoints module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfigurationTests.java80-95
• Registered Clients: Clients are loaded into an InMemoryRegisteredClientRepository based on properties under spring.security.oauth2.authorizationserver.client.* module/spring-boot-security-oauth2-authorization-server/src/test/java/org/springframework/boot/security/oauth2/server/authorization/autoconfigure/servlet/OAuth2AuthorizationServerWebSecurityConfigurationTests.java72-83

SAML2 Relying Party

Configures a RelyingPartyRegistrationRepository using Saml2RelyingPartyRegistrationConfiguration module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyRegistrationConfiguration.java68-78

• Metadata Support: Can automatically configure registrations from a remote Identity Provider (IdP) metadata URI using RelyingPartyRegistrations.collectionFromMetadataLocation module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyRegistrationConfiguration.java122-134
• Credentials: Supports mapping X.509 certificates and private keys for signing and decryption via Saml2X509Credential module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyRegistrationConfiguration.java91-107

---

Technical Implementation Overview

The following diagram illustrates how Spring Boot maps configuration properties and classpath presence to Spring Security bean definitions.

Diagram: Security Configuration Data Flow

Property/Class	Logic Entity	Code Implementation
spring.security.oauth2.resourceserver.jwt.*	JwtDecoder	JwtDecoderConfiguration
spring.security.oauth2.authorizationserver.client.*	RegisteredClientRepository	OAuth2AuthorizationServerAutoConfiguration
WebClient.class	Reactive Support	ReactiveOpaqueTokenIntrospectionClientConfiguration

Security Auto-Configuration Architecture

Sources: module/spring-boot-security/src/main/java/org/springframework/boot/security/autoconfigure/web/servlet/ServletWebSecurityAutoConfiguration.java26-30 module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerProperties.java43-44 module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyRegistrationConfiguration.java68-71

---

Security Testing Support

Spring Boot provides the spring-boot-starter-security-test (and stack-specific variants like spring-boot-starter-security-saml2-test) to facilitate testing secured applications smoke-test/spring-boot-smoke-test-saml2-service-provider/build.gradle27-28

MockMvc Integration

SecurityMockMvcAutoConfiguration automatically configures MockMvc with Spring Security's SecurityContext support module/spring-boot-security-test/src/main/java/org/springframework/boot/security/test/autoconfigure/webmvc/SecurityMockMvcAutoConfiguration.java47-49

• Customization: It applies SecurityMockMvcRequestPostProcessors.testSecurityContext() to ensure requests run with the user in the TestSecurityContextHolder module/spring-boot-security-test/src/main/java/org/springframework/boot/security/test/autoconfigure/webmvc/SecurityMockMvcAutoConfiguration.java77-92
• HtmlUnit Support: If HtmlUnitDriver is present, it configures a MockMvcHtmlUnitDriverCustomizer that sets a DelegatingSecurityContextExecutor module/spring-boot-security-test/src/main/java/org/springframework/boot/security/test/autoconfigure/webmvc/SecurityMockMvcAutoConfiguration.java61-69

Code Entity Association: Testing

Sources: module/spring-boot-security-test/src/main/java/org/springframework/boot/security/test/autoconfigure/webmvc/SecurityMockMvcAutoConfiguration.java47-69

---

Key Configuration Classes and Properties

Feature	Auto-Configuration Class	Properties Prefix
Default Servlet Security	ServletWebSecurityAutoConfiguration	spring.security.*
OAuth2 Resource Server	OAuth2ResourceServerAutoConfiguration	spring.security.oauth2.resourceserver.*
OAuth2 Auth Server	OAuth2AuthorizationServerAutoConfiguration	spring.security.oauth2.authorizationserver.*
SAML2 Relying Party	Saml2RelyingPartyAutoConfiguration	spring.security.saml2.relyingparty.*
MockMvc Security Test	SecurityMockMvcAutoConfiguration	N/A

Sources: module/spring-boot-security-oauth2-resource-server/src/main/java/org/springframework/boot/security/oauth2/server/resource/autoconfigure/OAuth2ResourceServerProperties.java43-44 module/spring-boot-security-saml2/src/main/java/org/springframework/boot/security/saml2/autoconfigure/Saml2RelyingPartyRegistrationConfiguration.java68-71 module/spring-boot-security-test/src/main/java/org/springframework/boot/security/test/autoconfigure/webmvc/SecurityMockMvcAutoConfiguration.java47-49