Topic

Spring Security

1 post about Spring Security. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Posts

Jetbrains
Debug Past an HTTP 403 Without Breaking Spring Security
Spring Security can reject a request before execution reaches a controller breakpoint, leaving developers to determine the effective roles and whether bypassing authorization is safe for debugging. IntelliJ IDEA’s security inlays read the live SecurityFilterChain during an active debug session, show role or authority requirements, link to configuration, and let developers unlock an exact URI and HTTP method either with all listed roles or with a chosen username and authority set. The debugger populates an artificial Authentication in the running application’s SecurityContext without changing configuration, while CSRF checks and method-level authorization still apply separately. Unlocks last for the debug session or until relocked, affect every client reaching that route, and have limitations including Servlet-only support, no programmatic API, and a null @AuthenticationPrincipal result.

The best engineering reads, once a week.

Topic

1 post about Spring Security. Every summary links to the original.

Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.

Newest first

Jetbrains
Debug Past an HTTP 403 Without Breaking Spring Security
Spring Security can reject a request before execution reaches a controller breakpoint, leaving developers to determine the effective roles and whether bypassing authorization is safe for debugging. IntelliJ IDEA’s security inlays read the live SecurityFilterChain during an active debug session, show role or authority requirements, link to configuration, and let developers unlock an exact URI and HTTP method either with all listed roles or with a chosen username and authority set. The debugger populates an artificial Authentication in the running application’s SecurityContext without changing configuration, while CSRF checks and method-level authorization still apply separately. Unlocks last for the debug session or until relocked, affect every client reaching that route, and have limitations including Servlet-only support, no programmatic API, and a null @AuthenticationPrincipal result.

The best engineering reads, once a week.