Securing Java Applications with Spring Security

Security is one of those things you don't think about until you get hacked. I remember deploying an app with a default Spring Security setup, thinking "it’s fine." It wasn't. I had left the actuator endpoints open, and anyone could see the health and metrics. Spring Security is powerful but complex. The `SecurityFilterChain` is your best friend. I usually start with JWT authentication for stateless APIs. It’s a bit of a learning curve because you have to configure the filter to intercept requests and validate tokens without sessions. For role-based access, the `@PreAuthorize` annotation is a lifesaver. You can do `@PreAuthorize("hasRole('ADMIN')")` right on your controller methods. It keeps the security logic close to the business logic. Also, never store passwords in plain text. Use BCryptPasswordEncoder. It’s slow by design, which makes brute-force attacks much harder.