Spring Security OAuth 2.0 Authentication Explained with Real-Time Examples

-

Introduction :

In modern applications, users often log in using Google, GitHub, Facebook, or other third-party platforms instead of creating a new account. This authentication mechanism is powered by OAuth 2.0.

OAuth 2.0 is an authorization framework that allows applications to access user information from another service without exposing the user's password. It is widely used in web applications, mobile applications, and enterprise systems.

In this article, we will understand OAuth 2.0 Authentication in Spring Security, its architecture, components, flow, real-time examples, and commonly asked interview questions.



What is OAuth 2.0?

OAuth 2.0 is an authorization protocol that enables a third-party application to access resources on behalf of a user.

Instead of sharing credentials directly with an application, users authenticate with a trusted provider such as Google, and the provider issues an access token that can be used to access protected resources.

Simple Definition

OAuth 2.0 allows users to grant limited access to their data without sharing their passwords.

Why Do We Need OAuth 2.0?

Imagine an application that allows users to upload files directly to Google Drive.

Without OAuth 2.0:

  • User shares Google username and password.

  • Application stores credentials.

  • Security risk increases.

With OAuth 2.0:

  • User authenticates with Google.

  • Google provides an access token.

  • Application uses the token to access Google Drive.

The password is never exposed to the application.

Key Components of OAuth 2.0

1. Resource Owner

The user who owns the data.

Example:

A Google account holder.

2. Client Application

The application requesting access.

Example:

A Spring Boot application.

3. Authorization Server

The server that authenticates users and issues tokens.

Example:

Google Authorization Server.

4. Resource Server

The server hosting protected resources.

Example:

Google Drive API.

5. Access Token

A temporary token used to access resources.

Example:

eyJhbGciOiJIUzI1NiIs...

Real-Time Example

Suppose a company develops an Employee Portal.

Requirements:

  • Employees can log in using Google.

  • No separate username/password management.

  • Secure authentication.

Flow:

  1. User clicks "Login with Google".

  2. Google login page opens.

  3. User enters credentials.

  4. Google verifies user.

  5. Google sends Authorization Code.

  6. Spring Boot exchanges code for Access Token.

  7. User successfully logs into the application.

OAuth 2.0 Authorization Code Flow

This is the most secure and commonly used OAuth flow.

Step 1 : User clicks Login with Google.

Step 2 : Application redirects user to Google Authorization Server.

Step 3 : User authenticates successfully.

Step 4 : Google sends Authorization Code.

Step 5 : Application exchanges code for Access Token.

Step 6 : Access Token is used to access user information.

Step 7 : User gains access to the application.

OAuth 2.0 in Spring Security

Spring Security provides built-in support for OAuth 2.0 login.

Maven Dependency

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

Application Configuration

application.yml

spring:
  security:
    oauth2:
      client:
        registration:
          google:
            client-id: YOUR_CLIENT_ID
            client-secret: YOUR_CLIENT_SECRET

This configuration enables Google OAuth login.

Security Configuration

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http)
            throws Exception {

        http
            .authorizeHttpRequests(auth ->
                auth.anyRequest().authenticated())
            .oauth2Login();

        return http.build();
    }
}

Explanation

  • Any request requires authentication.

  • OAuth login is enabled.

  • Spring Security automatically redirects users to Google.

Accessing Logged-In User Information

@GetMapping("/profile")
public String profile(
        @AuthenticationPrincipal OAuth2User user) {

    return "Welcome " + user.getAttribute("name");
}

Output

Welcome Sulochana

Advantages of OAuth 2.0

Improved Security

Passwords are never shared with client applications.

Single Sign-On (SSO)

Users can log in using existing accounts.

Better User Experience

No need to remember multiple passwords.

Industry Standard

Widely supported by Google, GitHub, Facebook, LinkedIn, and Microsoft.

Scalability

Suitable for enterprise-level systems.

OAuth 2.0 vs Traditional Authentication



Common Mistakes

Exposing Client Secret

Never store client secrets in public repositories.

Using HTTP Instead of HTTPS

OAuth communication should always use HTTPS.

Not Validating Tokens

Always verify tokens before granting access.

Improper Redirect URIs

Configure redirect URLs correctly.

Interview Questions

What is OAuth 2.0?

OAuth 2.0 is an authorization framework that allows applications to access resources on behalf of users without exposing passwords.

What is an Access Token?

An access token is a credential used to access protected resources.

What is an Authorization Server?

A server responsible for authenticating users and issuing tokens.

What is the Authorization Code Flow?

A secure OAuth flow where an authorization code is exchanged for an access token.

Why is OAuth 2.0 preferred over traditional authentication?

Because it improves security and avoids sharing user credentials with client applications.

Does OAuth 2.0 provide authentication?

OAuth 2.0 primarily provides authorization. Authentication is often implemented using OpenID Connect (OIDC) on top of OAuth 2.0.

Conclusion :

OAuth 2.0 is one of the most important security standards used in modern applications. It allows secure access to resources without exposing user credentials and enables features such as Single Sign-On (SSO) and third-party authentication.

Spring Security makes OAuth 2.0 integration simple by providing built-in support for authorization servers such as Google, GitHub, and Facebook. Understanding OAuth 2.0 is essential for Java Full Stack Developers and is frequently asked in interviews.

In the next article, we'll compare OAuth 2.0 and JWT Authentication, understand their differences, and learn when to use each approach in real-world applications.



Comments

Post a Comment

Popular posts from this blog

React Basics – How to Create Component

-
  Introduction (Story) : When I started learning React, I was confused about how components actually work. I saw many examples, but things became clear only when I created my own first component. In this blog, I will explain how to create a simple React component step by step in an easy way. What is a Component in React? A component is a reusable piece of UI in React. It helps in breaking the application into smaller, manageable parts. Tools Required : Node.js React (Create React App / Vite) VS Code  Step 1: Create React App : Run the following command: Where you want create the react project, then we have to create new folder and there you can open the cmd and run below command npx create-react-app my-app Navigate to project folder: cd my-app npm start Step 2: Create Your First Component Create a file named Hello.js import React from 'react' ; function Hello () { return <h1> Hello, Welcome to React! </h1> ; } export default Hello ; Step 3: ...
Read more

How to Build REST API using Spring Boot (Step-by-Step Guide)

-
Introduction  (Story + Experience)  : When I started learning Spring Boot, I found REST APIs a bit confusing. I watched multiple tutorials, but I didn’t fully understand how backend systems actually work. Things became clear when I tried building a simple REST API on my own. In this blog, I will share the same step-by-step process that helped me understand REST APIs in a practical way. What is REST API? A REST API allows communication between frontend and backend systems using HTTP methods like GET, POST, PUT, and DELETE. In real-world applications, REST APIs are used to send and receive data between client and server. Tools Required  : - Java - Spring Boot - IntelliJ / VS Code - Postman Step 1: Create Spring Boot Project  : Go to Spring Initializr and create a project with the following dependencies: - Spring Web - Spring Data JPA - PostgreSQL Driver Step 2: Create Controller  : @RestController @RequestMapping("/api") public class HelloController {   ...
Read more

Spring Boot @RequestParam Annotation Explained with Real-Time Examples

-
Image
 Introduction : As a Java Full Stack Developer, I have worked on several Spring Boot applications where APIs needed to receive data from users. One annotation that I frequently used in REST APIs is @RequestParam . In many real-world applications, users need to search, filter, sort, or paginate data. For example, an employee management system may allow users to search employees by department, status, or employee ID. In such cases, @RequestParam provides a simple and efficient way to pass data from the client to the server through URL query parameters. When I started learning Spring Boot, I often got confused between @RequestParam , @PathVariable , and @RequestBody . However, after working on multiple projects, I understood the purpose of each annotation and when to use them effectively. In this article, I will explain the @RequestParam annotation with practical examples, project use cases, common mistakes, best practices, and interview questions. What is @RequestParam? The @Reques...
Read more