spring-projects/spring-security

Spring Security is the security framework for the Spring IO Platform: it provides the authentication and authorization services that Java/Spring applications use to protect their endpoints and enforce access rules. It fits teams already building on Spring who need security integrated into the application itself rather than bolted on from outside. The project is distributed as a library, not a standalone service, under the Apache-2.0 license. Spring Security repository Apache 2.0 license

What it changes in a workflow

Rather than running a separate gateway or identity service, you add Spring Security as a dependency to your Spring application and let it handle the security layer inside the app. The reference documentation and Javadoc are the primary sources for the feature list and API, and a "what's new" page tracks changes per release. Spring Security Reference Spring Security API documentation what's new

Getting started and support

Getting the artifacts and a minimal "Hello World" setup are documented separately, so the first step is the obtaining guide followed by the servlet getting-started page. For questions, there is a Spring Security tag on Stack Overflow, and commercial support is offered. Getting Spring Security Hello Spring Security Stack Overflow tag commercial support

Requirements and constraints

The README states that Spring Security 6.0 requires Spring 6.0 as a minimum and also requires Java 17. That is the runtime baseline for this version line, not a broad statement about every past release. repository README

Building from source adds its own prerequisites: Git and a JDK 17 build, with JAVA_HOME pointing at the JDK 17 folder. The project uses a Gradle-based build with a self-contained ./gradlew bootstrap, which can publish jars to the local Maven repository or compile, test and build all artifacts and docs. repository README

IDE setup differs by editor. IntelliJ needs no special steps. Eclipse and VS Code require generating Eclipse metadata first, and for VS Code the README explicitly says not to import via the Gradle for Java extension but to open the repository root as a folder. These are contributor-facing constraints, not conditions for using the published library. repository README

Practical scope

The evidence describes a framework library for adding authentication and authorization to Spring applications. It does not document deployment, operational hardening or a managed identity product, so those are outside the scope shown here. The license is Apache-2.0, which is the condition that matters for redistribution and modification. Apache 2.0 license