Back to Challenges

Spring Boot 4 Securing REST API

Created by Glabay | Added on Jul 13, 2026
0 reviews

Overview

This project is designed to help bridge the gap between tutorials and real-world development.

Your goal is to build a secure REST API using Spring Boot 4 and Spring Security that supports user registration, authentication, and role-based authorization.

Rather than following a step-by-step tutorial, you'll be expected to research documentation, solve problems independently, and apply what you've learned.

The finished project should demonstrate a solid understanding of modern Spring Security concepts and serve as a portfolio project.

Technical Requirements

  • Java 25
  • Spring Boot 4
  • Spring Data JPA
  • Your application must support multiple Spring Profiles.
    • H2 Database
    • PostgreSQL

Choose a Build Tool:

  • Maven
  • Gradle

Required Features

User Registration

Create an endpoint allowing users to register an account.

Requirements:

  • Username
  • Password
  • Password Confirmation

Validation should include:

  • Required fields
  • Password confirmation matches
  • Username uniqueness
  • Appropriate validation annotations with reasonable message

Use Spring Validation together with:

  • BindingResult

Passwords must never be stored in plain text, use either:

  • BCrypt
  • Argon2

Authentication

Implement authentication using Spring Security.

Users should be able to:

  • Login
  • Logout

Logout should:

  • Invalidate the HTTP Session
  • Clear authentication
  • Remove relevant cookies

Authorization

Implement role-based authorization.

Minimum required roles:

  • USER
  • ADMIN

Public endpoints:

  • Home
  • Register
  • Login

Authenticated endpoints:

  • Dashboard

Administrator-only endpoints:

  • User Management

Spring Security Configuration

Implement a custom SecurityFilterChain.

Your security configuration should include:

  • Endpoint authorization
  • Password Encoder
  • Authentication Provider (recommended)
  • Login configuration
  • Logout configuration

Access Denied

Create custom handling for unauthorized requests.

When a logged-in user attempts to access an endpoint they are not authorized to use, return an appropriate 403 Forbidden response.

REST API

This project is API-only. Do not create a Thymeleaf or JSP frontend.

Your API should return meaningful HTTP status codes.

Examples include:

  • 200 OK
  • 201 Created
  • 400 Bad Request
  • 401 Unauthorized
  • 403 Forbidden
  • 404 Not Found

Learning Objectives

By completing this project you should become comfortable with:

  • Spring Security
  • Authentication
  • Authorization
  • Password Hashing
  • Role-Based Security
  • Spring Profiles
  • Spring Data JPA
  • Validation
  • BindingResult
  • SecurityFilterChain
  • PasswordEncoder
  • Session Management

Bonus Challenges

Choose as many as you'd like.

OAuth Login

Support OAuth2 login using one or more providers such as:

  • GitHub
  • Google

JWT Authentication

Replace session-based authentication with stateless JWT authentication.

Consider implementing:

  • Access Tokens
  • Refresh Tokens

Method Security

Use annotations such as:

  • @PreAuthorize
  • @PostAuthorize

instead of relying solely on endpoint configuration.