SPRING CONCEPTS
Authentication
Spring Concepts / Authentication
Authentication verifies the caller’s identity.
Understand the idea
The login endpoint checks an email/password pair. Later API requests prove possession of a signed token. Spring Security verifies that token before the controller sees its principal. Knowing a user’s email or id is not proof of identity.
A concrete example
Credentials → password check → access token
Access token → verified JWT principalIn the application
AuthController performs login, while the resource-server filter authenticates subsequent todo requests.
Authentication does not by itself permit access to every stored task. Authorization must also be enforced.