Top 5 Online Courses To Learn OAuth2 and JWT in 2026

Hello friends, if you want to learn OAuth2.0 and JWT (Json Web Token) and looking for online resources like eBooks, online courses, sites, tutorials, projects etch then you have come to the right place. In this article, I am going to share best online courses to learn OAuth2.0 and JWT. But, before we get to the 5 best courses that will teach you everything you need to know about OAuth2 and JWT, let me tell you a little bit more about what it all really is. A JWT is basically a mechanism that is used to verify the owner of some JSON data. It is an encoded string that can actually contain an unlimited amount of data. It is also cryptographically signed.

5 Best Spring Security Online Training Courses for Java Developers (2025)

Hello Java developers Spring Security is one of the leading open-source, security frameworks that allow you to implement security in Java-based web applications. It provides several security features like authentication, authorization, the remember me functionality out-of-the-box, which means you can directly use them without adding code or changing your class. Yes, Spring Security implements security at the application level i.e. you can even secure your non-secure resource without modifying them. It is also the leading framework to secure RESTful Web Services. Because of all these, the demand for Java developers with good knowledge of Spring Security is very high.

Top 3 Spring Security Books and Courses to Learn in 2025 - Best of Lot

Spring Security is one of the big projects under the Spring framework umbrella, which addresses the security requirements of modern web applications. Since Security is a paramount concern for enterprise Java applications, good knowledge of a security framework like Spring security goes a long way in someone's career. It helps you become a full-stack developer and opens a lot of opportunities in terms of job and career growth. There is a lot of demand for Java developers who know the Spring framework and understand how to secure their applications on the web. They are also one of the highest-paid professionals in the Java world, where a Java developer with Spring + Spring Security gets anywhere to 120,000 - 150,000 USD or equivalent across the globe. Even in India, you get a lot of excellent opportunities, exciting work, and a higher salary if you have these skills.

Which is the best course to Learn Spring Security 5 and Spring Data JPA for Java Programmers?

If you are a Java Spring developer and working with Spring Security then you may be familiar with the "Learn Spring Security" course by Eugen Paraschiv of Baeldung. It is one of the most advanced and comprehensive courses on Spring Security and the best part of this course is that Eugen always keeps it up-to-date with the new Spring Security release. Now that version Spring Security 5 is out - he has updated his course to use new features of Spring Security 5. Btw, there is some really cool new functionality coming in Spring Security 5 for the reactive programming model, and many other improvements and new features. But, the most important one is the release of OAuth2.

What is the delegating filter proxy in Spring Security? How it works?

The Delegating filter proxy or DelegatingFilterProxy is a spring aware class which implements javax.servlet.Filter interface and used to activate Spring security in a web application. Since Filters are created and maintained by Servlet or Web Container this filter is declared in web.xml and it is configured to process request for all URLs, which means every request and response pass through this filter. In other words, DelegatingFilterProxy works as a proxy between Web Container and Spring Container. It passes all request and response to Spring Security to implement security constraints e.g. performing authentication or authorization. 

Difference between @Secured vs @RolesAllowed vs @PreAuthorize, @PostAuthorize Annotations in Spring Security

Spring Security is a powerful framework to implement security on Spring based Java web application as well as on security RESTful Web Services. It also provides method level security, which means restricting access to a method depending upon role and permissions of object. If a user calling the method has access the method will be executed, otherwise AccessDeniedException will be thrown by Spring Security. All these annotations e.g. @Secured, @RolesAllowed, @PreAuthorize, and @PostAuthorize is used to implement method level security in Spring security, but there are some subtle difference between them. 

Role based Access control using Spring Security and MVC, Mapping LDAP Groups to Authorities for Authorization

Authentication and Authorization is an integral part of any Java enterprise or web application. Since most of the company uses LDAP Active directory for authentication, authorization, and Role-based access control (RBAC), it's good to know How to implement Role-based access control using Spring MVC and Spring Security. This is the second part of my articles on using Spring Security for authentication and authorization in Spring MVC based Java application. In the last part, we have learned about doing LDAP authentication against Windows active directory, and in this Spring Security tutorial, we will learn How to map LDAP groups to authorities for implementing Role-based access control or authorization.

Top 25 Spring Security Interview Questions Answers for Java Developers

Hello guys, Spring Security is one of the most popular security frameworks in the Java world and I strongly believe that every experienced Java developer should learn it. Because of its popularity, there is always some question on Spring Security on Java interviews but there are not enough resources to prepare for that. That's why when  I shared the Spring MVC questions and spring boot interview question last year, a lot of you asked me to share similar interview questions on Spring Security, Spring Cloud, and Microservices. I listen to those requests and have been doing some research since then to write those articles. 

How to limit Concurrent Login Sessions in a Java web application using Spring Security? Example

If you don't know, Spring security can limit the number of sessions a user can have in a Java web application. If you are developing a web application especially a secure web application in Java JEE then you must have come up with the requirement similar to many online banking portals have like only one session per user at a time or no concurrent session per user. If the user tries to open a new session then either an alert is shown or his previous session is closed. Even though you can also implement this functionality without using spring security but with Spring security, it's just a piece of cake with coffee :). 

2 Ways to setup LDAP Active Directory Authentication in Java - Spring Security Example Tutorial

The LDAP authentication is one of the most popular authentication mechanism around the world for enterprise application and Active directory (an LDAP implementation by Microsoft for Windows) is another widely used LDAP server. In many projects, we need to authenticate against active directory using LDAP by credentials provided in the login screen. Sometimes this simple task gets tricky because of various issues faced during implementation and integration and no standard way of doing LDAP authentication in a Java web application. Even though Java provides LDAP support but in this article, I will mostly talk about spring security because of it's my preferred Java framework for authentication, authorization, and security-related stuff.

How HTTP Basic Authentication works in Spring Security? Explained

In the last article, I have taught you how to enable Http basic authentication in Spring security-based Java application, and now we'll go one step further to understand how exactly http basic authentication works in Spring security. If you remember, when you use HTTP Basic for authentication purposes, the client, like a browser or a rest client sends login credentials in the http request header. The header is aptly named "Authorization," and it contains a Base64 encoded string, which is created by concatenating username and password using a colon. For example, if the username is "johnsmith" and the password is "JOHN3214" then they will be concatenated as "johnsmith:JOHN3214" before encoded using base 64 encoding algorithms.

Difference between Servlet and Filter in Java

Servlet and Filter are two of the essential concepts defined in Servlet specification. They are core of any web application because most of the request will pass through them. This is why they are also very popular on Java Web developer interviews. What is the difference between a Servlet and a Filter is one of the most common and interesting interview question related to Servlet. If you can explain the difference clearly, you improve your chance of hiring a lot. In order to understand and explain the difference, you must understand what is the purpose of Servlet and Filter, How they work and how they are used in various web applications. 

How to conditionally render view in JSP using Spring Security tag library? Example tutorial

One of the common requirement of secure Java application is to show and hide content based upon role of current user. For example, a logged in user can see his name e.g. Welcome User1 but that link is not visible to an unauthenticated user. Similarly, a user with admin role can see a lot of admin related functionality which should not be visible to a normal user e.g. add/remove users, disable users, create roles, edit roles etc. How can you achieve such condition based rendering in view? Does spring security support that? Well, the answer is Yes. Spring security provide a tag library which you can use in JSP pages to perform a lot of authentication and authorization related stuff e.g. you can access current user's name, you can access access current user's role and you can also conditionally show/hide certain section of views based upon user's role. 

How to get current logged in user in JSP and Controller using Spring Security? Example Tutorial

One of the common task while using Spring Security in a Java web application is getting the username of currently logged in user. Sometime, you need that in your controller class and sometime in JSP for view purpose, but the big question mark is how do you get the current user in Spring Security? Well, there are many ways to do it and depending upon whether you need it inside a JSP page or Controller class, you can choose them. The current user, also known as Principal in Spring Security can be obtained from the UserDetails class, which holds all details for currently logged in user. You can get this class from the SecurityContext, which in turn can be retrieved from SecurityContextHolder as shown below:

How to secure an URL using hasRole() in Spring Security? Is it enough to hide sections of JSP to protect URL? Example?

One of the Spring security question asked to me on a recent interview was about is it enough to hide portions of JSP to protect a URL from unauthorized access in Spring security? First of all I didn't understand the question, so I ask him to clarify a bit more. He explained to me that there are different roles in his application e.g. DEVELOPER, ADMIN, TRADER, OPERATION and each role can only see the functionalities based upon their role. For example, an ADMIN has a right to add or remove new users into the system, while DEVELOPER can only see test order, but OPERATION can see all orders. 

How to show current logged in username in JSP using Spring Security? Example Tutorial

One of the common feature of secure Java web application to show the username as link on the top right corner of web application once user successfully logged in. Some application also show the logout or sign-out link like that but how do you display the current user or principal name in a JSP page secured using Spring security library? Well, Spring Security provides a small but userful JSP tag library which contains custom tags similar to JSTL, which can show a lot of useful authentication and authorization details of current user. For example, you can use <s:authetication> tag to display the current principal details including the username of currently logged in user. The tag name is authentication here and s is the prefix you specify while importing tag using taglib directive in JSP. 

How does Remember Me functionality works in Spring Security?

In the last article, You have learned how to enable the remember-me functionality in Spring security and today you will learn how does Remember Me work under the hood. So far, you know that remember-me functionality uses cookie to remember users and allow auto-login (without entering password again), so you might have guessed that spring security provides hooks to generate that cookie as well as process those cookie when an already signed user open the application after the break e.g. after a day or two. As long as cookie is not expired and token is valid i.e. user hasn't changed the password, he should be able to login to your application. 

How to enable RememberMe Functionality in Spring Security

Hello guys, most of the web application has login or authentication functionality where user need to enter their username and password to access functionalities provided by application. This is great from application's perspective because functionalities are protected from anonymous user but from user's perspective he would appreciated something which would not ask him/her to enter username and password every now and then. This is what remember me functionality of Spring security does. It allow you to build a web application which can remember their user and allow them to automatically login when the restart their browser or come back another day. 

How to define Multiple intercept-url's in Spring Security? Does Order of URLs matter?

Hello guys, one of the frequently asked Spring Security Question is about the order of multiple intercept-urls in Spring security configuration file e.g. applicationContext-security.xml. If you have to define more than one intercept URLS, which order will you define them? Does order or URLs in configuration file even matters? The short answer of this question is, Yes, ordering of intercept URLs in Spring Security configuration file does matter and if you have to define multiple intercept-urls then you define the in a order from most specific to least specific. Why you should that? because Spring security tries to match the URL of every incoming request or outgoing response to the intercept urls in the same order they are declared. 

How to Secure Password in Java using Spring Security? Password hashing and Salting Example Tutorial

Hello guys, if you are wondering whether Spring Security provides password hashing or not and wondering how to use it in your project then you have come to the right place. First, Yes, Spring Security provides out-of-the-box support for password hashing and salting, but before going into the details of how to use that, let's first understand what is password hashing and salting and why do you need that in a secure web application. One of the common requirement of a secure application is that password is never stored in the plain text. It doesn't matter if you are storing password in a database or a flat file they must be stored in encrypted form. The process to encrypt password for storing is known as hashing.