Authentication vs Authorization (who are you vs what can you do)

package com.bank.security;

import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;

public class AuthenticationDemo {

    public static void printCurrentUser() {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        System.out.println("User: " + auth.getName());
        System.out.println("Authenticated: " + auth.isAuthenticated());
        System.out.println("Authorities: " + auth.getAuthorities());
    }
}

User: rajesh
Authenticated: true
Authorities: [ROLE_CUSTOMER]

package com.bank.service;

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.stereotype.Service;
import java.math.BigDecimal;

@Service
public class AccountService {

    @PreAuthorize("#accountId == authentication.name or hasRole('TELLER')")
    public BigDecimal getBalance(String accountId) {
        // A customer can see only their own account.
        // A teller can see any account.
        return new BigDecimal("125000.75");
    }

    @PreAuthorize("hasRole('ADMIN')")
    public void closeAccount(String accountId) {
        System.out.println("Account " + accountId + " closed by admin.");
    }
}

// Rajesh (CUSTOMER) calls getBalance("rajesh") --> allowed (own account)
// Rajesh (CUSTOMER) calls getBalance("priya")  --> 403 Forbidden
// Priya  (TELLER)   calls getBalance("rajesh") --> allowed (teller role)
// Rajesh (CUSTOMER) calls closeAccount("rajesh") --> 403 Forbidden

package com.bank.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                // Authentication: anyone can reach the login page
                .requestMatchers("/login", "/public/**").permitAll()
                // Authorization: only ADMIN can reach admin endpoints
                .requestMatchers("/api/v1/admin/**").hasRole("ADMIN")
                // Authorization: only TELLER or ADMIN can approve transfers
                .requestMatchers("/api/v1/transfers/approve").hasAnyRole("TELLER", "ADMIN")
                // Everything else needs authentication
                .anyRequest().authenticated()
            )
            .formLogin(form -> form.loginPage("/login"));
        return http.build();
    }
}

package com.bank.controller;

import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TransferController {

    @GetMapping("/api/v1/transfers")
    public ResponseEntity<String> listTransfers() {
        // If no valid token/session --> 401 (authentication failed)
        // If valid token but role is CUSTOMER, not TELLER --> 403 (authorization failed)
        return ResponseEntity.ok("Transfer list for authorized teller.");
    }
}

curl -X GET /api/v1/transfers
--> 401 Unauthorized (no credentials provided)

curl -X GET /api/v1/transfers -H "Authorization: Bearer <rajesh_customer_token>"
--> 403 Forbidden (authenticated but not a teller)

curl -X GET /api/v1/transfers -H "Authorization: Bearer <priya_teller_token>"
--> 200 OK (authenticated and authorized)

package com.bank.service;

// WRONG: mixed authentication and authorization logic
public class WrongTransferService {

    public void transfer(String username, String password, String fromAccount, String toAccount) {
        if (username.equals("rajesh") && password.equals("pass123")) {
            // Bug: anyone who logs in as rajesh can transfer from ANY account
            executeTransfer(fromAccount, toAccount);
        }
    }

    private void executeTransfer(String from, String to) { }
}

// CORRECT: separate authentication from authorization
public class CorrectTransferService {

    // Authentication handled by Spring Security filter chain
    // Authorization enforced by @PreAuthorize
    @PreAuthorize("#fromAccount == authentication.name or hasRole('TELLER')")
    public void transfer(String fromAccount, String toAccount) {
        executeTransfer(fromAccount, toAccount);
    }

    private void executeTransfer(String from, String to) { }
}

package com.bank.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;

@Configuration
public class AuthConfig {

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }

    @Bean
    public UserDetailsService userDetailsService(PasswordEncoder encoder) {
        var rajesh = User.builder()
            .username("rajesh")
            .password(encoder.encode("securePass2024"))
            .roles("CUSTOMER")
            .build();
        var priya = User.builder()
            .username("priya")
            .password(encoder.encode("tellerPass2024"))
            .roles("TELLER")
            .build();
        return new InMemoryUserDetailsManager(rajesh, priya);
    }
}

package com.bank.security;

import jakarta.servlet.http.HttpServletResponse;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.access.AccessDeniedHandler;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class ErrorHandlerConfig {

    @Bean
    public AuthenticationEntryPoint authEntryPoint() {
        return (request, response, authException) -> {
            response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); // 401
            response.getWriter().write("{\"error\":\"Please log in to access this resource.\"}");
        };
    }

    @Bean
    public AccessDeniedHandler accessDeniedHandler() {
        return (request, response, accessDeniedException) -> {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN); // 403
            response.getWriter().write("{\"error\":\"You do not have permission for this action.\"}");
        };
    }
}