Spring Security: JWT, OAuth2, CSRF/CORS

Spring Security uses a servlet filter chain that runs before DispatcherServlet to authenticate every request via JWT token validation and authorize access using @PreAuthorize with SpEL expressions.

CSRF exploits session cookies to forge requests, CORS restricts cross-origin JavaScript calls, @Valid rejects bad input at the controller boundary, and Spring Data JPA handles CRUD while JdbcTemplate handles complex SQL.

OAuth2 Resource Server validates external JWT tokens, @HttpExchange generates declarative REST clients, WebFlux provides reactive Mono/Flux types, WebSocket enables bidirectional real-time communication, and GraphQL lets clients pick exactly the fields they need.