Hi guys, in this lesson we will talk about authentication module of spring security. Authentication means confirming your own identity. So it is related to it. Who are you? There are a lot of login types in spring security, but we will talk about form logon, start points of spring security is HTTP filters, HTTP filters, catch the HTTP request and filter them. Spring security works with filters.

When you send a request from client side, simply security will catch it with authentication filters. This filter is basic authentication filter as default in spring security. In this class, we do filter internal methods. The request is processed But we should notice something here the request should be sent with basic authorization token to server side. So do it credentials should be sent with basic base 64 token. This token should be constructed from username and password.

Then in do filter internal method, the authorization header will be taken, then it will be decoded with base 64 algorithm. Then username password authentication token will be created from username and password. Later authentication request will be provided. Authentication will be implemented with provider manager, provider managers iterates through all the providers configured authentication providers and delegate the Actual authentication job to authentication providers. There are many implementations for authentication provider. One of the implementation is the authentication provider, which extends from the abstract user details authentication provider.

In authentication provider, we can inject password encoder, or user user details service to authenticate from database. In next lessons, we will see the implementation of it. In the authentication provider class, first of all, we will call retrieve user method. In this method, we will log user from database with username. After finding user with username we will check password with additional authentication checks methods after auto indication, we will return successful response or failure response as exception. But we should store it on security context to access it from everywhere in application.

As final thing, let's understand the content of authentication object. authentication is a principal object and contains credentials, authorities and principal. Okay, that's all about spring security authentication. Thank you.