How OAuth2 Login Actually Works in Spring Security | Authorization Code Flow Explained
You clicked "Login with Google." You got redirected. You came back logged in.
Between those 3 seconds, 6 things happened inside Spring Security — and most Java developers who built that button have never traced all of them.
In this video, I break down the full OAuth2 Authorization Code Flow from the inside — not the config, but what actually fires, in what order, and where it sits inside Spring Security's filter chain.
What you'll learn:
✅ Why OAuth2 is NOT an authentication protocol (most devs get this wrong)
✅ The 4 roles — Resource Owner, Client, Authorization Server, Resource Server
✅ The 6-step Authorization Code Flow — step by step with diagrams
✅ Where OAuth2AuthorizationRequestRedirectFilter and OAuth2LoginAuthenticationFilter plug into the filter chain
✅ What OAuth2UserService does and why you need to override it
✅ The state parameter — the CSRF protection most tutorials skip
✅ When NOT to use OAuth2 (and the mistakes that happen when you do)
This is Part 3 of the Spring Security series:
▶ Part 1 — How Spring Security Works Internally: / how-spring-security-works-internally-filte...
▶ Part 2 — How JWT Works in Spring Security: / how-jwt-authentication-works-in-spring-sec...
▶ Part 3 — OAuth2 Login (this video)
Read the full article on Medium:
/ how-oauth2-login-works-in-spring-security-...
Connect with me:
📝 Medium: / singh.piyush
🛠 Topmate: https://topmate.io/code_with_clarity
Timestamps:
0:00 — The moment that confused me
1:10 — OAuth2 vs OpenID Connect — the distinction that matters
2:30 — The 4 roles explained with Login with Google
4:00 — The Authorization Code Flow — all 6 steps
7:30 — Where OAuth2 plugs into Spring Security's filter chain
10:00 — OAuth2UserService — where your app takes over
12:00 — The state parameter and CSRF protection
13:30 — When NOT to use OAuth2
15:00 — Key takeaway
Tags:
#SpringSecurity #OAuth2 #SpringBoot #Java #Backend #LoginWithGoogle #Authorization #JavaDeveloper #SpringSecurityTutorial #OAuth2SpringBoot