How Spring Security Works Internally (Filters, Authentication & Authorization Explained)

If you have worked with Spring Boot for a while, you have used Spring Security without fully tracing what happens inside it. You add a dependency, configure a SecurityFilterChain, and wire a UserDetailsService, and your APIs are suddenly protected. It works. But under the hood, there is a very disciplined flow that decides who the user is, whether the password is valid, and whether the request should even reach your controller. Once that internal flow clicks, Spring Security stops feeling magica