AI Code Generation Quality for Java Spring Security

Java Spring Security remains a critical component for securing enterprise applications, and developers increasingly rely on AI coding assistants to generate security configurations. The quality of AI-generated Spring Security code varies significantly across different tools, and understanding these differences helps developers implement secure configurations more efficiently.

Understanding Spring Security Configuration

Spring Security provides an authentication and authorization framework for Java applications. The configuration involves multiple components: security filter chains, authentication managers, user detail services, and authorization rules. Each component has specific requirements that AI assistants must handle correctly to produce working code.

Modern Spring Security configurations use the SecurityFilterChain bean approach introduced in Spring Security 5.7, replacing the older WebSecurityConfigurerAdapter pattern. This change impacts how AI-generated code will compile and function in current Spring Boot applications.

Common AI Generation Issues

When AI assistants generate Spring Security configurations, several recurring quality issues emerge. These problems affect application security, compilation success, and runtime behavior.

Deprecated API Usage

A frequent problem involves AI-generated code using deprecated APIs. Many AI assistants still produce configurations extending WebSecurityConfigurerAdapter, which was deprecated in Spring Security 5.7 and removed in later versions. This results in compilation failures or runtime errors in modern Spring Boot applications.

Missing Security Filter Chain Configuration

AI-generated code often lacks complete SecurityFilterChain definitions. Incomplete configurations may compile but leave security gaps, exposing endpoints that should be protected. Proper chains must specify which URLs to permit, which authentication mechanisms to use, and how to handle authorization failures.

Incorrect Authentication Manager Wiring

Authentication manager configuration frequently contains errors. AI assistants sometimes generate code that fails to wire the authentication manager correctly to the security filter chain, resulting in authentication attempts that never complete or always fail regardless of credentials.

Practical Examples

Let us examine how different AI assistants handle Spring Security configuration requests and assess the quality of their outputs.

Example: Basic Security Filter Chain

A developer requests a basic security configuration for a REST API with JWT authentication:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            );

        return http.build();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

This example demonstrates correct modern Spring Security configuration. AI assistants generally produce accurate basic configurations when provided with clear requirements.

Example: JWT Authentication Filter

For JWT-based authentication, the security configuration requires additional components:

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;
    private final UserDetailsService userDetailsService;

    public JwtAuthenticationFilter(JwtService jwtService, UserDetailsService userDetailsService) {
        this.jwtService = jwtService;
        this.userDetailsService = userDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain filterChain)
            throws ServletException, IOException {

        final String authHeader = request.getHeader("Authorization");
        final String jwt;
        final String username;

        if (authHeader == null || !authHeader.startsWith("Bearer ")) {
            filterChain.doFilter(request, response);
            return;
        }

        jwt = authHeader.substring(7);

        try {
            username = jwtService.extractUsername(jwt);

            if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
                UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);

                if (jwtService.isTokenValid(jwt, userDetails)) {
                    UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails,
                        null,
                        userDetails.getAuthorities()
                    );
                    authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authToken);
                }
            }
        } catch (Exception e) {
            // Handle invalid JWT appropriately
        }

        filterChain.doFilter(request, response);
    }
}

This JWT filter implementation shows common patterns that AI assistants generate. Quality varies based on how specifically the request is framed.

Example: Method-Level Security

For method-level security with annotations:

import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.stereotype.Service;

@Service
public class PaymentService {

    @PreAuthorize("hasRole('USER') and #amount <= 1000")
    public String processPayment(double amount, String accountId) {
        // Payment processing logic
        return "Payment processed successfully";
    }

    @PreAuthorize("hasRole('ADMIN') or hasPermission(#accountId, 'VIEW')")
    public String getAccountDetails(String accountId) {
        // Account details retrieval
        return "Account details retrieved";
    }
}

Method-level security configurations require correct SpEL expression syntax. AI assistants generally handle basic expressions well but may struggle with complex custom permission evaluations.

Quality Assessment Criteria

Evaluating AI-generated Spring Security code requires checking multiple dimensions beyond simple compilation.

Compilation Success

Generated code must compile against the specified Spring Security version. Incompatible API usage indicates the AI assistant lacks current framework knowledge or failed to incorporate version information from the request.

Security Correctness

Configuration must implement intended security policies. Review authorization rules, authentication mechanisms, and password encoding to ensure they match requirements. AI-generated configurations sometimes permit unintended access or use weaker security settings than requested.

Best Practices Compliance

Modern Spring Security favors lambda DSL over builder methods, stateless session management for APIs, and proper separation of concerns. Generated code should reflect current best practices rather than legacy patterns.

Tool-Specific Observations

Different AI coding assistants demonstrate distinct strengths when generating Spring Security configurations. Claude Code handles complex custom authentication providers well, producing clean implementations with proper dependency injection. GitHub Copilot excels at generating basic security filter chains quickly, though it may default to deprecated APIs without explicit version context. Cursor provides good integration with existing project security configurations but sometimes produces redundant bean definitions.

Zed AI generates accurate JWT-related components when given clear extraction and validation requirements. Aider performs well for refactoring legacy security configurations to modern patterns, though it requires explicit guidance about the target Spring Security version.

Recommendations for Developers

When using AI assistants for Spring Security configuration generation, provide explicit context about your Spring Boot and Spring Security versions. Specify whether you need JWT, OAuth2, or basic authentication. Include sample endpoint patterns and required roles in your request.

Review generated security code carefully before deploying. Verify that authorization rules match your requirements, that authentication mechanisms are correctly configured, and that password encoding uses appropriate algorithms. Run integration tests to confirm authentication and authorization behave as expected.

For teams implementing custom security components, consider creating detailed templates or example implementations that AI assistants can reference. Providing specific examples improves output quality more than general requests.

Built by theluckystrike — More at zovo.one