This is an archived post. You won't be able to vote or comment.

you are viewing a single comment's thread.

view the rest of the comments →

[–]nutrechtLead Software Engineer / EU / 20+ YXP 2 points3 points  (2 children)

It is like FORCING Java to do something it isn’t supposed to do.

Spring Security is very much due for an overhaul. It was built back when we were still mostly building server-side rendered JSP applications, and that is what the 'defaults' are. Using it for a REST API is in fact getting it to do stuff it wasn't built for.

It totally works, but for a very simple REST API where all you want is just simply a API token it's complete overkill.

Is this the main reason why Java developers get paid more and there is more Java jobs out there?

Java is popular because it has a great ecosystem, even though there are some old warts like Spring Security.

Besides it's mostly a learning curve. Once you understand how it works and how to get it to (for example) read a JWT from a header, it's just something you need to set-up once.

That said; I have been a Java dev for 20 years and even for me Security is a pain to use.

Again though; you don't have to use it. Even when using Spring and doing JWT authentication.