Most developers can configure Spring Security, but far fewer can explain what actually happens when a protected request hits the app. In this video, I walk you through Spring Security’s internal architecture step by step—so it stops feeling like magic and starts feeling predictable. I start at the entry point: an HTTP request enters the framework, FilterChainProxy routes it to the right SecurityFilterChain, and each filter performs one specific job in a strictly ordered sequence. If any check fails, the chain can short-circuit with a 401/403. Then I zoom into the real authentication flow: how UsernamePasswordAuthenticationFilter extracts username/password, creates a UsernamePasswordAuthenticationToken (with authenticated=false), and hands it to the AuthenticationManager (ProviderManager). From there, DaoAuthenticationProvider loads the user via UserDetailsService (in my default demo, InMemoryUserDetailsManager) and verifies the raw password against the hashed one using PasswordEncoder. On success, Spring creates a new authenticated token (without exposing the password) and stores it in the SecurityContext. Finally, I show how subsequent requests can bypass re-authentication in a session-based setup, and how the AuthorizationFilter (often the last gate) decides whether you get through to the controller or get blocked with “access denied.”