Spring Security's core building blocks—AuthenticationManager, SecurityContextHolder, and the SecurityFilterChain—stay the same whether you're using plain Spring MVC or Spring Boot; Boot just automates their wiring through auto-configuration and a dedicated starter dependency.
Key Points: • AuthenticationManager (typically via ProviderManager) performs the actual authentication check. • SecurityContextHolder stores the current Authentication for the duration of the request. • SecurityFilterChain (replacing the older WebSecurityConfigurerAdapter) defines the ordered filters and authorization rules. • UserDetailsService loads user-specific data used during authentication. • spring-boot-starter-security pulls in all necessary Spring Security dependencies and applies sensible auto-configured defaults, so manual dependency wiring like plain Spring MVC required isn't necessary.
Example: In plain Spring MVC, you'd manually wire an XML or Java-based security configuration; in Spring Boot, adding spring-boot-starter-security to the POM auto-configures a default login form and basic protection with almost no extra code.
Interview Tip: A concise interview answer is:
"The core classes—AuthenticationManager, SecurityContextHolder, and the SecurityFilterChain—are the same in Spring MVC and Spring Boot. Boot just simplifies setup through auto-configuration and the spring-boot-starter-security dependency, which pulls in everything needed instead of manually adding each Spring Security module."