Spring Security Properties to JSON Configuration

Spring Security Properties

Spring Security configuration in application.properties covers authentication, authorization, OAuth2 client settings, CORS policies, and session management. These properties often span many nested levels.

Example Properties

# OAuth2 Client Configuration
spring.security.oauth2.client.registration.google.client-id=your-client-id
spring.security.oauth2.client.registration.google.client-secret=your-secret
spring.security.oauth2.client.registration.google.scope=openid,profile,email
spring.security.oauth2.client.provider.google.authorization-uri=https://accounts.google.com/o/oauth2/auth
spring.security.oauth2.client.provider.google.token-uri=https://oauth2.googleapis.com/token

# Session Configuration
server.servlet.session.timeout=30m
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.same-site=strict

# CORS
management.endpoints.web.cors.allowed-origins=https://example.com
management.endpoints.web.cors.allowed-methods=GET,POST

Why Convert to JSON?

The deeply nested dot-notation in Spring Security properties can be difficult to read and debug. Converting to JSON reveals the hierarchical structure clearly:

{
  "spring": {
    "security": {
      "oauth2": {
        "client": {
          "registration": {
            "google": { ... }
          },
          "provider": {
            "google": { ... }
          }
        }
      }
    }
  }
}

This tree view makes it immediately obvious how OAuth2 registrations and providers relate to each other, which is hard to see in flat properties format. The JSON output can also be used as reference documentation or imported into security audit tools.