public final class OAuth2ResourceServerConfigurer

Sign-in with a bearer token on each request: the routes under the chain are an OAuth 2.0 resource server, and the token is a JWT.

@Bean
SecurityFilterChain api(HttpSecurity http) {
    http.securityMatcher("/api/**")
        .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/orders/**").hasAuthority("SCOPE_orders:read")
                .anyRequest().authenticated())
        .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
    return http.build();
}

With nothing more said, the tokens are verified by the application’s JwtDecoder bean, or else as these properties describe:

A request authenticated by its token is not asked for a CSRF token: a browser does not attach an Authorization header to a request another site made it send, which is the whole of what CSRF protection is against. No session is started for it either.

A token is refused with 401 and the reason in WWW-Authenticate; a good token that does not grant enough, with 403 and insufficient_scope. See BearerTokenAuthenticationEntryPoint and BearerTokenAccessDeniedHandler.