diff --git a/pom.xml b/pom.xml
index 0bd8136a356ef2c0d48a0ef12f222dfdd04b1db5..f44028cea0bd670c573d741628af1d4247c024a9 100644
--- a/pom.xml
+++ b/pom.xml
@@ -18,6 +18,13 @@
         <java.version>17</java.version>
     </properties>
     <dependencies>
+        <!-- https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-starter-security -->
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+            <version>3.2.0</version>
+        </dependency>
+
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-actuator</artifactId>
diff --git a/src/main/java/fr/but3/tp509/Security.java b/src/main/java/fr/but3/tp509/Security.java
new file mode 100644
index 0000000000000000000000000000000000000000..720cbec725bbaf8c746249029bdc3e005e9240dd
--- /dev/null
+++ b/src/main/java/fr/but3/tp509/Security.java
@@ -0,0 +1,60 @@
+package fr.but3.tp509;
+
+import jakarta.servlet.DispatcherType;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.security.config.Customizer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.provisioning.JdbcUserDetailsManager;
+import org.springframework.security.web.SecurityFilterChain;
+import org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher;
+import org.springframework.web.servlet.handler.HandlerMappingIntrospector;
+
+import javax.sql.DataSource;
+
+@Configuration
+@EnableWebSecurity
+public class Security {
+
+    @Autowired
+    DataSource dataSource;
+
+    @Bean
+    public JdbcUserDetailsManager udm() {
+        return new JdbcUserDetailsManager(dataSource);
+    }
+
+    @Bean
+    public SecurityFilterChain mesautorisations(HttpSecurity http, HandlerMappingIntrospector introspector) throws Exception {
+        MvcRequestMatcher.Builder mvc = new MvcRequestMatcher.Builder(introspector);
+        return http.authorizeHttpRequests((authorize) -> authorize.dispatcherTypeMatchers(DispatcherType.FORWARD)
+                                                                  .permitAll().requestMatchers(mvc.pattern("/"))
+                                                                  .permitAll().requestMatchers(mvc.pattern("/private"))
+                                                                  .authenticated().anyRequest().permitAll())
+                   .formLogin(Customizer.withDefaults()).logout((configurer) -> {
+                    configurer.logoutUrl("/logout").logoutSuccessUrl("/public");
+                }).rememberMe((configurer) -> configurer.useSecureCookie(true)).build();
+    }
+
+//    @Bean
+//    public UserDetailsService mesutilisateurs() {
+//        String usersByUsernameQuery = "select username, password, enabled from t1 where username = ?";
+//        String authsByUserQuery = "select username, authority from t2 where username = ?";
+//
+//        JdbcUserDetailsManager users = new JdbcUserDetailsManager(dataSource);
+//
+//        userDetailsManager.setUsersByUsernameQuery(usersByUsernameQuery);
+//        userDetailsManager.setAuthoritiesByUsernameQuery(authsByUserQuery);
+//
+//        return users;
+//    }
+
+//    @Bean
+//    public PasswordEncoder encoder() {
+//        return new BCryptPasswordEncoder();
+//    }
+//
+}
+// $2a$10$2OPCwbH78n9AdfuD5Nq8ROT4atyfguBGaoOAYGRZ2btdlj9lzu1DS
diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties
index a7bc00c35eee24b382e26e56dbe94caf9f0625fd..edbd1f8406e998d988797617f3ff41d0fb00bf47 100644
--- a/src/main/resources/application.properties
+++ b/src/main/resources/application.properties
@@ -9,4 +9,7 @@ spring.datasource.password=moi
 spring.jpa.show-sql=true
 ## Hibernate Properties
 # Hibernate ddl auto (create, create-drop, validate, update)
-spring.jpa.hibernate.ddl-auto=update
\ No newline at end of file
+spring.jpa.hibernate.ddl-auto=update
+# Security
+spring.security.user.name=user
+spring.security.user.password=000000
diff --git a/src/main/resources/data.sql b/src/main/resources/data.sql
new file mode 100644
index 0000000000000000000000000000000000000000..55ac83a47d32d21c0590a3dabbc3678ff4e0644d
--- /dev/null
+++ b/src/main/resources/data.sql
@@ -0,0 +1,11 @@
+truncate users cascade;
+truncate authorities cascade;
+
+insert into users values('john', '{bcrypt}$2a$10$2OPCwbH78n9AdfuD5Nq8ROT4atyfguBGaoOAYGRZ2btdlj9lzu1DS', true);
+insert into authorities values('john', 'ADMIN');
+
+INSERT INTO users VALUES ('paul','{MD5}6c63212ab48e8401eaf6b59b95d816a9',TRUE);
+INSERT INTO users VALUES ('pierre','{noop}pierre',TRUE);
+
+INSERT INTO authorities VALUES ('paul', 'USER');
+INSERT INTO authorities VALUES ('pierre', 'USER');
diff --git a/src/main/resources/schema.sql b/src/main/resources/schema.sql
new file mode 100644
index 0000000000000000000000000000000000000000..3911c8e603cee526dc039fe6a61ea5538b776016
--- /dev/null
+++ b/src/main/resources/schema.sql
@@ -0,0 +1,15 @@
+DROP TABLE IF EXISTS authorities CASCADE;
+DROP TABLE IF EXISTS users CASCADE;
+
+CREATE TABLE users(
+    username VARCHAR(50) NOT NULL,
+    password VARCHAR(100) NOT NULL,
+    enabled BOOLEAN NOT NULL DEFAULT TRUE,
+    PRIMARY KEY (username)
+);
+
+CREATE TABLE authorities(
+    username VARCHAR(50) NOT NULL,
+    authority VARCHAR(50) NOT NULL,
+    FOREIGN KEY (username) REFERENCES users (username)
+)
\ No newline at end of file
diff --git a/src/main/webapp/WEB-INF/jsp/private/v2.jsp b/src/main/webapp/WEB-INF/jsp/private/v2.jsp
index 298ad00dc0e35a6388c0dff03b1a3d3fe7040f9c..cf43be9a1df16df9475be23a9476105043d6cbc0 100644
--- a/src/main/webapp/WEB-INF/jsp/private/v2.jsp
+++ b/src/main/webapp/WEB-INF/jsp/private/v2.jsp
@@ -3,6 +3,6 @@
         <title>V2</title>
     </head>
     <body>
-        <h1>Cette page est privée</h1>
+        <h1>Cette page est privée: <%= request.getRemoteUser() %></h1>
     </body>
 </html>
diff --git a/src/main/webapp/WEB-INF/jsp/public/v1.jsp b/src/main/webapp/WEB-INF/jsp/public/v1.jsp
index a2b188f36c8daeac3dac44b33b9154b63f435d55..e71e0c17cee15cbf1073970caaf9173abcf0b589 100644
--- a/src/main/webapp/WEB-INF/jsp/public/v1.jsp
+++ b/src/main/webapp/WEB-INF/jsp/public/v1.jsp
@@ -3,6 +3,6 @@
         <title>V1</title>
     </head>
     <body>
-        <h1>V1</h1>
+        <h1>V1: <%= request.getRemoteUser() %></h1>
     </body>
 </html>
\ No newline at end of file