Springboot Security

by affaan-mef648e01899bNo license275K starsListed Oct 8, 2026Updated Oct 8, 2026Repository updated 3 days ago

Buenas prácticas de Spring Security para autenticación/autorización, validación, CSRF, secretos, cabeceras, limitación de velocidad y seguridad de dependencias en servicios Java Spring Boot.

Instructions onlySecurity

AI-generated overview

Spring Boot security guidance covering authentication, authorization, validation, CSRF, secrets, headers, rate limiting and dependency scanning.

What it does: Provides a Spanish-language reference checklist and code examples for hardening Java Spring Boot services. It covers JWT and session authentication, method-level authorization, Bean Validation, SQL injection prevention, password hashing, CSRF posture, secret externalization, security headers, CORS, rate limiting, dependency scanning, logging/PII and file uploads. It ends with a pre-launch checklist; it produces guidance rather than runnable artifacts.
When to use it: Use when adding authentication or authorization to a Spring Boot service, handling user input, creating endpoints, or working with secrets. Also relevant when configuring CORS, CSRF, security headers, rate limiting, or scanning dependencies for CVEs.
Requirements: No scripts or tooling are shipped; it is instructions only. Applying the examples assumes a Java Spring Boot project with Spring Security, and mentions optional libraries such as Bucket4j, Spring Cloud Vault, OWASP Dependency Check and Snyk.

Revisión de Seguridad Spring Boot

Usar al agregar autenticación, manejar entradas, crear endpoints o trabajar con secretos.

Cuándo Activar

Agregar autenticación (JWT, OAuth2, basada en sesión)
Implementar autorización (@PreAuthorize, control de acceso basado en roles)
Validar entrada de usuario (Bean Validation, validadores personalizados)
Configurar CORS, CSRF o cabeceras de seguridad
Gestionar secretos (Vault, variables de entorno)
Agregar limitación de velocidad o protección contra fuerza bruta
Escanear dependencias por CVEs

Autenticación

Preferir JWT sin estado o tokens opacos con lista de revocación
Usar cookies httpOnly, Secure, SameSite=Strict para sesiones
Validar tokens con OncePerRequestFilter o resource server

java

@Componentpublic class JwtAuthFilter extends OncePerRequestFilter {  private final JwtService jwtService;
  public JwtAuthFilter(JwtService jwtService) {    this.jwtService = jwtService;  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String header = request.getHeader(HttpHeaders.AUTHORIZATION);    if (header != null && header.startsWith("Bearer ")) {      String token = header.substring(7);      Authentication auth = jwtService.authenticate(token);      SecurityContextHolder.getContext().setAuthentication(auth);    }    chain.doFilter(request, response);  }}

@Componentpublic class JwtAuthFilter extends OncePerRequestFilter {  private final JwtService jwtService;
  public JwtAuthFilter(JwtService jwtService) {    this.jwtService = jwtService;  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String header = request.getHeader(HttpHeaders.AUTHORIZATION);    if (header != null && header.startsWith("Bearer ")) {      String token = header.substring(7);      Authentication auth = jwtService.authenticate(token);      SecurityContextHolder.getContext().setAuthentication(auth);    }    chain.doFilter(request, response);  }}

Autorización

Habilitar seguridad de métodos: @EnableMethodSecurity
Usar @PreAuthorize("hasRole('ADMIN')") o @PreAuthorize("@authz.canEdit(#id)")
Denegar por defecto; exponer solo los scopes requeridos

java

@RestController@RequestMapping("/api/admin")public class AdminController {
  @PreAuthorize("hasRole('ADMIN')")  @GetMapping("/users")  public List<UserDto> listUsers() {    return userService.findAll();  }
  @PreAuthorize("@authz.isOwner(#id, authentication)")  @DeleteMapping("/users/{id}")  public ResponseEntity<Void> deleteUser(@PathVariable Long id) {    userService.delete(id);    return ResponseEntity.noContent().build();  }}

@RestController@RequestMapping("/api/admin")public class AdminController {
  @PreAuthorize("hasRole('ADMIN')")  @GetMapping("/users")  public List<UserDto> listUsers() {    return userService.findAll();  }
  @PreAuthorize("@authz.isOwner(#id, authentication)")  @DeleteMapping("/users/{id}")  public ResponseEntity<Void> deleteUser(@PathVariable Long id) {    userService.delete(id);    return ResponseEntity.noContent().build();  }}

Validación de Entrada

Usar Bean Validation con @Valid en controllers
Aplicar restricciones en DTOs: @NotBlank, @Email, @Size, validadores personalizados
Sanitizar cualquier HTML con lista blanca antes de renderizar

java

// MAL: Sin validación@PostMapping("/users")public User createUser(@RequestBody UserDto dto) {  return userService.create(dto);}
// BIEN: DTO validadopublic record CreateUserDto(    @NotBlank @Size(max = 100) String name,    @NotBlank @Email String email,    @NotNull @Min(0) @Max(150) Integer age) {}
@PostMapping("/users")public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {  return ResponseEntity.status(HttpStatus.CREATED)      .body(userService.create(dto));}

// MAL: Sin validación@PostMapping("/users")public User createUser(@RequestBody UserDto dto) {  return userService.create(dto);}
// BIEN: DTO validadopublic record CreateUserDto(    @NotBlank @Size(max = 100) String name,    @NotBlank @Email String email,    @NotNull @Min(0) @Max(150) Integer age) {}
@PostMapping("/users")public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {  return ResponseEntity.status(HttpStatus.CREATED)      .body(userService.create(dto));}

Prevención de Inyección SQL

Usar repositorios de Spring Data o consultas parametrizadas
Para consultas nativas, usar bindings :param; nunca concatenar cadenas

java

// MAL: Concatenación de cadenas en consulta nativa@Query(value = "SELECT * FROM users WHERE name = '" + name + "'", nativeQuery = true)
// BIEN: Consulta nativa parametrizada@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)List<User> findByName(@Param("name") String name);
// BIEN: Consulta derivada de Spring Data (auto-parametrizada)List<User> findByEmailAndActiveTrue(String email);

// MAL: Concatenación de cadenas en consulta nativa@Query(value = "SELECT * FROM users WHERE name = '" + name + "'", nativeQuery = true)
// BIEN: Consulta nativa parametrizada@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)List<User> findByName(@Param("name") String name);
// BIEN: Consulta derivada de Spring Data (auto-parametrizada)List<User> findByEmailAndActiveTrue(String email);

Codificación de Contraseñas

Siempre hashear contraseñas con BCrypt o Argon2 — nunca almacenar en texto plano
Usar el bean PasswordEncoder, no hashing manual

java

@Beanpublic PasswordEncoder passwordEncoder() {  return new BCryptPasswordEncoder(12); // factor de costo 12}
// En el serviciopublic User register(CreateUserDto dto) {  String hashedPassword = passwordEncoder.encode(dto.password());  return userRepository.save(new User(dto.email(), hashedPassword));}

@Beanpublic PasswordEncoder passwordEncoder() {  return new BCryptPasswordEncoder(12); // factor de costo 12}
// En el serviciopublic User register(CreateUserDto dto) {  String hashedPassword = passwordEncoder.encode(dto.password());  return userRepository.save(new User(dto.email(), hashedPassword));}

Protección CSRF

Para aplicaciones de sesión de navegador, mantener CSRF habilitado; incluir token en formularios/cabeceras
Para APIs puras con tokens Bearer, deshabilitar CSRF y depender de autenticación sin estado

java

http  .csrf(csrf -> csrf.disable())  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

http  .csrf(csrf -> csrf.disable())  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

Gestión de Secretos

Sin secretos en el código fuente; cargar desde entorno o vault
Mantener application.yml libre de credenciales; usar marcadores de posición
Rotar tokens y credenciales de base de datos regularmente

yaml

# MAL: Hardcodeado en application.ymlspring:  datasource:    password: mySecretPassword123
# BIEN: Marcador de variable de entornospring:  datasource:    password: ${DB_PASSWORD}
# BIEN: Integración con Spring Cloud Vaultspring:  cloud:    vault:      uri: https://vault.example.com      token: ${VAULT_TOKEN}

# MAL: Hardcodeado en application.ymlspring:  datasource:    password: mySecretPassword123
# BIEN: Marcador de variable de entornospring:  datasource:    password: ${DB_PASSWORD}
# BIEN: Integración con Spring Cloud Vaultspring:  cloud:    vault:      uri: https://vault.example.com      token: ${VAULT_TOKEN}

Cabeceras de Seguridad

java

http  .headers(headers -> headers    .contentSecurityPolicy(csp -> csp      .policyDirectives("default-src 'self'"))    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)    .xssProtection(Customizer.withDefaults())    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

http  .headers(headers -> headers    .contentSecurityPolicy(csp -> csp      .policyDirectives("default-src 'self'"))    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)    .xssProtection(Customizer.withDefaults())    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

Configuración de CORS

Configurar CORS a nivel del filtro de seguridad, no por controller
Restringir orígenes permitidos — nunca usar * en producción

java

@Beanpublic CorsConfigurationSource corsConfigurationSource() {  CorsConfiguration config = new CorsConfiguration();  config.setAllowedOrigins(List.of("https://app.example.com"));  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));  config.setAllowedHeaders(List.of("Authorization", "Content-Type"));  config.setAllowCredentials(true);  config.setMaxAge(3600L);
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();  source.registerCorsConfiguration("/api/**", config);  return source;}
// En SecurityFilterChain:http.cors(cors -> cors.configurationSource(corsConfigurationSource()));

@Beanpublic CorsConfigurationSource corsConfigurationSource() {  CorsConfiguration config = new CorsConfiguration();  config.setAllowedOrigins(List.of("https://app.example.com"));  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));  config.setAllowedHeaders(List.of("Authorization", "Content-Type"));  config.setAllowCredentials(true);  config.setMaxAge(3600L);
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();  source.registerCorsConfiguration("/api/**", config);  return source;}
// En SecurityFilterChain:http.cors(cors -> cors.configurationSource(corsConfigurationSource()));

Limitación de Velocidad

Aplicar Bucket4j o límites a nivel de gateway en endpoints costosos
Registrar y alertar sobre ráfagas; retornar 429 con hints de reintento

java

// Usar Bucket4j para limitación de velocidad por endpoint@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  private Bucket createBucket() {    return Bucket.builder()        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))        .build();  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String clientIp = request.getRemoteAddr();    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());
    if (bucket.tryConsume(1)) {      chain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());      response.getWriter().write("{\"error\": \"Rate limit exceeded\"}");    }  }}

// Usar Bucket4j para limitación de velocidad por endpoint@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  private Bucket createBucket() {    return Bucket.builder()        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))        .build();  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String clientIp = request.getRemoteAddr();    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());
    if (bucket.tryConsume(1)) {      chain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());      response.getWriter().write("{\"error\": \"Rate limit exceeded\"}");    }  }}

Seguridad de Dependencias

Ejecutar OWASP Dependency Check / Snyk en CI
Mantener Spring Boot y Spring Security en versiones soportadas
Fallar builds ante CVEs conocidos

Logging y PII

Nunca registrar secretos, tokens, contraseñas ni datos PAN completos
Redactar campos sensibles; usar logging JSON estructurado

Subida de Archivos

Validar tamaño, tipo de contenido y extensión
Almacenar fuera del web root; escanear si es requerido

Lista de Verificación Antes del Lanzamiento

Recuerda: Denegar por defecto, validar entradas, privilegio mínimo y seguro por configuración primero.

Source and attribution

Source:affaan-m/eccindocs/es/skills/springboot-securityat commitef648e0

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

More from affaan-m/ecc

Vue Patterns

affaan-m

Reference guide for Vue 3 Composition API, component architecture, Pinia state, Vue Router, and Nuxt SSR patterns.

Software Development275Kupdated 3 days ago

Uncloud

affaan-m

Reference guide for managing Uncloud clusters with the uc CLI: deploying services, Caddy ingress, ports, scaling and logs.

DevOps & Cloud275Kupdated 3 days ago

Team Agent Orchestration

affaan-m

Coordinates multiple AI agents as a team using work items, Kanban states, branch isolation, and merge gates.

AI & Agents275Kupdated 3 days ago

Tasteforge Video

affaan-m

Use for file-driven multimodal image, video, and 3D-asset discovery; taste interviews; distill or apply workflows; style-pack validation; editable EDL/FCPXML export; provenance audits; and offline planning that must fail closed before provider generation.

Awaiting classification275Kupdated 3 days ago

Taste

affaan-m

Defines an angelcore / cloud-trance / hyperpop visual direction for music videos and short-form edits, with mood, editing grammar and a beat-mapped shot plan.

Design & Creative275Kupdated 3 days ago

Social Publisher

affaan-m

Schedules and publishes social media posts across 13 platforms through the SocialClaw workspace API.

Marketing & Sales275Kupdated 3 days ago

Springboot Security

Revisión de Seguridad Spring Boot

Cuándo Activar

Autenticación

Autorización

Validación de Entrada

Prevención de Inyección SQL

Codificación de Contraseñas

Protección CSRF

Gestión de Secretos

Cabeceras de Seguridad

Configuración de CORS

Limitación de Velocidad

Seguridad de Dependencias

Logging y PII

Subida de Archivos

Lista de Verificación Antes del Lanzamiento

Source and attribution

More from affaan-m/ecc

Vue Patterns

Uncloud

Team Agent Orchestration

Tasteforge Video

Taste

Social Publisher

More in Security

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate

Secops Hunt

Secops Cases