Springboot Security

affaan-m/ECC/.kiro/skills/springboot-security

by affaan-mef648e01899ba3e8dc6371642deaaf64b4477775No license275K starsListed Oct 9, 2026Updated Oct 9, 2026Repository updated 4 days ago

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

Instructions onlySecurity

AI-generated overview

Spring Boot security review guidance covering authentication, authorization, validation, CSRF, secrets, headers, rate limiting and dependency checks.

What it does: This skill provides a review checklist and code patterns for securing Java Spring Boot services. It covers authentication filters, method-level authorization, input validation, SQL injection prevention, password encoding, CSRF posture, secrets externalization, security headers, CORS, rate limiting, dependency scanning, logging hygiene and file uploads. It produces guidance and annotated Java and YAML examples rather than executable artifacts.
When to use it: Use it when adding authentication or authorization to a Spring Boot service, handling user input, creating endpoints, or managing secrets. It also fits reviews of CORS, CSRF, security headers, rate limiting and dependency vulnerabilities before release.
Requirements: No scripts or tooling are required; it is instructions only. The examples assume a Java Spring Boot project with Spring Security, and mention optional libraries and services such as Bucket4j, Spring Cloud Vault, OWASP Dependency Check and Snyk.

Spring Boot Security Review

Use when adding auth, handling input, creating endpoints, or dealing with secrets.

When to Activate

Adding authentication (JWT, OAuth2, session-based)
Implementing authorization (@PreAuthorize, role-based access)
Validating user input (Bean Validation, custom validators)
Configuring CORS, CSRF, or security headers
Managing secrets (Vault, environment variables)
Adding rate limiting or brute-force protection
Scanning dependencies for CVEs

Authentication

Prefer stateless JWT or opaque tokens with revocation list
Use httpOnly, Secure, SameSite=Strict cookies for sessions
Validate tokens with OncePerRequestFilter or resource server

java

@Componentpublic class JwtAuthFilter extends OncePerRequestFilter {  private final JwtService jwtService;
  public JwtAuthFilter(JwtService jwtService) {    this.jwtService = jwtService;  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String header = request.getHeader(HttpHeaders.AUTHORIZATION);    if (header != null && header.startsWith("Bearer ")) {      String token = header.substring(7);      Authentication auth = jwtService.authenticate(token);      SecurityContextHolder.getContext().setAuthentication(auth);    }    chain.doFilter(request, response);  }}

@Componentpublic class JwtAuthFilter extends OncePerRequestFilter {  private final JwtService jwtService;
  public JwtAuthFilter(JwtService jwtService) {    this.jwtService = jwtService;  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String header = request.getHeader(HttpHeaders.AUTHORIZATION);    if (header != null && header.startsWith("Bearer ")) {      String token = header.substring(7);      Authentication auth = jwtService.authenticate(token);      SecurityContextHolder.getContext().setAuthentication(auth);    }    chain.doFilter(request, response);  }}

Authorization

Enable method security: @EnableMethodSecurity
Use @PreAuthorize("hasRole('ADMIN')") or @PreAuthorize("@authz.canEdit(#id)")
Deny by default; expose only required scopes

java

@RestController@RequestMapping("/api/admin")public class AdminController {
  @PreAuthorize("hasRole('ADMIN')")  @GetMapping("/users")  public List<UserDto> listUsers() {    return userService.findAll();  }
  @PreAuthorize("@authz.isOwner(#id, authentication)")  @DeleteMapping("/users/{id}")  public ResponseEntity<Void> deleteUser(@PathVariable Long id) {    userService.delete(id);    return ResponseEntity.noContent().build();  }}

@RestController@RequestMapping("/api/admin")public class AdminController {
  @PreAuthorize("hasRole('ADMIN')")  @GetMapping("/users")  public List<UserDto> listUsers() {    return userService.findAll();  }
  @PreAuthorize("@authz.isOwner(#id, authentication)")  @DeleteMapping("/users/{id}")  public ResponseEntity<Void> deleteUser(@PathVariable Long id) {    userService.delete(id);    return ResponseEntity.noContent().build();  }}

Input Validation

Use Bean Validation with @Valid on controllers
Apply constraints on DTOs: @NotBlank, @Email, @Size, custom validators
Sanitize any HTML with a whitelist before rendering

java

// BAD: No validation@PostMapping("/users")public User createUser(@RequestBody UserDto dto) {  return userService.create(dto);}
// GOOD: Validated DTOpublic record CreateUserDto(    @NotBlank @Size(max = 100) String name,    @NotBlank @Email String email,    @NotNull @Min(0) @Max(150) Integer age) {}
@PostMapping("/users")public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {  return ResponseEntity.status(HttpStatus.CREATED)      .body(userService.create(dto));}

// BAD: No validation@PostMapping("/users")public User createUser(@RequestBody UserDto dto) {  return userService.create(dto);}
// GOOD: Validated DTOpublic record CreateUserDto(    @NotBlank @Size(max = 100) String name,    @NotBlank @Email String email,    @NotNull @Min(0) @Max(150) Integer age) {}
@PostMapping("/users")public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {  return ResponseEntity.status(HttpStatus.CREATED)      .body(userService.create(dto));}

SQL Injection Prevention

Use Spring Data repositories or parameterized queries
For native queries, use :param bindings; never concatenate strings

java

// BAD: String concatenation with EntityManager (SQL injection risk)String sql = "SELECT * FROM users WHERE name = '" + name + "'";List<User> users = entityManager.createNativeQuery(sql, User.class).getResultList();
// GOOD: Parameterized native query@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)List<User> findByName(@Param("name") String name);
// GOOD: Spring Data derived query (auto-parameterized)List<User> findByEmailAndActiveTrue(String email);

// BAD: String concatenation with EntityManager (SQL injection risk)String sql = "SELECT * FROM users WHERE name = '" + name + "'";List<User> users = entityManager.createNativeQuery(sql, User.class).getResultList();
// GOOD: Parameterized native query@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)List<User> findByName(@Param("name") String name);
// GOOD: Spring Data derived query (auto-parameterized)List<User> findByEmailAndActiveTrue(String email);

Password Encoding

Always hash passwords with BCrypt or Argon2 — never store plaintext
Use PasswordEncoder bean, not manual hashing

java

@Beanpublic PasswordEncoder passwordEncoder() {  return new BCryptPasswordEncoder(12); // cost factor 12}
// In servicepublic User register(CreateUserDto dto) {  String hashedPassword = passwordEncoder.encode(dto.password());  return userRepository.save(new User(dto.email(), hashedPassword));}

@Beanpublic PasswordEncoder passwordEncoder() {  return new BCryptPasswordEncoder(12); // cost factor 12}
// In servicepublic User register(CreateUserDto dto) {  String hashedPassword = passwordEncoder.encode(dto.password());  return userRepository.save(new User(dto.email(), hashedPassword));}

CSRF Protection

For browser session apps, keep CSRF enabled; include token in forms/headers
For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth

java

http  .csrf(csrf -> csrf.disable())  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

http  .csrf(csrf -> csrf.disable())  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

Secrets Management

No secrets in source; load from env or vault
Keep application.yml free of credentials; use placeholders
Rotate tokens and DB credentials regularly

yaml

# BAD: Hardcoded in application.ymlspring:  datasource:    password: mySecretPassword123
# GOOD: Environment variable placeholderspring:  datasource:    password: ${DB_PASSWORD}
# GOOD: Spring Cloud Vault integrationspring:  cloud:    vault:      uri: https://vault.example.com      token: ${VAULT_TOKEN}

# BAD: Hardcoded in application.ymlspring:  datasource:    password: mySecretPassword123
# GOOD: Environment variable placeholderspring:  datasource:    password: ${DB_PASSWORD}
# GOOD: Spring Cloud Vault integrationspring:  cloud:    vault:      uri: https://vault.example.com      token: ${VAULT_TOKEN}

Security Headers

java

http  .headers(headers -> headers    .contentSecurityPolicy(csp -> csp      .policyDirectives("default-src 'self'"))    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)    .xssProtection(Customizer.withDefaults())    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

http  .headers(headers -> headers    .contentSecurityPolicy(csp -> csp      .policyDirectives("default-src 'self'"))    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)    .xssProtection(Customizer.withDefaults())    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

CORS Configuration

Configure CORS at the security filter level, not per-controller
Restrict allowed origins — never use * in production

java

@Beanpublic CorsConfigurationSource corsConfigurationSource() {  CorsConfiguration config = new CorsConfiguration();  config.setAllowedOrigins(List.of("https://app.example.com"));  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));  config.setAllowedHeaders(List.of("Authorization", "Content-Type"));  config.setAllowCredentials(true);  config.setMaxAge(3600L);
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();  source.registerCorsConfiguration("/api/**", config);  return source;}
// In SecurityFilterChain:http.cors(cors -> cors.configurationSource(corsConfigurationSource()));

@Beanpublic CorsConfigurationSource corsConfigurationSource() {  CorsConfiguration config = new CorsConfiguration();  config.setAllowedOrigins(List.of("https://app.example.com"));  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));  config.setAllowedHeaders(List.of("Authorization", "Content-Type"));  config.setAllowCredentials(true);  config.setMaxAge(3600L);
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();  source.registerCorsConfiguration("/api/**", config);  return source;}
// In SecurityFilterChain:http.cors(cors -> cors.configurationSource(corsConfigurationSource()));

Rate Limiting

Apply Bucket4j or gateway-level limits on expensive endpoints
Log and alert on bursts; return 429 with retry hints

java

// Using Bucket4j for per-endpoint rate limiting@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  private Bucket createBucket() {    return Bucket.builder()        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))        .build();  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String clientIp = request.getRemoteAddr();    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());
    if (bucket.tryConsume(1)) {      chain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());      response.getWriter().write("{\"error\": \"Rate limit exceeded\"}");    }  }}

// Using Bucket4j for per-endpoint rate limiting@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  private Bucket createBucket() {    return Bucket.builder()        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))        .build();  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String clientIp = request.getRemoteAddr();    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());
    if (bucket.tryConsume(1)) {      chain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());      response.getWriter().write("{\"error\": \"Rate limit exceeded\"}");    }  }}

Dependency Security

Run OWASP Dependency Check / Snyk in CI
Keep Spring Boot and Spring Security on supported versions
Fail builds on known CVEs

Logging and PII

Never log secrets, tokens, passwords, or full PAN data
Redact sensitive fields; use structured JSON logging

File Uploads

Validate size, content type, and extension
Store outside web root; scan if required

Checklist Before Release

Remember: Deny by default, validate inputs, least privilege, and secure-by-configuration first.

Source and attribution

Source:affaan-m/ECCin.kiro/skills/springboot-securityat commitef648e0

License: No license

Content belongs to its original authors. SourceWeft indexes it from a public repository.

Report or request removal

Springboot Security

Spring Boot Security Review

When to Activate

Authentication

Authorization

Input Validation

SQL Injection Prevention

Password Encoding

CSRF Protection

Secrets Management

Security Headers

CORS Configuration

Rate Limiting

Dependency Security

Logging and PII

File Uploads

Checklist Before Release

Source and attribution

More from affaan-m/ECC

Unified Notifications Ops

Verification Loop

Ui To Vue

Unified Memory

Visa Doc Translate

Team Builder

More in Security

Kyc Rules

Kyc Rules

Compliance Tracking

Dpop Adoption

Secops Triage

Secops Investigate