Springboot Security

affaan-m/ECC/.kiro/skills/springboot-security

作者 affaan-mef648e01899ba3e8dc6371642deaaf64b4477775无许可证275K 个星标收录于 2026年10月9日更新于 2026年10月9日仓库4天前更新

Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.

仅含说明Security

AI 生成的概览

Spring Boot 安全审查指南，涵盖认证、授权、校验、CSRF、密钥、响应头、限流与依赖检查。

功能: 该技能为 Java Spring Boot 服务的安全加固提供审查清单和代码模式。内容涵盖认证过滤器、方法级授权、输入校验、SQL 注入防护、密码编码、CSRF 策略、密钥外置、安全响应头、CORS、限流、依赖扫描、日志脱敏以及文件上传。产出的是指导说明和带注释的 Java、YAML 示例，而非可执行产物。
适用场景: 在为 Spring Boot 服务添加认证或授权、处理用户输入、创建接口或管理密钥时使用。也适用于发布前对 CORS、CSRF、安全响应头、限流和依赖漏洞的审查。
运行要求: 无需脚本或工具，仅为说明性内容。示例假定存在使用 Spring Security 的 Java Spring Boot 项目，并提及 Bucket4j、Spring Cloud Vault、OWASP Dependency Check 和 Snyk 等可选库与服务。

Spring Boot Security Review

Use when adding auth, handling input, creating endpoints, or dealing with secrets.

When to Activate

Adding authentication (JWT, OAuth2, session-based)
Implementing authorization (@PreAuthorize, role-based access)
Validating user input (Bean Validation, custom validators)
Configuring CORS, CSRF, or security headers
Managing secrets (Vault, environment variables)
Adding rate limiting or brute-force protection
Scanning dependencies for CVEs

Authentication

Prefer stateless JWT or opaque tokens with revocation list
Use httpOnly, Secure, SameSite=Strict cookies for sessions
Validate tokens with OncePerRequestFilter or resource server

java

@Componentpublic class JwtAuthFilter extends OncePerRequestFilter {  private final JwtService jwtService;
  public JwtAuthFilter(JwtService jwtService) {    this.jwtService = jwtService;  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String header = request.getHeader(HttpHeaders.AUTHORIZATION);    if (header != null && header.startsWith("Bearer ")) {      String token = header.substring(7);      Authentication auth = jwtService.authenticate(token);      SecurityContextHolder.getContext().setAuthentication(auth);    }    chain.doFilter(request, response);  }}

@Componentpublic class JwtAuthFilter extends OncePerRequestFilter {  private final JwtService jwtService;
  public JwtAuthFilter(JwtService jwtService) {    this.jwtService = jwtService;  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String header = request.getHeader(HttpHeaders.AUTHORIZATION);    if (header != null && header.startsWith("Bearer ")) {      String token = header.substring(7);      Authentication auth = jwtService.authenticate(token);      SecurityContextHolder.getContext().setAuthentication(auth);    }    chain.doFilter(request, response);  }}

Authorization

Enable method security: @EnableMethodSecurity
Use @PreAuthorize("hasRole('ADMIN')") or @PreAuthorize("@authz.canEdit(#id)")
Deny by default; expose only required scopes

java

@RestController@RequestMapping("/api/admin")public class AdminController {
  @PreAuthorize("hasRole('ADMIN')")  @GetMapping("/users")  public List<UserDto> listUsers() {    return userService.findAll();  }
  @PreAuthorize("@authz.isOwner(#id, authentication)")  @DeleteMapping("/users/{id}")  public ResponseEntity<Void> deleteUser(@PathVariable Long id) {    userService.delete(id);    return ResponseEntity.noContent().build();  }}

@RestController@RequestMapping("/api/admin")public class AdminController {
  @PreAuthorize("hasRole('ADMIN')")  @GetMapping("/users")  public List<UserDto> listUsers() {    return userService.findAll();  }
  @PreAuthorize("@authz.isOwner(#id, authentication)")  @DeleteMapping("/users/{id}")  public ResponseEntity<Void> deleteUser(@PathVariable Long id) {    userService.delete(id);    return ResponseEntity.noContent().build();  }}

Input Validation

Use Bean Validation with @Valid on controllers
Apply constraints on DTOs: @NotBlank, @Email, @Size, custom validators
Sanitize any HTML with a whitelist before rendering

java

// BAD: No validation@PostMapping("/users")public User createUser(@RequestBody UserDto dto) {  return userService.create(dto);}
// GOOD: Validated DTOpublic record CreateUserDto(    @NotBlank @Size(max = 100) String name,    @NotBlank @Email String email,    @NotNull @Min(0) @Max(150) Integer age) {}
@PostMapping("/users")public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {  return ResponseEntity.status(HttpStatus.CREATED)      .body(userService.create(dto));}

// BAD: No validation@PostMapping("/users")public User createUser(@RequestBody UserDto dto) {  return userService.create(dto);}
// GOOD: Validated DTOpublic record CreateUserDto(    @NotBlank @Size(max = 100) String name,    @NotBlank @Email String email,    @NotNull @Min(0) @Max(150) Integer age) {}
@PostMapping("/users")public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {  return ResponseEntity.status(HttpStatus.CREATED)      .body(userService.create(dto));}

SQL Injection Prevention

Use Spring Data repositories or parameterized queries
For native queries, use :param bindings; never concatenate strings

java

// BAD: String concatenation with EntityManager (SQL injection risk)String sql = "SELECT * FROM users WHERE name = '" + name + "'";List<User> users = entityManager.createNativeQuery(sql, User.class).getResultList();
// GOOD: Parameterized native query@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)List<User> findByName(@Param("name") String name);
// GOOD: Spring Data derived query (auto-parameterized)List<User> findByEmailAndActiveTrue(String email);

// BAD: String concatenation with EntityManager (SQL injection risk)String sql = "SELECT * FROM users WHERE name = '" + name + "'";List<User> users = entityManager.createNativeQuery(sql, User.class).getResultList();
// GOOD: Parameterized native query@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)List<User> findByName(@Param("name") String name);
// GOOD: Spring Data derived query (auto-parameterized)List<User> findByEmailAndActiveTrue(String email);

Password Encoding

Always hash passwords with BCrypt or Argon2 — never store plaintext
Use PasswordEncoder bean, not manual hashing

java

@Beanpublic PasswordEncoder passwordEncoder() {  return new BCryptPasswordEncoder(12); // cost factor 12}
// In servicepublic User register(CreateUserDto dto) {  String hashedPassword = passwordEncoder.encode(dto.password());  return userRepository.save(new User(dto.email(), hashedPassword));}

@Beanpublic PasswordEncoder passwordEncoder() {  return new BCryptPasswordEncoder(12); // cost factor 12}
// In servicepublic User register(CreateUserDto dto) {  String hashedPassword = passwordEncoder.encode(dto.password());  return userRepository.save(new User(dto.email(), hashedPassword));}

CSRF Protection

For browser session apps, keep CSRF enabled; include token in forms/headers
For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth

java

http  .csrf(csrf -> csrf.disable())  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

http  .csrf(csrf -> csrf.disable())  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

Secrets Management

No secrets in source; load from env or vault
Keep application.yml free of credentials; use placeholders
Rotate tokens and DB credentials regularly

yaml

# BAD: Hardcoded in application.ymlspring:  datasource:    password: mySecretPassword123
# GOOD: Environment variable placeholderspring:  datasource:    password: ${DB_PASSWORD}
# GOOD: Spring Cloud Vault integrationspring:  cloud:    vault:      uri: https://vault.example.com      token: ${VAULT_TOKEN}

# BAD: Hardcoded in application.ymlspring:  datasource:    password: mySecretPassword123
# GOOD: Environment variable placeholderspring:  datasource:    password: ${DB_PASSWORD}
# GOOD: Spring Cloud Vault integrationspring:  cloud:    vault:      uri: https://vault.example.com      token: ${VAULT_TOKEN}

Security Headers

java

http  .headers(headers -> headers    .contentSecurityPolicy(csp -> csp      .policyDirectives("default-src 'self'"))    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)    .xssProtection(Customizer.withDefaults())    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

http  .headers(headers -> headers    .contentSecurityPolicy(csp -> csp      .policyDirectives("default-src 'self'"))    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)    .xssProtection(Customizer.withDefaults())    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

CORS Configuration

Configure CORS at the security filter level, not per-controller
Restrict allowed origins — never use * in production

java

@Beanpublic CorsConfigurationSource corsConfigurationSource() {  CorsConfiguration config = new CorsConfiguration();  config.setAllowedOrigins(List.of("https://app.example.com"));  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));  config.setAllowedHeaders(List.of("Authorization", "Content-Type"));  config.setAllowCredentials(true);  config.setMaxAge(3600L);
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();  source.registerCorsConfiguration("/api/**", config);  return source;}
// In SecurityFilterChain:http.cors(cors -> cors.configurationSource(corsConfigurationSource()));

@Beanpublic CorsConfigurationSource corsConfigurationSource() {  CorsConfiguration config = new CorsConfiguration();  config.setAllowedOrigins(List.of("https://app.example.com"));  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));  config.setAllowedHeaders(List.of("Authorization", "Content-Type"));  config.setAllowCredentials(true);  config.setMaxAge(3600L);
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();  source.registerCorsConfiguration("/api/**", config);  return source;}
// In SecurityFilterChain:http.cors(cors -> cors.configurationSource(corsConfigurationSource()));

Rate Limiting

Apply Bucket4j or gateway-level limits on expensive endpoints
Log and alert on bursts; return 429 with retry hints

java

// Using Bucket4j for per-endpoint rate limiting@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  private Bucket createBucket() {    return Bucket.builder()        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))        .build();  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String clientIp = request.getRemoteAddr();    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());
    if (bucket.tryConsume(1)) {      chain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());      response.getWriter().write("{\"error\": \"Rate limit exceeded\"}");    }  }}

// Using Bucket4j for per-endpoint rate limiting@Componentpublic class RateLimitFilter extends OncePerRequestFilter {  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();
  private Bucket createBucket() {    return Bucket.builder()        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))        .build();  }
  @Override  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,      FilterChain chain) throws ServletException, IOException {    String clientIp = request.getRemoteAddr();    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());
    if (bucket.tryConsume(1)) {      chain.doFilter(request, response);    } else {      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());      response.getWriter().write("{\"error\": \"Rate limit exceeded\"}");    }  }}

Dependency Security

Run OWASP Dependency Check / Snyk in CI
Keep Spring Boot and Spring Security on supported versions
Fail builds on known CVEs

Logging and PII

Never log secrets, tokens, passwords, or full PAN data
Redact sensitive fields; use structured JSON logging

File Uploads

Validate size, content type, and extension
Store outside web root; scan if required

Checklist Before Release

Remember: Deny by default, validate inputs, least privilege, and secure-by-configuration first.

来源与署名

来源：affaan-m/ECC位于.kiro/skills/springboot-security提交ef648e0

许可证：无许可证

内容归原作者所有。SourceWeft 从公开仓库中收录这些内容。

举报或申请下架

Springboot Security

Spring Boot Security Review

When to Activate

Authentication

Authorization

Input Validation

SQL Injection Prevention

Password Encoding

CSRF Protection

Secrets Management

Security Headers

CORS Configuration

Rate Limiting

Dependency Security

Logging and PII

File Uploads

Checklist Before Release

来源与署名

更多来自 affaan-m/ECC 的技能

Unified Notifications Ops

Verification Loop

Ui To Vue

Unified Memory

Visa Doc Translate

Team Builder

更多Security技能

Kyc Rules

Kyc Rules

Compliance Tracking

Google Cloud Scc Remediation

Google Cloud Recipe Auth

Dpop Adoption