skills.rest
dprice-dev
dprice-devCOMMUNITY
Explore all skills by this author →
GitHub

spring-security

Guide Spring Boot 4.x teams in applying Spring Security 7.x authentication and authorization patterns.

Updated Aug 23, 2026
Search Tags:#testing#jwt#securityfilterchain#spring security#oauth2 oidc#spring boot 4#method authorization
One-click install
npx skills add https://github.com/dprice-dev/claude-java-skills --skill spring-security-dprice-dev
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: spring-security
Source: https://github.com/dprice-dev/claude-java-skills/tree/main/.claude/skills/spring-security
Command: npx skills add https://github.com/dprice-dev/claude-java-skills --skill spring-security-dprice-dev

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

It helps you choose and reason about the right Spring Security authentication and authorization approach for a Spring Boot 4.x service, and it clarifies how method and filter-chain rules interact across your request and test pipeline.

Core Features & Use Cases

  • Authentication mode selection: Pick the right approach between JWT Resource Server, OAuth2 Client, Basic Auth, or gateway-validated JWT based on your system architecture.
  • SecurityFilterChain design guidance: Understand matcher ordering, stateless vs stateful session strategies, and where security gates sit in the servlet request pipeline.
  • Method-level authorization strategy: Apply @PreAuthorize/@PostAuthorize correctly (including custom evaluator beans) with an emphasis on placing rules in the service layer.
  • Test pyramid alignment: Decide what security tools belong in component, end-to-end, and acceptance tests to avoid fragile or incorrect security testing.

Quick Start

Ask the AI to review your current endpoints and your intended identity provider (or whether you have a gateway) and recommend the best SecurityFilterChain and test-layer strategy for Spring Boot 4.x.

Frequently Asked Questions about spring-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure a JWT resource server in Spring Boot 4?▼

Configure a JWT resource server in Spring Boot 4 by defining a SecurityFilterChain that validates JWTs statelessly. This Skill guides selecting the correct Spring Security 7.x pattern and matcher ordering for your request pipeline.

What is the best way to apply method-level authorization with Spring Security?▼

Apply method-level authorization using @PreAuthorize and @PostAuthorize annotations in your service layer. This Skill clarifies how to implement custom evaluator beans and explains how method rules interact with filter-chain gates.

Does this Skill support OAuth2 client and Basic Auth setups?▼

Yes, it supports OAuth2 OIDC client apps and Basic Auth. It helps you choose the right authentication mode between JWT, OAuth2, Basic Auth, or gateway-validated JWT based on your specific system architecture.

How do I test Spring Security rules across the test pyramid?▼

Test Spring Security rules by aligning tools with the test pyramid. This Skill provides requirements for security-specific test tooling across component, end-to-end, and acceptance layers to prevent fragile or incorrect test setups.

Why does SecurityFilterChain matcher ordering matter in Spring Security 7.x?▼

SecurityFilterChain matcher ordering matters because it dictates where security gates sit in the servlet request pipeline. Proper ordering ensures correct exception translation behavior and stateless versus stateful session strategies.

When should I use gateway-validated JWT instead of a JWT resource server?▼

Use gateway-validated JWT when an external gateway handles token validation before reaching your service. This Skill helps you decide between gateway-validated JWT and a native JWT resource server based on your architecture.

Related Skills

Explore More Software Engineering Skills→
scalekit-incscalekit-inc

implementing-scalekit-springboot-auth

Integrate Scalekit OIDC authentication into Spring Boot 3.x applications.

Official
Advanced
diShine-digital-agencydiShine-digital-agency
1

shine-test-strategy

Designs scalable pyramid-based test strategies with coverage targets and CI gating rules for unit, integration, and end-to-end tests.

Community
Intermediate
dallaydallay
1

spring-boot-actuator

Configure Spring Boot Actuator endpoints for monitoring, health checks, and metrics export.

Official
Advanced
infraspecdevinfraspecdev
3

backend-spring-security

Detect misconfigured Spring Security protection in Spring Boot 3.x application code.

Official
Advanced