skills.rest
taipt1504
taipt1504COMMUNITY
Explore all skills by this author →
GitHub

spring-security

Configure and validate Spring Security for MVC and WebFlux applications.

3|2|Updated Jan 16, 2026
Search Tags:#authorization#authentication#jwt#owasp#cors#secrets-management#spring-security
One-click install
npx skills add https://github.com/taipt1504/agent-skills --skill spring-security-taipt1504
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: spring-security
Source: https://github.com/taipt1504/agent-skills/tree/main/skills/spring-security
Command: npx skills add https://github.com/taipt1504/agent-skills --skill spring-security-taipt1504

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Helps developers avoid common and critical security misconfigurations in Java Spring applications by providing patterns, checks, and prescriptive fixes for authentication, authorization, CORS, secrets, and OWASP compliance.

Core Features & Use Cases

  • Authentication & Authorization: Guidance and examples for SecurityFilterChain, SecurityWebFilterChain, JWT filters, password hashing, and method-level access control.
  • JWT & OAuth2: Token provider and validation patterns, reactive and MVC examples, and migration notes for Spring Security 6.x.
  • CORS and Security Headers: Explicit origin configuration, preflight caching, and a security headers filter for HSTS, CSP, and nosniff.
  • Secrets & Pre-Deployment Checklist: Secrets-from-environment or Vault patterns, gitignore rules, OWASP dependency scanning, and production hardening checks.
  • Testing & Validation: MockMvc and WebTestClient test patterns, OWASP scan integration, and pre-deploy verification items.

Quick Start

Ask the spring-security skill to review my SecurityConfig and JWT setup, list critical vulnerabilities, and produce prioritized fixes with code or configuration changes.

Frequently Asked Questions about spring-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure JWT authentication in a Spring Security 6.x SecurityFilterChain?▼

Configure signature-verified JWT authentication in Spring Security 6.x by defining a SecurityFilterChain bean, adding a custom JWT filter to the chain, and validating tokens before processing requests. This applies to both MVC and WebFlux projects for stateless authorization.

What is the recommended way to lock down CORS origins in a Spring application?▼

Lock down CORS origins in Spring by explicitly defining allowed origins in your SecurityFilterChain configuration. This prevents wildcard origin usage and includes preflight caching settings to ensure strict cross-origin resource sharing policies.

Can I use method-level access control with Spring Security WebFlux?▼

Yes, you can apply method-level access control in Spring Security WebFlux using SecurityWebFilterChain configuration. This enables reactive authorization checks, ensuring users have specific permissions before executing methods within your resource server setup.

How do I set up an OAuth2 resource server with Spring Security?▼

Set up an OAuth2 resource server with Spring Security by configuring JWT or OAuth2 token validation within your SecurityFilterChain. This validates bearer tokens, enforces signature verification, and integrates seamlessly with MVC or WebFlux reactive endpoints.

What BCrypt password hashing cost should I use for Spring Security authentication?▼

Use BCrypt password hashing at the recommended cost factor provided by Spring Security patterns. This ensures secure password storage during authentication setup, protecting against brute-force attacks while maintaining acceptable application performance.

How do I integrate OWASP dependency scanning into a Spring Security pre-deployment checklist?▼

Integrate OWASP dependency scanning into your Spring Security pre-deployment checklist by configuring scans to fail on high CVSS vulnerabilities. Combine this with secrets-from-environment or Vault usage checks and gitignore rules for production hardening.

Related Skills

Explore More Software Engineering Skills→
glinckerglincker
35

environment-manager

Manage .env files, environment variables, and secrets across deployment stages.

Official
Advanced
dandudzidandudzi
2

springboot-security

Secure Spring Boot applications with JWT, OAuth2, and input validation.

Community
Advanced
rnavarychrnavarych
14

security-testing

Automate security testing with Snyk, Semgrep, Gitleaks, and OWASP ZAP in CI/CD pipelines.

Community
Advanced
petbrainspetbrains
13

backend-passport-js

Implement JWT, OAuth, or custom authentication middleware for Express.js applications.

Official
Intermediate