skills.rest
zenobiuszeto
zenobiuszetoCOMMUNITY
Explore all skills by this author →
GitHub

spring-security

Configures Spring Boot 3.x APIs with OAuth2/JWT authentication and RBAC via @PreAuthorize and Authority mapping.

Updated Feb 25, 2026
Search Tags:#security#jwt#rbac#mtls#oauth2#keycloak#spring-security
One-click install
npx skills add https://github.com/zenobiuszeto/banking-strawman-capabilities --skill spring-security-zenobiuszeto
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: spring-security
Source: https://github.com/zenobiuszeto/banking-strawman-capabilities/tree/main/skills/spring-security
Command: npx skills add https://github.com/zenobiuszeto/banking-strawman-capabilities --skill spring-security-zenobiuszeto

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secures Java 21 / Spring Boot 3.x APIs by enforcing robust authentication, authorization, and auditable access controls to prevent unauthorized access, privilege escalation, and token misuse in a banking-grade backend.

Core Features & Use Cases

  • OAuth2 Resource Server (JWT): Validate bearer tokens via jwk-set-uri or issuer-uri for stateless API authentication.
  • Role-Based Access Control (RBAC): Map token roles to Spring authorities and enforce method- and endpoint-level restrictions with @PreAuthorize and hasRole/hasAuthority.
  • Service-to-Service and Web Flows: Support client_credentials for machine-to-machine calls and authorization_code+PKCE for public clients, with optional opaque token introspection when immediate revocation is required.
  • Audit & Safety: Correlation ID propagation, strict SessionCreationPolicy.STATELESS, secure password hashing recommendations, and Terraform/Keycloak provisioning guidance for production setups.

Quick Start

Configure your Spring Boot app as an OAuth2 resource server using jwk-set-uri or issuer-uri, set SessionCreationPolicy.STATELESS, register a JwtAuthenticationConverter to map the roles claim to ROLE_ authorities, and protect /api/** endpoints with role-based rules.

Frequently Asked Questions about spring-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure Spring Boot APIs with OAuth2 and JWT authentication?▼

Secure Spring Boot APIs by configuring the app as an OAuth2 resource server, validating bearer tokens via jwk-set-uri or issuer-uri, and setting SessionCreationPolicy.STATELESS for stateless API authentication.

How do I enforce role-based access control in Spring Boot using JWT claims?▼

Enforce RBAC in Spring Boot by registering a JwtAuthenticationConverter to map token roles claims to GrantedAuthority, then applying @PreAuthorize with hasRole or hasAuthority on endpoints.

Does Spring Security support both client_credentials and authorization_code PKCE flows?▼

Spring Security supports client_credentials for machine-to-machine calls and authorization_code with PKCE for public clients, including optional opaque token introspection for immediate revocation requirements.

Can I use mTLS and Keycloak for banking-grade Spring Boot 3.x backend security?▼

Yes, this approach secures Java 21 and Spring Boot 3.x banking-grade backends using mTLS, ownership checks, and Terraform Keycloak provisioning guidance for auditable access controls and production setups.

What is the best way to prevent privilege escalation in Spring Boot OAuth2 resource servers?▼

Prevent privilege escalation by mapping token roles to strict Spring authorities, enforcing method- and endpoint-level restrictions, propagating correlation IDs, and applying stateless session policies across user and service accounts.

Related Skills

Explore More Software Engineering Skills→
rrezartprebrezarrezartprebreza
203

oauth2-resource-server

Configure Spring Security to validate JWTs and enforce scope-based access.

Community
Advanced
velcraftingvelcrafting
1

observability-audit

Standardize logs, metrics, and traces across backend changes.

Community
Intermediate
abudhahirabudhahir

spring-boot-engineer

Generate Spring Boot 3.x configurations, REST controllers, and Spring Security 6 authentication flows.

Community
Intermediate
ysyecustysyecust
40

springboot-security

Configure Spring Security best practices for Java Spring Boot services.

Community
Advanced