springboot-security

Spring Boot stateless authentication with JWT requires configuring token-based session management and OAuth2 resource servers. This Skill applies guardrails for JWT validation, stateless session policies, and secure API authentication across microservices.

Secrets management in Spring Boot should use environment-based injection rather than hardcoding values. This Skill enforces environment-based secrets configuration to prevent sensitive data exposure in source control and deployment artifacts.

CSRF protection and secure cookies in Spring Boot require applying specific security filter configurations and cookie attributes. This Skill provides secure defaults for cookies and CSRF handling tailored for both web apps and stateless APIs.

Spring Boot input validation requires bean validation annotations to enforce constraints and prevent injection attacks. This Skill enforces bean validation guardrails to ensure all API inputs are sanitized and validated before processing.

Security headers and CORS in Spring Boot microservices need explicit filter chain configuration to control cross-origin requests and prevent clickjacking. This Skill enforces security headers and CORS policies as part of its comprehensive security guardrails.

Spring Boot dependency scanning identifies vulnerable transitive libraries in your project's dependency tree. This Skill incorporates dependency security guidance to reduce risks from known vulnerabilities in third-party Java libraries.