skills.rest
Femad-6
Femad-6COMMUNITY
Explore all skills by this author →
WebsiteGitHub

springboot-security

Reviews Spring Boot code for authentication, authorization, validation, and security configuration issues.

Updated Mar 25, 2026
Search Tags:#authentication#jwt#owasp#security review#java#spring boot#spring security
One-click install
npx skills add https://github.com/Femad-6/my-skills --skill springboot-security-femad-6
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: springboot-security
Source: https://github.com/Femad-6/my-skills/tree/main/.github/skills/springboot-security
Command: npx skills add https://github.com/Femad-6/my-skills --skill springboot-security-femad-6

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Spring Boot applications often ship with insecure defaults: missing authorization checks, unvalidated input, hardcoded secrets, and misconfigured CORS or CSRF. This Skill provides a structured security review checklist with concrete code patterns so you can catch vulnerabilities before release. ## Core Features & Use Cases - Authentication & Authorization Patterns: JWT filter implementation, method-level security with @PreAuthorize, and deny-by-default configuration. - Input Validation & Injection Prevention: Bean Validation on DTOs, parameterized queries, and password hashing with BCrypt. - Security Hardening: CSRF posture, security headers, CORS restrictions, rate limiting with Bucket4j, secrets externalization, and dependency CVE scanning. - Use Case: Before merging a new REST API, run a review to verify every endpoint has authorization guards, validated inputs, no string-concatenated SQL, and no secrets committed to application.yml. ## Quick Start Review my Spring Boot application for security issues including authentication, input validation, and secrets management.

Frequently Asked Questions about springboot-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication in Spring Boot?▼

Implement JWT authentication with a OncePerRequestFilter that extracts the Bearer token from the Authorization header, validates it through a JWT service, and sets the Authentication in the SecurityContextHolder. Configure the security filter chain as stateless with SessionCreationPolicy.STATELESS.

How to secure Spring Boot REST API endpoints with roles?▼

Enable method security with @EnableMethodSecurity and annotate endpoints with @PreAuthorize, such as @PreAuthorize("hasRole('ADMIN')") or custom expressions like @PreAuthorize("@authz.isOwner(#id, authentication)"). Deny access by default and expose only required scopes.

Should I disable CSRF in Spring Security for REST APIs?▼

Disable CSRF only for pure APIs using stateless Bearer token authentication, since CSRF attacks target cookie-based sessions. For browser session applications, keep CSRF enabled and include the token in forms or headers.

How do I prevent SQL injection in Spring Data JPA?▼

Use Spring Data derived queries or parameterized native queries with :param bindings via @Param annotations. Never concatenate user input into query strings, as that allows attackers to inject arbitrary SQL.

What password hashing should Spring Boot use?▼

Use BCrypt or Argon2 through a PasswordEncoder bean, such as new BCryptPasswordEncoder(12) with cost factor 12. Never store plaintext passwords or perform manual hashing in service code.

Why is allowing all CORS origins dangerous in production?▼

Using wildcard origins with allowed credentials lets any website make authenticated requests on behalf of your users. Configure a CorsConfigurationSource with an explicit list of allowed origins, methods, and headers, and register it at the security filter level.

Related Skills

Explore More Software Engineering Skills→
JeffallanJeffallan
10.9k

spring-boot-engineer

Automate building Spring Boot 3.x microservices with REST APIs and WebFlux.

Community
Advanced
rnavarychrnavarych
14

role-aqa:security-testing

Your response is missing. Please try again.

Community
Advanced
smart-village-solutionssmart-village-solutions
4

secrets-management

Manage secrets in CI/CD pipelines with rotation and access controls.

Official
Advanced
BagelHoleBagelHole
46

service-mesh

Configure Istio and Linkerd service meshes for traffic routing and mTLS.

Community
Intermediate