springboot-security

Implement JWT authentication with a OncePerRequestFilter that extracts the Bearer token from the Authorization header, validates it through a JwtService, and sets the Authentication in SecurityContextHolder. Prefer stateless tokens with a revocation list for logout support.

Enable method security with @EnableMethodSecurity and annotate endpoints with @PreAuthorize("hasRole('ADMIN')") or custom expressions like @PreAuthorize("@authz.isOwner(#id, authentication)"). Deny by default and expose only required scopes.

Disable CSRF only for pure APIs using stateless Bearer token authentication, since CSRF attacks target cookie-based sessions. For browser apps with session cookies, keep CSRF enabled and include the token in forms or headers.

Use Spring Data derived queries or parameterized native queries with :param bindings via @Param annotations. Never concatenate user input into query strings, as that bypasses the driver's escaping and allows injection.

Use BCrypt or Argon2 through a PasswordEncoder bean, such as new BCryptPasswordEncoder(12) with cost factor 12. Never store plaintext passwords or use manual hashing outside the encoder abstraction.

Wildcard allowed origins (*) let any website make credentialed requests to your API, enabling cross-site data theft. Configure CORS at the security filter level with an explicit origin list, restricted methods, and credentials only where needed.