springboot-security

Implement JWT authentication with a OncePerRequestFilter that extracts the Bearer token from the Authorization header, validates it through a JWT service, and sets the Authentication in the SecurityContextHolder. Configure the security filter chain as stateless with CSRF disabled for pure token-based APIs.

Enable method security with @EnableMethodSecurity and annotate endpoints with @PreAuthorize, such as hasRole('ADMIN') or custom expressions like @authz.isOwner(#id, authentication). Follow a deny-by-default policy and expose only the required scopes per endpoint.

Disable CSRF only for stateless APIs using Bearer tokens, since CSRF attacks rely on browser cookies. For browser session-based applications, keep CSRF enabled and include the token in forms or request headers.

Use Spring Data derived queries or parameterized native queries with :param bindings via @Param annotations. Never concatenate user input into query strings, as that bypasses the driver's escaping and allows injection.

Externalize secrets using environment variable placeholders like ${DB_PASSWORD} in application.yml, or integrate Spring Cloud Vault for centralized secret management. Never commit credentials to source control, and rotate tokens and database passwords regularly.

Use Bucket4j in a OncePerRequestFilter to create per-client-IP buckets with bandwidth limits, such as 100 requests per minute. Return HTTP 429 with an error message when the bucket is exhausted, and log bursts for alerting.