How do I install the Spring Boot Security skill?

Run npx skillmds add majiayu000/spring-boot-security in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Spring Boot Security safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Spring Boot Security?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Spring Boot Security free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Spring Boot Security?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Spring Boot Security by majiayu000 — Agent Skill

Name: Spring Boot Security
Rating: 4.5 (4 reviews)
Author: majiayu000

Spring Boot Security

Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.

majiayu000 1596eb6 2 files · 4.2 KB Updated Sep 9, 2026 567 repo stars

File contents

Spring Security 7 for Spring Boot 4

Implements authentication and authorization with Spring Security 7's mandatory Lambda DSL.

Critical Breaking Changes

Removed API	Replacement	Status
`and()` method	Lambda DSL closures	Required
`authorizeRequests()`	`authorizeHttpRequests()`	Required
`antMatchers()`	`requestMatchers()`	Required
`WebSecurityConfigurerAdapter`	`SecurityFilterChain` bean	Required
`@EnableGlobalMethodSecurity`	`@EnableMethodSecurity`	Required

Core Workflow

Create SecurityFilterChain bean → Configure with Lambda DSL
Define authorization rules → authorizeHttpRequests() with requestMatchers()
Configure authentication → Form login, HTTP Basic, or OAuth2
Add method security → @EnableMethodSecurity + @PreAuthorize
Handle CORS/CSRF → Configure for REST APIs

Quick Patterns

See EXAMPLES.md for complete working examples including:

REST API Security with JWT/OAuth2 (Java + Kotlin)
Form Login with Session Security and CSRF
Method Security with @PreAuthorize and SpEL
CORS Configuration for cross-origin APIs
Password Encoder (Argon2 for Security 7)

Spring Boot 4 Specifics

Lambda DSL is mandatory (no and() chaining)
Argon2 password encoder: Argon2PasswordEncoder.defaultsForSpring7()
CSRF for SPAs: CookieCsrfTokenRepository.withHttpOnlyFalse()
@EnableMethodSecurity replaces @EnableGlobalMethodSecurity

Detailed References

Examples: See EXAMPLES.md for complete working code examples
Troubleshooting: See TROUBLESHOOTING.md for common issues and Boot 4 migration
Security Configuration: See references/SECURITY-CONFIG.md for complete SecurityFilterChain patterns
Authentication: See references/AUTHENTICATION.md for UserDetailsService, password encoding
JWT/OAuth2: See references/JWT-OAUTH2.md for resource server, token validation

Anti-Pattern Checklist

Anti-Pattern	Fix
Using `and()` chaining	Use Lambda DSL closures
`antMatchers()`	Replace with `requestMatchers()`
`authorizeRequests()`	Replace with `authorizeHttpRequests()`
CSRF disabled without JWT	Keep CSRF for session-based auth
Hardcoded credentials	Use environment variables or Secret Manager
`permitAll()` on sensitive endpoints	Audit all permit rules
Missing `authenticated()` default	End with `.anyRequest().authenticated()`

Critical Reminders

Lambda DSL is mandatory — No more and() chaining in Security 7
Order matters — More specific requestMatchers before general ones
CSRF for sessions — Only disable for stateless JWT APIs
Method security needs enabling — Add @EnableMethodSecurity
Test security configuration — Use @WithMockUser and JWT test support (see spring-boot-testing)

---name: spring-boot-securitydescription: Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.--- # Spring Security 7 for Spring Boot 4 Implements authentication and authorization with Spring Security 7's mandatory Lambda DSL. ## Critical Breaking Changes | Removed API | Replacement | Status | |-------------|-------------|--------| | `and()` method | Lambda DSL closures | **Required** | | `authorizeRequests()` | `authorizeHttpRequests()` | **Required** | | `antMatchers()` | `requestMatchers()` | **Required** | | `WebSecurityConfigurerAdapter` | `SecurityFilterChain` bean | **Required** | | `@EnableGlobalMethodSecurity` | `@EnableMethodSecurity` | **Required** | ## Core Workflow 1. **Create SecurityFilterChain bean** → Configure with Lambda DSL 2. **Define authorization rules** → `authorizeHttpRequests()` with `requestMatchers()` 3. **Configure authentication** → Form login, HTTP Basic, or OAuth2 4. **Add method security** → `@EnableMethodSecurity` + `@PreAuthorize` 5. **Handle CORS/CSRF** → Configure for REST APIs ## Quick Patterns See [EXAMPLES.md](EXAMPLES.md) for complete working examples including: - **REST API Security** with JWT/OAuth2 (Java + Kotlin) - **Form Login with Session Security** and CSRF - **Method Security** with @PreAuthorize and SpEL - **CORS Configuration** for cross-origin APIs - **Password Encoder** (Argon2 for Security 7) ## Spring Boot 4 Specifics - **Lambda DSL** is mandatory (no `and()` chaining) - **Argon2** password encoder: `Argon2PasswordEncoder.defaultsForSpring7()` - **CSRF for SPAs**: `CookieCsrfTokenRepository.withHttpOnlyFalse()` - **@EnableMethodSecurity** replaces `@EnableGlobalMethodSecurity` ## Detailed References - **Examples**: See [EXAMPLES.md](EXAMPLES.md) for complete working code examples - **Troubleshooting**: See [TROUBLESHOOTING.md](TROUBLESHOOTING.md) for common issues and Boot 4 migration - **Security Configuration**: See [references/SECURITY-CONFIG.md](references/SECURITY-CONFIG.md) for complete SecurityFilterChain patterns - **Authentication**: See [references/AUTHENTICATION.md](references/AUTHENTICATION.md) for UserDetailsService, password encoding - **JWT/OAuth2**: See [references/JWT-OAUTH2.md](references/JWT-OAUTH2.md) for resource server, token validation ## Anti-Pattern Checklist | Anti-Pattern | Fix | |--------------|-----| | Using `and()` chaining | Use Lambda DSL closures | | `antMatchers()` | Replace with `requestMatchers()` | | `authorizeRequests()` | Replace with `authorizeHttpRequests()` | | CSRF disabled without JWT | Keep CSRF for session-based auth | | Hardcoded credentials | Use environment variables or Secret Manager | | `permitAll()` on sensitive endpoints | Audit all permit rules | | Missing `authenticated()` default | End with `.anyRequest().authenticated()` | ## Critical Reminders 1. **Lambda DSL is mandatory** — No more `and()` chaining in Security 7 2. **Order matters** — More specific `requestMatchers` before general ones 3. **CSRF for sessions** — Only disable for stateless JWT APIs 4. **Method security needs enabling** — Add `@EnableMethodSecurity` 5. **Test security configuration** — Use `@WithMockUser` and JWT test support (see `spring-boot-testing`)

Frequently asked questions