# Spring Security

> Use this skill when implementing or reviewing security in a Spring Boot application. Covers authentication, authorization, input validation, secure configuration, and API security best practices.

- Skill: `senoritadeveloper01/spring-security` (Agent Skill)
- Install (CLI): `npx skillmds@latest add senoritadeveloper01/spring-security`
- Raw SKILL.md: https://api.skillmd.com/api/skills/senoritadeveloper01/spring-security/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: senoritadeveloper01 (https://skillmd.com/u/senoritadeveloper01)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/senoritadeveloper01/spring-security

---


# Spring Security

## Scope
Apply this skill when working on:
- authentication and authorization
- Spring Security configuration
- API endpoint protection
- JWT or session-based security
- secure API design
- handling sensitive data

---

## Security Configuration

- Use Spring Security filter chain configuration.
- Prefer explicit configuration over defaults.
- Deny by default; explicitly allow public endpoints.
- Clearly separate public vs protected routes.

---

## Authentication

- Prefer stateless JWT or secure session-based authentication.
- Extract and validate tokens using filters (e.g., `OncePerRequestFilter`).
- Store tokens securely:
    - Prefer httpOnly cookies for browser apps
    - Avoid exposing tokens to JavaScript when possible
- Never store or log raw credentials.

---

## Authorization

- Enable method-level security (`@EnableMethodSecurity`).
- Use annotations like:
    - `@PreAuthorize("hasRole('ADMIN')")`
    - `@PreAuthorize("@authz.isOwner(#id)")`
- Enforce authorization at:
    - controller level (entry point)
    - service layer (critical logic)
- Always verify ownership or permissions before actions.

---

## HTTP Semantics & API Security

- Use correct status codes:
    - 401 → unauthenticated
    - 403 → authenticated but not authorized
- Never return 200 for security failures.
- Do not leak internal details in responses.
- Keep error responses consistent and minimal.

---

## Input Validation

- Validate all incoming data using Bean Validation (`@Valid`).
- Apply constraints:
    - `@NotBlank`, `@Email`, `@Size`, etc.
- Prefer allowlist validation.
- Reject invalid data early at API boundary.

---

## Injection Prevention

- Never concatenate SQL queries.
- Use:
    - Spring Data JPA
    - parameterized queries
- Avoid passing raw user input into execution contexts.

---

## Password & Credential Handling

- Always hash passwords using:
    - BCrypt or Argon2
- Never store plaintext passwords.
- Use `PasswordEncoder` bean.

---

## CSRF Protection

- For browser-based apps:
    - Keep CSRF enabled
    - include CSRF tokens
- For stateless APIs:
    - disable CSRF
    - rely on JWT/Bearer tokens

---

## CORS Configuration

- Configure CORS centrally (not per controller).
- Never use wildcard (`*`) in production.
- Restrict origins to trusted domains only.

---

## Security Headers

Always configure headers such as:
- Content-Security-Policy
- X-Frame-Options
- X-Content-Type-Options
- Referrer-Policy

These reduce XSS, clickjacking, and injection risks.

---

## Secrets Management

- Never hardcode secrets in code or config.
- Use:
    - environment variables
    - secret managers (Vault, cloud providers)
- Rotate credentials regularly.
- Do not expose secrets in logs or errors.

---

## Rate Limiting & Abuse Protection

- Apply rate limiting to API endpoints.
- Protect:
    - authentication endpoints
    - expensive operations
- Return HTTP 429 when limits are exceeded.

---

## Logging & Sensitive Data

- Never log:
    - passwords
    - tokens
    - secrets
- Log:
    - authentication attempts
    - authorization failures
- Keep logs structured and safe.

---

## File Upload Security

- Validate:
    - file size
    - file type
    - file extension
- Store files outside web root.
- Avoid executing uploaded content.

---

## Dependency Security

- Keep dependencies up to date.
- Scan for vulnerabilities (OWASP, Snyk).
- Do not use outdated Spring Security versions.

---

## Cloud & Infrastructure Awareness

- Follow least privilege principle for access control.
- Store secrets in managed services.
- Enable logging and monitoring.
- Avoid exposing services publicly unless required.

---

## Common Pitfalls

- Missing authorization checks
- Incorrect HTTP status codes
- Hardcoded secrets
- Logging sensitive data
- Using string-based SQL queries
- Overly permissive CORS
- Disabled security headers

---

## Output Expectations

When generating security-related code:
- configure Spring Security explicitly
- secure all endpoints by default
- validate all inputs
- use proper HTTP status codes
- avoid security anti-patterns
- highlight potential vulnerabilities if detected