Springboot Security

Spring Boot Security

Rule: Every endpoint must be explicitly protected. No endpoint is public unless declared with permitAll() in SecurityConfig.

Before Starting

1. Check existing security setup in src/security/ and src/config/SecurityConfig.java:

   bash ~/.claude/skills/project-scan/scripts/scan.sh
   

2. Load references/security-patterns.md — permission model and guard patterns

Steps

Protecting an existing endpoint

1. Add @PreAuthorize to the controller method:

   @PreAuthorize("@permissionEvaluator.hasPermission(authentication, 'PERMISSION_NAME')")
   

2. Verify the permission exists in the AppPermission enum
3. Confirm the permission is assigned to the correct roles in the seeder or config

Setting up JWT from scratch

1. Add dependencies: spring-boot-starter-security, jjwt-api, jjwt-impl, jjwt-jackson
2. Create in src/security/: JwtFilter, JwtService, UserDetailsServiceImpl
3. Create SecurityConfig in src/config/ — define the filter chain and public routes
4. Add JWT_SECRET and JWT_EXPIRATION to application.yml via env vars — never hardcode
5. Run env-check to confirm vars are set:

   bash ~/.claude/skills/env-check/scripts/check-env.sh