springboot-security

Installation
Summary

Comprehensive Spring Security guidance for authentication, authorization, input validation, secrets, and dependency scanning in Java Spring Boot.

  • Covers authentication patterns (JWT, OAuth2, sessions with secure cookies), authorization via method security annotations, and token validation with filters
  • Includes input validation with Bean Validation constraints, SQL injection prevention through parameterized queries, and password hashing with BCrypt or Argon2
  • Provides CSRF, CORS, and security header configuration strategies tailored to stateless APIs versus browser-based sessions
  • Addresses secrets management via environment variables and Spring Cloud Vault, rate limiting with Bucket4j, and CVE scanning in CI pipelines
  • Includes pre-release checklist covering token expiration, authorization guards, input sanitization, and PII redaction in logs
SKILL.md

Spring Boot Security Review

Use when adding auth, handling input, creating endpoints, or dealing with secrets.

When to Activate

  • Adding authentication (JWT, OAuth2, session-based)
  • Implementing authorization (@PreAuthorize, role-based access)
  • Validating user input (Bean Validation, custom validators)
  • Configuring CORS, CSRF, or security headers
  • Managing secrets (Vault, environment variables)
  • Adding rate limiting or brute-force protection
  • Scanning dependencies for CVEs

Authentication

  • Prefer stateless JWT or opaque tokens with revocation list
  • Use httpOnly, Secure, SameSite=Strict cookies for sessions
  • Validate tokens with OncePerRequestFilter or resource server
Related skills
Installs
4.5K
GitHub Stars
179.7K
First Seen
Jan 30, 2026