Spring Boot Security Standards

Priority: P0 (CRITICAL)

Implementation Guidelines

Configuration (Spring Security 6+)

• Lambda DSL: ALWAYS use Lambda DSL.
• SecurityFilterChain: Expose as @Bean. Do not extend WebSecurityConfigurerAdapter.
• Statelessness: Enforce SessionCreationPolicy.STATELESS for REST APIs.

Golden Snippet

See Security Configuration for full SecurityFilterChain example.

Authentication vs Authorization