Spring Boot Security Standards

Priority: P0 (CRITICAL)

Configure SecurityFilterChain

• Lambda DSL: ALWAYS use Lambda DSL.
• SecurityFilterChain: Expose as @Bean. not extend WebSecurityConfigurerAdapter.
• Statelessness: Enforce SessionCreationPolicy.STATELESS for REST APIs.

See implementation examples for SecurityFilterChain configuration with Lambda DSL and JWT.

Implement Authentication and Authorization

• Authentication: Validation of credentials (Who you?). Use AuthenticationManager or JwtDecoder.
• Authorization: Verification of access rights (Can you this?). Use @PreAuthorize.

Secure JWT Tokens