Agent skill · software engineering · affaan-m
springboot-security
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
Why this skill is useful
Provides specific Spring Security patterns and Java code snippets that enhance security practices in Spring Boot applications.
What it needs
About 4k tokens when loaded. Last updated 2026-08-06. 238,342 stars on the source repository.
What this skill does
Spring Boot Security Review Use when adding auth, handling input, creating endpoints, or dealing with secrets. When to Activate Adding authentication (JWT, OAuth2, session-based) Implementing authorization (@PreAuthorize, role-based access) Validating user input (Bean Validation, custom validators) Configuring CORS, CSRF, or security headers Managing secrets (Vault, environment variables) Adding rate limiting or brute-force protection Scanning dependencies for CVEs Authentication Prefer stateless JWT or opaque tokens with revocation list Use httpOnly, Secure, SameSite=Strict cookies for sessions Validate tokens with OncePerRequestFilter or resource server Authorization Enable method security: @EnableMethodSecurity Use @PreAuthorize("hasRole('ADMIN')") or @PreAuthorize("@authz.canEdit(#id)") Deny by default; expose only required scopes Input Validation Use Bean Validation with @Valid on controllers Apply constraints on DTOs: @NotBlank, @Email, @Size, custom validators Sanitize any HTML with a whitelist before rendering SQL Injection Prevention Use Spring Data repositories or parameterized queries For native queries, use :param bindings; never concatenate strings Password Encoding Always hash passwords with BCrypt or Argon2 — never store plaintext Use PasswordEncoder bean, not manual hashing CSRF Protection For browser session apps, keep CSRF enabled; include token in forms/headers For pure APIs with Bearer tokens, disable CSRF and rely on stateless auth Secrets Management No secrets in source; load from env or vault Keep application.yml free of credentials; use placeholders Rotate tokens and DB credentials regularly Security Headers CORS Configuration Configure CORS at the security filter level, not per-controller Restrict allowed origins — never use in production Rate Limiting Apply Bucket4j or gateway-level limits on expensive endpoints Log and alert on bursts; return 429 with retry hints Dependency Security Run OWASP Dependency Check / Snyk in CI Keep Spring Boot …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills affaan-m/springboot-security--10473b