Spring security
Spring Security patterns — authentication, authorization, JWT, CORS, secrets management, OWASP scanning, security review for MVC and WebFlux applications. Use when configuring SecurityFilterChain or SecurityWebFilterChain, implementing JWT authentication, setting up CORS, applying method-level security, managing secrets, or reviewing OWASP compliance.From its SKILL.md
npx -y skills add taipt1504/agent-skills --skill spring-securityAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
2 things to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
- 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
5.2 KB, as published. Nobody here has run it
Spring Security
OWASP Top 10 Quick Rules
| Rule | Critical Pattern |
|---|---|
| No hardcoded secrets | @ConfigurationProperties + env vars / Vault |
| Parameterized queries | .bind("param", value) -- never concatenate SQL |
| Validate all inputs | @Valid @RequestBody + Bean Validation |
| JWT validation | Verify signature + expiry; Keys.hmacShaKeyFor() |
| CORS locked down | Explicit setAllowedOrigins(List.of("https://...")) |
| @JsonIgnore secrets | On passwordHash, creditCard in all domain objects |
| Generic error messages | Never expose stack traces, SQL errors, or keys |
| Rate limiting | Every endpoint -- 100 req/min default, stricter for sensitive ops |
| File type whitelist | Validate extension + magic bytes + size (max 5MB) |
| Path traversal | resolved.startsWith(uploadDir) before file reads |
Security Config
MVC — SecurityFilterChain, HttpSecurity, OncePerRequestFilter for JWT, @EnableWebSecurity, @EnableMethodSecurity.
WebFlux — SecurityWebFilterChain, ServerHttpSecurity, @EnableWebFluxSecurity, @EnableReactiveMethodSecurity, oauth2ResourceServer with JWT converter.
Both: CSRF disabled (stateless), stateless sessions, explicit CORS origins (never *), BCrypt >= 12.
Secrets Management
@ConfigurationPropertieswith@Validated— map${ENV_VAR}references- Never hardcode secrets; never commit
application-local.yml .gitignore:.env,*.pem,*.key,application-local.yml,application-secret.yml- Production: Vault / AWS Secrets Manager / K8s Secrets
Pre-Deployment Checklist
- No hardcoded secrets in source or git history
- JWT secret from env var; BCrypt cost >= 12
- CORS: explicit origins, no wildcards
-
@PreAuthorizeon sensitive methods -
@Validon all request bodies; file upload whitelist - Parameterized queries only (zero SQL concatenation)
- Rate limiting on auth + expensive endpoints
- Security headers: HSTS, X-Frame-Options, CSP, nosniff
- OWASP scan passes (
failBuildOnCVSS=7) - No PII/tokens/credentials in logs
- Actuator: only health/info public
- No
@Disabledsecurity tests
Anti-Patterns
// BAD: SQL injection
String sql = "SELECT * FROM users WHERE name = '" + name + "'";
// GOOD: databaseClient.sql("SELECT ... WHERE name = :name").bind("name", name)
// BAD: Secret in code
private static final String API_KEY = "sk-proj-xxxx";
// GOOD: @Value("${app.api-key}") private String apiKey;
// BAD: Wildcard CORS
config.setAllowedOrigins(List.of("*"));
// GOOD: config.setAllowedOrigins(List.of("https://app.example.com"));
// BAD: Exposing internals
return new ErrorResponse(ex.getMessage(), ex.getStackTrace());
// GOOD: ProblemDetail.forStatusAndDetail(500, "An unexpected error occurred");
References
- references/jwt-auth.md — JWT filter (MVC), SecurityFilterChain, SecurityWebFilterChain, token provider, method security
- references/oauth2-oidc.md — OAuth2 resource server, client credentials, principal extraction, Spring Security 6.x migration, mockJwt()
- references/cors-headers.md — CORS (MVC + WebFlux), security headers filter
- references/security-testing.md — MockMvc + WebTestClient security tests, OWASP dep scanning
- references/file-upload-secrets.md — File upload validation, path traversal, secrets management
Related Skills
- redis-patterns — Redis-based rate limiting
- spring-webflux-patterns — Resilience4j rate limiting, WebFilter setup
- pentest — Security scanning, OWASP Top 10 assessment
- summer-security — APISIX auth, Keycloak integration (Summer projects)