{"enrichment":{"faq":[{"a":"springboot-security guides you through production-ready patterns for hardening Spring Boot applications. Key practices include implementing stateless JWT or session-based authentication, enforcing method-level authorization controls, validating all user input, configuring CSRF and CORS policies correctly, using BCrypt for password encoding, externalizing secrets via vaults, setting protective response headers, implementing rate limiting, and scanning dependencies for CVE vulnerabilities before release.","q":"What are spring boot security best practices?"},{"a":"springboot-security covers stateless JWT authentication patterns for Spring Boot, including token generation, validation, and refresh mechanisms. It explains how to configure Spring Security filters to intercept and verify JWT tokens, manage token expiration, and integrate JWT with method-level authorization to control access based on user roles and permissions.","q":"How does springboot-security handle JWT authentication?"},{"a":"springboot-security teaches CSRF protection configuration through Spring Security's built-in mechanisms, including token-based CSRF defense, safe HTTP method handling, and proper header validation. It covers when to disable CSRF for stateless APIs and how to maintain protection for session-based applications.","q":"How do I configure CSRF protection in springboot-security?"},{"a":"springboot-security recommends BCrypt for password encoding in Spring Boot applications. It explains why BCrypt provides adaptive hashing with configurable work factors, demonstrates configuration in Spring Security, and covers best practices for salting and verifying passwords securely without storing plaintext credentials.","q":"What password encoding methods does springboot-security recommend?"},{"a":"springboot-security covers secure secrets management by externalizing sensitive data like database credentials and API keys outside application code. It guides configuration of Spring Boot to integrate with external vaults, environment variables, and property files with restricted access, preventing accidental exposure of PII and credentials in logs or version control.","q":"How does springboot-security address secrets management?"},{"a":"springboot-security addresses SQL injection prevention through parameterized queries with Spring Data, input validation frameworks, and output encoding. It covers file upload validation, sanitization of user input, and protective response headers that mitigate XSS, clickjacking, and other common vulnerabilities in Spring Boot APIs.","q":"Can springboot-security help prevent SQL injection and input attacks?"}],"shadow_tags":["token-validation","access-control","credential-storage","api-gateway-security","vulnerability-scanning","request-filtering","data-protection","authentication-flow","compliance-checklist"],"summary_rewrite":"This skill guides you through hardening Spring Boot applications with production-ready security patterns. It covers stateless JWT and session-based authentication, method-level authorization controls, input validation, CSRF and CORS configuration, secure password encoding, secrets externalization, protective response headers, rate limiting, and dependency vulnerability scanning."},"files":[{"bytes":8837,"path":"skills/springboot-security/SKILL.md","sha256":"531b57f7ae04cfb1d83cd4af2fe46433f274117bc16aa3e48e2bd741060db2aa","url":"https://skillfed.io/files/xu-xiang/everything-claude-code-zh/springboot-security/568d549a/SKILL.md"}],"id":"xu-xiang/everything-claude-code-zh/springboot-security","links":{"html":"https://skillfed.io/xu-xiang/everything-claude-code-zh/springboot-security","md":"https://skillfed.io/xu-xiang/everything-claude-code-zh/springboot-security.md","repo":"https://github.com/xu-xiang/everything-claude-code-zh"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":298,"language":"JavaScript","last_updated":"2026-03-05","license":"MIT","name":"springboot-security","publisher":"xu-xiang","stars":1767},"relations":{"similar":[{"id":"affaan-m/ECC/springboot-security"},{"id":"personamanagmentlayer/pcl/spring-boot-expert"},{"id":"bobmatnyc/claude-mpm-skills/spring-boot"},{"id":"manutej/luxor-claude-marketplace/spring-boot-development"},{"id":"giuseppe-trisciuoglio/developer-kit/spring-boot-security-jwt"},{"id":"affaan-m/ECC/quarkus-security"},{"id":"doccker/cc-use-exp/cc-java-dev"},{"id":"xu-xiang/everything-claude-code-zh/springboot-patterns"},{"id":"pluginagentmarketplace/custom-plugin-java/java-spring-boot"},{"id":"decebals/claude-code-java/security-audit"}]},"slug":{"owner":"xu-xiang","repo":"everything-claude-code-zh","skill":"springboot-security"},"version":"568d549a"}