springboot-security
This skill guides you through hardening Spring Boot applications with production-ready security patterns. It covers stateless JWT and session-based authentication, method-level authorization controls, input validation, CSRF and CORS configuration, secure password encoding, secrets externalization, protective response headers, rate limiting, and dependency vulnerability scanning.
Spring Boot Security provides authentication, authorization, and input validation best practices for securing Spring Boot applications.
AI-generated summary based on this skill's SKILL.md
Install
xu-xiang/everything-claude-code-zh/springboot-security · repository language: JavaScript
git clone https://github.com/xu-xiang/everything-claude-code-zh
cp -r everything-claude-code-zh/skills/springboot-security ~/.claude/skills/springboot-securitynpx skillfed install xu-xiang/everything-claude-code-zh/springboot-securityFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are spring boot security best practices?
springboot-security guides you through production-ready patterns for hardening Spring Boot applications. Key practices include implementing stateless JWT or session-based authentication, enforcing method-level authorization controls, validating all user input, configuring CSRF and CORS policies correctly, using BCrypt for password encoding, externalizing secrets via vaults, setting protective response headers, implementing rate limiting, and scanning dependencies for CVE vulnerabilities before release.
How does springboot-security handle JWT authentication?
springboot-security covers stateless JWT authentication patterns for Spring Boot, including token generation, validation, and refresh mechanisms. It explains how to configure Spring Security filters to intercept and verify JWT tokens, manage token expiration, and integrate JWT with method-level authorization to control access based on user roles and permissions.
How do I configure CSRF protection in springboot-security?
springboot-security teaches CSRF protection configuration through Spring Security's built-in mechanisms, including token-based CSRF defense, safe HTTP method handling, and proper header validation. It covers when to disable CSRF for stateless APIs and how to maintain protection for session-based applications.
What password encoding methods does springboot-security recommend?
springboot-security recommends BCrypt for password encoding in Spring Boot applications. It explains why BCrypt provides adaptive hashing with configurable work factors, demonstrates configuration in Spring Security, and covers best practices for salting and verifying passwords securely without storing plaintext credentials.
How does springboot-security address secrets management?
springboot-security covers secure secrets management by externalizing sensitive data like database credentials and API keys outside application code. It guides configuration of Spring Boot to integrate with external vaults, environment variables, and property files with restricted access, preventing accidental exposure of PII and credentials in logs or version control.
Can springboot-security help prevent SQL injection and input attacks?
springboot-security addresses SQL injection prevention through parameterized queries with Spring Data, input validation frameworks, and output encoding. It covers file upload validation, sanitization of user input, and protective response headers that mitigate XSS, clickjacking, and other common vulnerabilities in Spring Boot APIs.
SKILL.md
rendered from the published skill — quoted content, verbatim
Spring Boot 安全审查（Security Review）
在添加身份验证（Auth）、处理输入、创建端点或处理机密信息时使用。
何时激活（When to Activate）
- 添加身份验证（JWT、OAuth2、基于 Session 的认证）
- 实现授权（
@PreAuthorize、基于角色的访问控制） - 校验用户输入（Bean Validation、自定义校验器）
- 配置 CORS、CSRF 或安全响应头
- 管理机密信息（Vault、环境变量）
- 添加速率限制（Rate Limiting）或暴力破解防护
- 扫描依赖项的 CVE 漏洞
身份验证（Authentication）
- 优先使用无状态 JWT 或带撤回列表的模糊令牌（Opaque Tokens）
- 为 Session 使用
httpOnly、Secure、SameSite=Strict属性的 Cookie - 使用
OncePerRequestFilter或资源服务器校验令牌
```java @Component public class JwtAuthFilter extends OncePerRequestFilter { private final JwtService jwtService;
public JwtAuthFilter(JwtService jwtService) { this.jwtService = jwtService; }
@Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { String header = request.getHeader(HttpHeaders.AUTHORIZATION); if (header != null && header.startsWith("Bearer ")) { String token = header.substring(7); Authentication auth = jwtService.authenticate(token);
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/springboot-security/SKILL.md