skills.rest
ZzZueszZ
ZzZueszZCOMMUNITY
Explore all skills by this author →
GitHub

Spring Security

Configures Spring Security with JWT authentication, authorization, CORS, and method-level access control.

Updated May 12, 2026
Search Tags:#authorization#authentication#jwt#java#cors#spring boot#spring security
One-click install
npx skills add https://github.com/ZzZueszZ/claude-kit --skill spring-security-zzzueszz
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: Spring Security
Source: https://github.com/ZzZueszZ/claude-kit/tree/main/.claude/skills/spring-security
Command: npx skills add https://github.com/ZzZueszZ/claude-kit --skill spring-security-zzzueszz

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Setting up Spring Security correctly is error-prone: deprecated APIs, misconfigured CORS, weak password encoding, and inconsistent JWT handling lead to vulnerable Spring Boot APIs. This Skill provides standardized, production-oriented patterns for securing REST APIs. ## Core Features & Use Cases - SecurityFilterChain Configuration: Modern Spring Security 6+ setup with stateless sessions, CSRF handling, CORS, and role-based URL authorization. - JWT Authentication: Complete token provider, authentication filter, refresh token flow, and UserDetailsService implementation. - Method-Level Security: @PreAuthorize patterns with SpEL expressions and custom permission evaluators for fine-grained authorization. - Use Case: When building a new Spring Boot REST API, use this Skill to scaffold the full security layer—SecurityConfig, JWT filter, auth controller with register/login/refresh endpoints—following consistent best practices. ## Quick Start Ask the AI to set up JWT-based Spring Security for your Spring Boot project using the spring-security skill.

Frequently Asked Questions about Spring Security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I configure JWT authentication in Spring Boot?▼

Create a JwtTokenProvider to generate and validate tokens, a JwtAuthenticationFilter extending OncePerRequestFilter to extract the Bearer token, and register the filter before UsernamePasswordAuthenticationFilter in your SecurityFilterChain with stateless session management.

How to set up role-based authorization in Spring Security 6?▼

Use SecurityFilterChain with authorizeHttpRequests to map URL patterns to roles, such as requestMatchers("/api/v1/admin/**").hasRole("ADMIN"). Avoid the deprecated WebSecurityConfigurerAdapter and enable @EnableMethodSecurity for annotation-based control.

Should I use @PreAuthorize or @Secured for method security?▼

Prefer @PreAuthorize because it supports SpEL expressions for complex rules like checking the authenticated user's ID against a method parameter. @Secured only supports simple role checks without expression logic.

Why should CSRF be disabled for REST APIs?▼

CSRF protection targets browser session-based attacks, but stateless REST APIs using JWT Bearer tokens do not rely on cookies or sessions. Disabling CSRF is safe when every request carries an explicit Authorization header.

What password encoder should Spring Boot use?▼

Use BCryptPasswordEncoder with a strength factor of at least 12. BCrypt applies adaptive hashing with built-in salting, making it resistant to rainbow table and brute-force attacks, unlike plaintext or fast hashes like MD5.

Related Skills

Explore More Software Engineering Skills→
abudhahirabudhahir

spring-boot-engineer

Generate Spring Boot 3.x configurations, REST controllers, and Spring Security 6 authentication flows.

Community
Intermediate
cenjiecenjie

api-security-hardening

Secure REST APIs with authentication, rate limiting, CORS, and input validation.

Community
Advanced
fusenginefusengine
22

laravel-auth

Implement authentication and authorization for Laravel 12 applications.

Community
Advanced
rrezartprebrezarrezartprebreza
203

oauth2-resource-server

Configure Spring Security to validate JWTs and enforce scope-based access.

Community
Advanced