skills.rest
adamreger
adamregerCOMMUNITY
Explore all skills by this author →
GitHub

springboot-security

Reviews Spring Boot code for authentication, authorization, validation, and security misconfigurations.

2|Updated Feb 25, 2026
Search Tags:#authorization#authentication#jwt#security review#java#spring boot#spring security
One-click install
npx skills add https://github.com/adamreger/ecc-antigravity --skill springboot-security-adamreger
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: springboot-security
Source: https://github.com/adamreger/ecc-antigravity/tree/main/skills/springboot-security
Command: npx skills add https://github.com/adamreger/ecc-antigravity --skill springboot-security-adamreger

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Spring Boot applications frequently ship with insecure defaults: unvalidated inputs, hardcoded secrets, missing authorization checks, and misconfigured CORS or CSRF. This Skill provides a structured security review checklist with concrete code patterns so common vulnerabilities are caught before release. ## Core Features & Use Cases - Authentication & Authorization Patterns: JWT filter implementation, method-level security with @PreAuthorize, and deny-by-default access control. - Input & SQL Safety: Bean Validation on DTOs, parameterized queries, and password hashing with BCrypt to prevent injection and credential leaks. - Configuration Hardening: CSRF posture, security headers, CORS restrictions, secrets externalization, rate limiting with Bucket4j, and dependency CVE scanning. - Use Case: Before merging a new REST endpoint, run a review to confirm the controller validates its DTO with @Valid, enforces @PreAuthorize roles, avoids string-concatenated native queries, and returns proper security headers. ## Quick Start Review my Spring Boot controller and security configuration for authentication, validation, and secrets-handling issues.

Frequently Asked Questions about springboot-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I implement JWT authentication in Spring Boot?▼

Implement JWT authentication with a OncePerRequestFilter that extracts the Bearer token from the Authorization header, validates it through a JWT service, and sets the Authentication in the SecurityContextHolder. Prefer stateless sessions with token revocation support.

How to secure Spring Boot REST endpoints with role-based access?▼

Enable method security with @EnableMethodSecurity and annotate endpoints with @PreAuthorize, such as hasRole('ADMIN') or custom expressions like @authz.isOwner(#id, authentication). Deny access by default and expose only required scopes.

Should I disable CSRF in a Spring Boot REST API?▼

Disable CSRF only for pure APIs using stateless Bearer token authentication, since CSRF attacks target cookie-based sessions. For browser session applications, keep CSRF enabled and include the token in forms or headers.

How do I prevent SQL injection in Spring Data JPA?▼

Use Spring Data derived queries or parameterized native queries with :param bindings via @Param annotations. Never concatenate user input into query strings, as that bypasses the driver's escaping and enables injection.

Where should Spring Boot store database passwords and API secrets?▼

Never hardcode secrets in application.yml or source code. Reference environment variables with placeholders like ${DB_PASSWORD}, or integrate Spring Cloud Vault for centralized secret management, and rotate credentials regularly.

How do I add rate limiting to Spring Boot endpoints?▼

Use Bucket4j in a OncePerRequestFilter to create per-client token buckets, returning HTTP 429 when the limit is exceeded. Alternatively, enforce limits at the API gateway level and log bursts for alerting.

Related Skills

Explore More Software Engineering Skills→
ArMaTeCArMaTeC

spring-boot-engineer

Generates Spring Boot 3.x applications with REST controllers, JPA repositories, and Spring Security 6.

Community
Advanced
paulundpaulund

security-reviewer

Identify and report security vulnerabilities in code, configurations, and infrastructure.

Community
Advanced
garethdainegarethdaine

pii-detector-redactor

Detect and redact PII from documents with configurable styles and audit logs.

Community
Advanced
citytexicitytexi
1

kotlin-tooling-java-to-kotlin

Converts Java source files to idiomatic Kotlin with framework-aware annotation and API preservation.

Community
Advanced