Agent skill

Spring Boot Security

Spring Security 6+ standards, Lambda DSL, and Hardening

View SKILL.md on GitHub Repository
Stars 163
Forks 31

Install this agent skill to your Project

npx add-skill https://github.com/majiayu000/claude-skill-registry/tree/main/skills/other/security-fierzone-agent-skills-standar

Metadata

Additional technical details for this skill

labels
spring-boot security oauth2 jwt
triggers 
{
    "files": [
        "**/*SecurityConfig.java",
        "**/*Filter.java"
    ],
    "keywords": [
        "security-filter-chain",
        "lambda-dsl",
        "csrf",
        "cors"
    ]
}

SKILL.md

Spring Boot Security Standards

Priority: P0 (CRITICAL)

Implementation Guidelines

Configuration (Spring Security 6+)

  • Lambda DSL: ALWAYS use Lambda DSL (.authorizeHttpRequests(auth -> ...)) for readability.
  • SecurityFilterChain: Expose as @Bean. Do not extend WebSecurityConfigurerAdapter.
  • Statelessness: Enforce SessionCreationPolicy.STATELESS for REST APIs.

JWT Best Practices

  • Algorithm: Enforce RS256 or HS256. Reject none algorithm explicitly in JWT configuration.
  • Claims: Validate iss, aud, and exp claims.
  • Tokens: Short-lived access tokens (15m), secure refresh tokens.

Hardening

  • CSRF: Disable for stateless APIs. Enable + Cookie for Browser Apps.
  • CORS: Explain allowed origins. NEVER use * with credentials.
  • Headers: Enable default headers (HSTS, Content-Type-Options).

Authorization

  • Method Security: Use @EnableMethodSecurity.
  • Annotations: Prefer @PreAuthorize over URL matching.

Anti-Patterns

  • Adapter Extension: **No Adapter**: Use SecurityFilterChain bean.
  • Chained Calls: **No .and()**: Use Lambda DSL.
  • Hardcoded Secrets: **No Secrets**: Use Vault/Env.
  • Legacy Matchers: **No antMatchers**: Use requestMatchers.

References

  • Implementation Examples

Related Topics

common/security-standards | architecture

Recommended Agent Skills

Expand your agent's capabilities with these related and highly-rated skills.

majiayu000/claude-skill-registry

agent-ops-spec

Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.

163 31
Explore
majiayu000/claude-skill-registry

agent-ops-state

Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.

163 31
Explore
majiayu000/claude-skill-registry

agent-ops-spec

Manage specification documents in .agent/specs/. Use when user provides requirements, acceptance criteria, or feature descriptions that need to be tracked and validated against implementation.

163 31
Explore
majiayu000/claude-skill-registry

agent-ops-testing

Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.

163 31
Explore
majiayu000/claude-skill-registry

agent-ops-testing

Test strategy, execution, and coverage analysis. Use when designing tests, running test suites, or analyzing test results beyond baseline checks.

163 31
Explore
majiayu000/claude-skill-registry

agent-ops-state

Maintain .agent state files. Use at session start, after meaningful steps, and before concluding: read/update constitution/memory/focus/issues/baseline consistently.

163 31
Explore

Didn't find tool you were looking for?

Be as detailed as possible for better results