hoangnguyen0403/spring-boot-security
skills/spring-boot/spring-boot-security/SKILL.md
Configure Spring Security 6+ with Lambda DSL, JWT, and hardening rules. Use when configuring Spring Security 6+, OAuth2, JWT, or security hardening in Spring Boot.
$ install --global
skillsauthnpx skillsauth add hoangnguyen0403/agent-skills-standard spring-boot-securityInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 28, 2026, 2:42 AM123.7s3 files scanned
SKILL.md
- name:
- spring-boot-security
- description:
- Configure Spring Security 6+ with Lambda DSL, JWT, and hardening rules. Use when configuring Spring Security 6+, OAuth2, JWT, or security hardening in Spring Boot.
Spring Boot Security Standards
Priority: P0 (CRITICAL)
Configure SecurityFilterChain
- Lambda DSL: ALWAYS use Lambda DSL.
- SecurityFilterChain: Expose as
@Bean. not extendWebSecurityConfigurerAdapter. - Statelessness: Enforce
SessionCreationPolicy.STATELESSfor REST APIs.
See implementation examples for SecurityFilterChain configuration with Lambda DSL and JWT.
Implement Authentication and Authorization
- Authentication: Validation of credentials (Who you?). Use
AuthenticationManagerorJwtDecoder. - Authorization: Verification of access rights (Can you this?). Use
@PreAuthorize.
Secure JWT Tokens
- Algorithm: Enforce
RS256orHS256. Rejectnonealgorithm. - Claims: Validate
iss,aud, andexp. - Tokens: Short-lived access JWTs (15m), secure refresh tokens (httpOnly cookie).
Hardening Checklist
- [ ] CSRF: Disabled for pure APIs? Enabled + Cookie for Browser Apps?
- [ ] CORS: Specific origins permitted? No
*with credentials? - [ ] Headers: HSTS, Content-Type-Options, X-Frame-Options enabled?
- [ ] Secrets: No hardcoded keys? Loaded from Vault/Env?
- [ ] Rate Limiting: Applied on login/expensive endpoints?
- [ ] Dependencies: Scanned for CVEs?
Anti-Patterns
- No Adapter: Use
SecurityFilterChainbean instead of extending legacy classes. - No .and(): Use Lambda DSL for configuration.
- No Secrets: Load from Vault or Environment variables (never git).
- No antMatchers: Use
requestMatchers(Spring Security 6+).
References
- Implementation Examples
- common/security-standards
- architecture
Related Skills
hoangnguyen0403/common-operator-profile
testing
VerifiedTrustedCommunity
Infer the requesting operator's technical fluency from message content (never ask directly) and adapt register — business, hybrid, or technical — across SDLC workflow output. Use when starting sdlc, brainstorm-feature, plan-feature, verify-work, publish-notes, or session-report, or whenever a request's phrasing signals a non-technical or cross-stack operator.
524SKILL.mdUpdated Jul 12, 2026
hoangnguyen0403/database-transactions
documentation
VerifiedTrustedCommunity
Define transaction boundaries, locking, and consistency guarantees for multi-step writes. Use when designing atomic operations, retries, idempotency, or concurrent write behavior.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-schema-design
development
VerifiedTrustedCommunity
Design relational or document schemas from access patterns, cardinality, and lifecycle. Use when modeling entities, choosing embed vs normalize, or shaping schema boundaries before implementation.
524SKILL.mdUpdated Jun 19, 2026
hoangnguyen0403/database-query-performance
data-ai
VerifiedTrustedCommunity
Diagnose database latency with explain plans, index ownership, and query-shape review. Use when a query is slow, an index is missing, or scans and N+1 patterns appear.
524SKILL.mdUpdated Jun 19, 2026