springboot-security

Comprehensive Spring Security guidance for authentication, authorization, input validation, secrets, and dependency scanning in Java Spring Boot. Use when adding auth, handling input, creating endpoints, or dealing with secrets. Remember : Deny by default, validate inputs, least privilege, and secure-by-configuration first. - Covers authentication patterns (JWT, OAuth2, sessions with secure cookies), authorization via method security annotations, and token validation with filters - Includes input validation with Bean Validation constraints, SQL injection prevention through parameterized queries, and password hashing with BCrypt or Argon2 - Provides CSRF, CORS, and security header configuration strategies tailored to stateless APIs versus browser-based sessions - Addresses secrets management via environment variables and Spring Cloud Vault, rate limiting with Bucket4j, and CVE scanning in CI pipelines - Includes pre-release checklist covering token expiration, authorization guards, input sanitization, and PII redaction in logs - Adding authentication (JWT, OAuth2, session-based) - Implementing authorization (@PreAuthorize, role-based access) - Validating user input (Bean Validation, custom validators) - Configuring CORS, CSRF, or security headers - Managing secrets (Vault, environment variables) - Adding rate limiting or brute-force protection - Scanning dependencies for CVEs -...