Is CSRF protection included?

The skill provides logic for managing CSRF posture, explaining when to enable it for browser-based sessions and how to handle it in stateless APIs.

How does this skill help with authentication?

It provides implementation patterns for stateless JWT and opaque tokens, including validation filters and secure cookie configurations for session-based apps.

Does it provide guidance on secrets management?

It emphasizes externalizing secrets through environment variables or vaults, ensuring that credentials never reside in source code or application.yml files.

Can it assist with authorization logic?

Yes, it guides you through enabling method-level security using @PreAuthorize and establishing 'deny-by-default' access control policies.

How does it handle input validation?

It enforces the use of Bean Validation (JSR 303/380) and parameterized queries to prevent common attacks like SQL injection and XSS.

Spring Boot Security

Name: Spring Boot Security
Author: ysyecust

byysyecust

•

보안 및 테스팅

Implements industry-standard security patterns and vulnerability mitigations for Java Spring Boot applications.

This skill provides specialized guidance for securing Java Spring Boot services, covering the full spectrum of modern application security. It assists in implementing robust authentication using JWT or session-based cookies, fine-grained authorization via method-level security, and comprehensive input validation to prevent SQL injection and XSS. By following this skill's patterns for secrets management, secure HTTP headers, and rate limiting, developers can ensure their microservices are hardened against common threats and meet production-readiness standards.

주요 기능

012 GitHub stars

02Production-ready checklist for secrets and dependency management

03Fine-grained RBAC and method-level authorization configurations

04Standardized input validation and SQL injection prevention

05Security header configuration (CSP, HSTS, XSS Protection)

06Stateless JWT and session-based authentication implementation

사용 사례

01Hardening existing Spring Boot services against OWASP Top 10 vulnerabilities

02Implementing secure secrets management and externalized configurations

03Securing RESTful APIs with stateless JWT authentication and authorization

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add ysyecust/everything-claude-code springboot-security

For use in Claude.ai and ChatGPT

Download Skill