springboot-security
Spring Security best practices for authn/authz, validation, CSRF, secrets
by affaan-mFree
Description
springboot-security is an agent skill from the ECC collection by affaan-m, listed on skills.sh. It is a Spring Security review guide for Java Spring Boot services. It covers authentication and authorisation, input validation, CSRF, secrets, security headers, rate limiting and the security of dependencies. On authentication it prefers stateless JWTs or opaque tokens with a revocation list, and httpOnly, Secure and SameSite Strict cookies for sessions, with tokens checked in a filter or a resource server. It also covers role-based access with @PreAuthorize, Bean Validation and custom validators, CORS and CSRF configuration, the handling of secrets through Vault or environment variables, brute-force protection and scanning dependencies for CVEs. The skill applies when adding auth, handling input, creating endpoints or dealing with secrets. It is a SKILL.md file that an AI agent loads when a task calls for it. It is free and open source, and the skills.sh listing shows all three security audits passing.…
Highlights
- JWT, OAuth2 and session authentication
- @PreAuthorize role-based access
- httpOnly, Secure and SameSite cookies
- Secrets, rate limiting and CVE scanning
Ratings & Reviews
No ratings yet
Be the first to rate springboot-security.
People also visit
quarkus-security
Quarkus security implementation patterns: JWT and OIDC authentication
django-security
Django security best practices, authentication, authorization, CSRF protection
java-coding-standards
Java coding standards for Spring Boot and Quarkus services: naming
springboot-security FAQ
What does the springboot-security skill do?
It guides an agent in securing Spring Boot services, covering authentication, authorisation, input validation, CSRF, secrets and headers.
Which token approach does it prefer?
Stateless JWT or opaque tokens with a revocation list.
How should session cookies be set?
With httpOnly, Secure and SameSite Strict, according to the skill.
How do I install it?
Run: npx skills add https://github.com/affaan-m/ecc --skill springboot-security
Is it free?
Yes. It is free and open source.
Are there security findings?
The skills.sh listing shows Gen Agent Trust Hub, Socket and Snyk all passing.
What are the best springboot-security alternatives?
Popular alternatives to springboot-security include quarkus-security, django-security and java-coding-standards. See all springboot-security alternatives