spring-boot-security
This skill provides configuration templates and guidance for implementing Spring Security 6+ using Lambda DSL.
Install
mkdir -p .claude/skills/spring-boot-security && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/5154" && unzip -o skill.zip -d .claude/skills/spring-boot-security && rm skill.zipInstalls to .claude/skills/spring-boot-security
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Configure Spring Security 6+ with Lambda DSL, JWT, and hardening rules. Use when configuring Spring Security 6+, OAuth2, JWT, or security hardening in Spring Boot.Key capabilities
- →Configure SecurityFilterChain using Lambda DSL
- →Enforce stateless session management for REST APIs
- →Implement JWT token validation with RS256 or HS256
- →Apply security hardening headers
- →Configure CORS and CSRF policies
How it works
It enforces modern Spring Security 6 standards by replacing legacy adapter classes with functional bean definitions and Lambda DSL configurations.
Inputs & outputs
When to use spring-boot-security
- →Configure Spring Security 6
- →Implement Lambda DSL in security configs
- →Harden application authentication
- →Audit security configurations
About this skill
Spring Boot Security Standards
Priority: P0 (CRITICAL)
Configure SecurityFilterChain
- Lambda DSL: ALWAYS use Lambda DSL.
- SecurityFilterChain: Expose as
@Bean. not extendWebSecurityConfigurerAdapter. - Statelessness: Enforce
SessionCreationPolicy.STATELESSfor REST APIs.
See implementation examples for SecurityFilterChain configuration with Lambda DSL and JWT.
Implement Authentication and Authorization
- Authentication: Validation of credentials (Who you?). Use
AuthenticationManagerorJwtDecoder. - Authorization: Verification of access rights (Can you this?). Use
@PreAuthorize.
Secure JWT Tokens
- Algorithm: Enforce
RS256orHS256. Rejectnonealgorithm. - Claims: Validate
iss,aud, andexp. - Tokens: Short-lived access JWTs (15m), secure refresh tokens (httpOnly cookie).
Hardening Checklist
- CSRF: Disabled for pure APIs? Enabled + Cookie for Browser Apps?
- CORS: Specific origins permitted? No
*with credentials? - Headers: HSTS, Content-Type-Options, X-Frame-Options enabled?
- Secrets: No hardcoded keys? Loaded from Vault/Env?
- Rate Limiting: Applied on login/expensive endpoints?
- Dependencies: Scanned for CVEs?
Anti-Patterns
- No Adapter: Use
SecurityFilterChainbean instead of extending legacy classes. - No .and(): Use Lambda DSL for configuration.
- No Secrets: Load from Vault or Environment variables (never git).
- No antMatchers: Use
requestMatchers(Spring Security 6+).
References
- Implementation Examples
- common/security-standards
- architecture
When not to use it
- →When extending WebSecurityConfigurerAdapter
- →When using the 'none' algorithm for JWT
Limitations
- →Requires migration from legacy antMatchers to requestMatchers
- →Secrets must be managed via environment variables or Vault
How it compares
It mandates the use of Lambda DSL and bean-based configuration, avoiding the deprecated inheritance-based security patterns.
Compared to similar skills
spring-boot-security side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| spring-boot-security (this skill) | 1 | 1mo | No flags | Advanced |
| springboot-security | 5 | 5mo | No flags | Intermediate |
| asl-java-implement-rule-authz | 0 | 2mo | No flags | Advanced |
| springboot-verification | 4 | 4mo | Review | Intermediate |
Try saying
Example prompts that trigger this skill in your AI assistant.
More by HoangNguyen0403
View all by HoangNguyen0403 →You might also like
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
asl-java-implement-rule-authz
ChapmanRichard
Use when: 需要在 LeaveSystem_Backend_Java 中实现认证与鉴权规则，覆盖 Header/JWT、RBAC、资源归属和默认拒绝。关键词: Java 鉴权, Spring Boot, RBAC, Authorization, 资源级权限
springboot-verification
affaan-m
Verification loop for Spring Boot projects: build, static analysis, tests with coverage, security scans, and diff review before release or PR.
auth-implementation-patterns
sickn33
Master authentication and authorization patterns including JWT, OAuth2, session management, and RBAC to build secure, scalable access control systems. Use when implementing auth systems, securing APIs, or debugging security issues.
spring-authorization-server
claude-dev-suite
|
security-owasp
navikt
OWASP Top 10:2025 kodenivå-mønstre for Kotlin, Go, Java og Node.js — tilgangskontroll, forsyningskjede, injeksjon og feilhåndtering