Springboot Security

This is your Spring Security checklist in skill form. It covers JWT and OAuth2 authentication, method-level authorization with @PreAuthorize, Bean Validation for inputs, CSRF and CORS config, secrets management, rate limiting with Bucket4j, and dependency scanning. The code samples are production-ready, not toys: proper filter chains, parameterized queries to stop SQL injection, BCrypt password encoding, security headers. Activate it when you're adding auth to an endpoint, handling user input, or reviewing a PR before release. The pre-deploy checklist alone is worth having around. If you're building Spring Boot APIs and don't want to reinvent security patterns, this gives you the guardrails.

skills.sh installs: 6K
GitHub stars: 300.3K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/ecc --skill springboot-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Spring Boot Security Review

Use when adding auth, handling input, creating endpoints, or dealing with secrets.

When to Activate

Adding authentication (JWT, OAuth2, session-based)
Implementing authorization (@PreAuthorize, role-based access)
Validating user input (Bean Validation, custom validators)
Configuring CORS, CSRF, or security headers
Managing secrets (Vault, environment variables)
Adding rate limiting or brute-force protection
Scanning dependencies for CVEs

Authentication

Prefer stateless JWT or opaque tokens with revocation list
Use httpOnly, Secure, SameSite=Strict cookies for sessions
Validate tokens with OncePerRequestFilter or resource server

@Component
public class JwtAuthFilter extends OncePerRequestFilter {
  private final JwtService jwtService;

  public JwtAuthFilter(JwtService jwtService) {
    this.jwtService = jwtService;
  }

SKILL.md on GitHub