Springboot Security

The springboot-security skill provides developers with Spring Boot security best practices for implementing authentication, authorization, input validation, CSRF protection, secret management, rate limiting, and dependency scanning in Java services. It addresses common security vulnerabilities by offering code examples and configuration patterns for JWT/OAuth2 tokens, role-based access control, Bean Validation, secure headers, and CVE scanning. The skill is activated when developers are adding auth mechanisms, validating user input, configuring CORS/CSRF, managing secrets, or reviewing dependencies for security vulnerabilities.

skills.sh installs: 6.4K
GitHub stars: 229.1K
last updated: Jul 14, 2026

View on GitHub

Install

$ npx -y skills add affaan-m/everything-claude-code --skill springboot-security --agent claude-code

Installs into .claude/skills of the current project.

Files

Spring Boot Security Review

Use when adding auth, handling input, creating endpoints, or dealing with secrets.

When to Activate

Adding authentication (JWT, OAuth2, session-based)
Implementing authorization (@PreAuthorize, role-based access)
Validating user input (Bean Validation, custom validators)
Configuring CORS, CSRF, or security headers
Managing secrets (Vault, environment variables)
Adding rate limiting or brute-force protection
Scanning dependencies for CVEs

Authentication

Prefer stateless JWT or opaque tokens with revocation list
Use httpOnly, Secure, SameSite=Strict cookies for sessions
Validate tokens with OncePerRequestFilter or resource server

@Component
public class JwtAuthFilter extends OncePerRequestFilter {
  private final JwtService jwtService;

  public JwtAuthFilter(JwtService jwtService) {
    this.jwtService = jwtService;
  }

SKILL.md on GitHub