springboot-security

Spring Boot Security Review

Use when adding authentication (Auth), handling input, creating endpoints, or handling secrets.

When to Activate

Adding authentication (JWT, OAuth2, session-based authentication)
Implementing authorization (@PreAuthorize, role-based access control)
Validating user input (Bean Validation, custom validators)
Configuring CORS, CSRF, or security response headers
Managing secrets (Vault, environment variables)
Adding rate limiting or brute-force protection
Scanning dependencies for CVE vulnerabilities

Authentication

Prefer stateless JWT or opaque tokens with a revocation list
Use httpOnly、Secure、SameSite=Strict attribute cookies for sessions
Use OncePerRequestFilter or a resource server to validate tokens

@Component
public class JwtAuthFilter extends OncePerRequestFilter {
  private final JwtService jwtService;

  public JwtAuthFilter(JwtService jwtService) {
    this.jwtService = jwtService;
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
      FilterChain chain) throws ServletException, IOException {
    String header = request.getHeader(HttpHeaders.AUTHORIZATION);
    if (header != null && header.startsWith("Bearer ")) {
      String token = header.substring(7);
      Authentication auth = jwtService.authenticate(token);
      SecurityContextHolder.getContext().setAuthentication(auth);
    }
    chain.doFilter(request, response);
  }
}

Authorization

Enable method security:@EnableMethodSecurity
Use @PreAuthorize("hasRole('ADMIN')") or @PreAuthorize("@authz.canEdit(#id)")
Deny by default; expose only the required scopes

@RestController
@RequestMapping("/api/admin")
public class AdminController {

  @PreAuthorize("hasRole('ADMIN')")
  @GetMapping("/users")
  public List<UserDto> listUsers() {
    return userService.findAll();
  }

  @PreAuthorize("@authz.isOwner(#id, authentication)")
  @DeleteMapping("/users/{id}")
  public ResponseEntity<Void> deleteUser(@PathVariable Long id) {
    userService.delete(id);
    return ResponseEntity.noContent().build();
  }
}

Input Validation

On controllers, apply @Valid use Bean Validation
Apply constraints on DTOs:@NotBlank、@Email、@Size, custom validators
Before rendering, sanitize any HTML content using an allowlist

// 差（BAD）：没有校验
@PostMapping("/users")
public User createUser(@RequestBody UserDto dto) {
  return userService.create(dto);
}

// 好（GOOD）：校验过的 DTO
public record CreateUserDto(
    @NotBlank @Size(max = 100) String name,
    @NotBlank @Email String email,
    @NotNull @Min(0) @Max(150) Integer age
) {}

@PostMapping("/users")
public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {
  return ResponseEntity.status(HttpStatus.CREATED)
      .body(userService.create(dto));
}

SQL Injection Prevention

Use Spring Data repositories or parameterized queries
For native queries, use :param binding; never concatenate strings

// 差（BAD）：在原生查询中直接拼接字符串
@Query(value = "SELECT * FROM users WHERE name = '" + name + "'", nativeQuery = true)

// 好（GOOD）：参数化原生查询
@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)
List<User> findByName(@Param("name") String name);

// 好（GOOD）：Spring Data 衍生查询（自动参数化）
List<User> findByEmailAndActiveTrue(String email);

Password Encoding

Always hash passwords using BCrypt or Argon2 — never store plaintext
Use the PasswordEncoder Bean instead of performing hashing manually

@Bean
public PasswordEncoder passwordEncoder() {
  return new BCryptPasswordEncoder(12); // 成本因子（cost factor）为 12
}

// 在 Service 中
public User register(CreateUserDto dto) {
  String hashedPassword = passwordEncoder.encode(dto.password());
  return userRepository.save(new User(dto.email(), hashedPassword));
}

CSRF Protection

For browser session-based applications, keep CSRF enabled; include the token in forms/headers
For pure APIs using Bearer tokens, disable CSRF and rely on stateless authentication

http
  .csrf(csrf -> csrf.disable())
  .sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

Secrets Management

Do not keep secrets in source code; load them from environment variables or Vault
Keep application.yml free of credential information; use placeholders
Regularly rotate tokens and database credentials

# 差（BAD）：在 application.yml 中硬编码
spring:
  datasource:
    password: mySecretPassword123

# 好（GOOD）：使用环境变量占位符
spring:
  datasource:
    password: ${DB_PASSWORD}

# 好（GOOD）：Spring Cloud Vault 集成
spring:
  cloud:
    vault:
      uri: https://vault.example.com
      token: ${VAULT_TOKEN}

Security Headers

http
  .headers(headers -> headers
    .contentSecurityPolicy(csp -> csp
      .policyDirectives("default-src 'self'"))
    .frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)
    .xssProtection(Customizer.withDefaults())
    .referrerPolicy(rp -> rp.policy(ReferrerPolicyHeaderWriter.ReferrerPolicy.NO_REFERRER)));

CORS Configuration

Configure CORS at the security filter level, not per controller
Limit allowed origins — never use *

@Bean
public CorsConfigurationSource corsConfigurationSource() {
  CorsConfiguration config = new CorsConfiguration();
  config.setAllowedOrigins(List.of("https://app.example.com"));
  config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
  config.setAllowedHeaders(List.of("Authorization", "Content-Type"));
  config.setAllowCredentials(true);
  config.setMaxAge(3600L);

  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
  source.registerCorsConfiguration("/api/**", config);
  return source;
}

// 在 SecurityFilterChain 中：
http.cors(cors -> cors.configurationSource(corsConfigurationSource()));

Rate Limiting

Apply Bucket4j or gateway-level limits on high-overhead endpoints
Log and alert on burst requests; return a 429 error with retry guidance

// 使用 Bucket4j 进行单端点速率限制
@Component
public class RateLimitFilter extends OncePerRequestFilter {
  private final Map<String, Bucket> buckets = new ConcurrentHashMap<>();

  private Bucket createBucket() {
    return Bucket.builder()
        .addLimit(Bandwidth.classic(100, Refill.intervally(100, Duration.ofMinutes(1))))
        .build();
  }

  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
      FilterChain chain) throws ServletException, IOException {
    String clientIp = request.getRemoteAddr();
    Bucket bucket = buckets.computeIfAbsent(clientIp, k -> createBucket());

    if (bucket.tryConsume(1)) {
      chain.doFilter(request, response);
    } else {
      response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
      response.getWriter().write("{\"error\": \"Rate limit exceeded\"}");
    }
  }
}

Dependency Security

Run OWASP Dependency Check / Snyk in CI
Keep Spring Boot and Spring Security on supported versions
Fail build when known CVEs are found

Logging and PII (Personally Identifiable Information)

Never log secrets, tokens, passwords, or full card number (PAN) data
Redact sensitive fields; use structured JSON logs

File Uploads

Validate file size, content type, and extension
Store outside the web root; scan for viruses as needed

Checklist Before Release

Authentication tokens are validated and expire correctly
Every sensitive path has authorization protection
All inputs are validated and sanitized
No string-concatenated SQL
CSRF policy matches the application type
Secrets are externalized; not committed to the repository
Security response headers are configured
Rate limiting is set on APIs
Dependencies are scanned and up to date
Logs contain no sensitive data

Remember: Follow the principles of deny by default, validate input, least privilege, and prefer implementing security through configuration.