Individual skill
spring-security
Configure, test and review Spring Security 6/7 in Spring Boot 3/4 apps: SecurityFilterChain lambda DSL, method security, OAuth2 resource server with JWT, OIDC login, CSRF/CORS, password encoding, headers, actuator protection, and MockMvc security tests. Use when adding or auditing authentication and authorization.
skills/spring-security/SKILL.md
Source commit edbecfa9099c4addae1f500cca1ac067204b30fd
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- Yes
- Observed behavior
- Network or broad shell
- Last checked
- Nov 4, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 40,895
- Repository last updated
- Nov 6, 2026
- License
- MIT
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- ai Repository topic
- github-copilot Repository topic
- prompt-engineering Repository topic
- hacktoberfest Repository topic
- agent-skills Repository topic
- agents Repository topic
- awesome Repository topic
- custom-agents Repository topic
- security Derived category
- testing Derived category
- security-application Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
SKILL.mdcore · 5,304 bytesreferences/actuator-protection.mddoc · 2,061 bytesreferences/csrf-cors-sessions-headers.mddoc · 3,506 bytesreferences/method-security.mddoc · 1,435 bytesreferences/oauth2-resource-server-jwt.mddoc · 2,969 bytesreferences/oidc-login-oauth2-client.mddoc · 2,070 bytesreferences/password-encoding.mddoc · 650 bytesreferences/review-checklist.mddoc · 729 bytesreferences/testing-security.mddoc · 3,918 bytes
Read excerpt
# Spring Security
Practical guidance for Spring Security 6.x (Spring Boot 3.x) and 7.x (Spring Boot 4.x). Details per topic are in `references/`.
## Safety rules
- Never read, print, or commit secrets: `.env`, `application-*.properties` with credentials, client secrets, private keys, JWT signing keys. Reference them via environment variables or a secret manager.
- Never disable security (`permitAll()` on everything, `csrf.disable()` for browser apps) just to make a test or demo pass.
## First: detect the version
1. Find the Boot version (`pom.xml` parent/BOM, `build.gradle(.kts)`, `libs.versions.toml`) and run `./mvnw dependency:tree -Dincludes=org.springframework.security` or `./gradlew dependencies --configuration runtimeClasspath` to see the Spring Security version.
2. Boot 3.x -> Security 6.x; Boot 4.x -> Security 7.x. Do not mix guidance: in 7.x, APIs deprecated in 6.x are removed (for example `and()` chaining, `authorizeRequests`, `AntPathRequestMatcher`/`MvcRequestMatcher` style matchers; use the lambda DSL and `requestMatchers(...)`). Check the "What's New" and migration pages on docs.spring.io/spring-security when upgrading.
3. Identify the app type: servlet MVC (`SecurityFilterChain`) or WebFlux (`SecurityWebFilterChain`, `@EnableWebFluxSecurity`); browser app with sessions, or stateless API.