Setting the file. One moment.
Skill 114 · Create Spring Boot Java Project
Subchapter 114.6
references/security.mdMarkdown2 KBView on GitHub
For anything beyond the basics (OAuth2/OIDC, JWT resource server, method security, CSRF/CORS details, testing security) use the spring-security skill. This page covers secure defaults when scaffolding.
Add security at generation time (Boot 4: spring-boot-starter-security, plus spring-boot-starter-security-test in test scope if generated by start.spring.io). Adding it secures every endpoint by default.
@Configuration
@EnableWebSecurity
class SecurityConfig {
@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(auth -> auth
.requestMatchers("/actuator/health/**", "/actuator/info").permitAll()
.anyRequest().authenticated())
.httpBasic(Customizer.withDefaults());
return http.build();
}
}PasswordEncoder bean alone: Boot’s generated password is then left unencoded and cannot authenticate with a delegating encoder.anyRequest().authenticated() last.PasswordEncoder together. Use PasswordEncoderFactories.createDelegatingPasswordEncoder() and store its encoded {id}hash values, never plain text.{noop} passwords or InMemoryUserDetailsManager demo users outside local experiments.health and info over HTTP: management.endpoints.web.exposure.include=health,info@Valid, Bean Validation) and use parameterized queries / Spring Dataspring.mvc.problemdetails.enabled=true; no stack traces to clients (server.error.include-stacktrace=never)* with credentialsserver.forward-headers-strategy=framework behind a proxy