$ loading_
为 Spring Boot 服务提供认证鉴权、CSRF、防护头与依赖安全最佳实践
复制安装指令，让 AI 自动完成配置 · 推荐新手
请帮我安装 askskill 上的 "springboot-security" 技能： 1. 下载 https://raw.githubusercontent.com/affaan-m/ECC/main/skills/springboot-security/SKILL.md 2. 保存为 ~/.claude/skills/springboot-security/SKILL.md 3. 装好后重载技能，告诉我可以用了
请为一个 Spring Boot REST API 设计 Spring Security 方案，包含 JWT 认证、基于角色的授权、密码存储、登录失败限制，并给出推荐配置与代码示例。
一套安全配置建议，包含过滤器链、认证授权策略、密码加密方式与示例代码。
请审查下面的 Spring Boot 安全配置，找出认证、CSRF、请求校验、安全响应头、密钥管理和依赖版本方面的风险，并按严重程度给出修复建议。
一份按风险等级排序的问题清单，以及对应的修复步骤和最佳实践说明。
我准备上线一个 Spring Boot 服务，请给我一份安全加固清单，覆盖速率限制、CORS、HTTP 安全头、输入校验、Secrets 管理、依赖扫描和日志审计。
一份可执行的上线安全清单，帮助在生产环境中系统性加固 Spring Boot 服务。
Use when adding auth, handling input, creating endpoints, or dealing with secrets.
httpOnly, Secure, SameSite=Strict cookies for sessionsOncePerRequestFilter or resource server@Component
public class JwtAuthFilter extends OncePerRequestFilter {
private final JwtService jwtService;
public JwtAuthFilter(JwtService jwtService) {
this.jwtService = jwtService;
}
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
FilterChain chain) throws ServletException, IOException {
String header = request.getHeader(HttpHeaders.AUTHORIZATION);
if (header != null && header.startsWith("Bearer ")) {
String token = header.substring(7);
Authentication auth = jwtService.authenticate(token);
SecurityContextHolder.getContext().setAuthentication(auth);
}
chain.doFilter(request, response);
}
}
@EnableMethodSecurity@PreAuthorize("hasRole('ADMIN')") or @PreAuthorize("@authz.canEdit(#id)")@RestController
@RequestMapping("/api/admin")
public class AdminController {
@PreAuthorize("hasRole('ADMIN')")
@GetMapping("/users")
public List<UserDto> listUsers() {
return userService.findAll();
}
@PreAuthorize("@authz.isOwner(#id, authentication)")
@DeleteMapping("/users/{id}")
public ResponseEntity<Void> deleteUser(@PathVariable Long id) {
userService.delete(id);
return ResponseEntity.noContent().build();
}
}
@Valid on controllers@NotBlank, @Email, @Size, custom validators// BAD: No validation
@PostMapping("/users")
public User createUser(@RequestBody UserDto dto) {
return userService.create(dto);
}
// GOOD: Validated DTO
public record CreateUserDto(
@NotBlank @Size(max = 100) String name,
@NotBlank @Email String email,
@NotNull @Min(0) @Max(150) Integer age
) {}
@PostMapping("/users")
public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {
return ResponseEntity.status(HttpStatus.CREATED)
.body(userService.create(dto));
}
:param bindings; never concatenate strings// BAD: String concatenation in native query
@Query(value = "SELECT * FROM users WHERE name = '" + name + "'", nativeQuery = true)
// GOOD: Parameterized native query
@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)
List<User> findByName(@Param("name") String name);
// GOOD: Spring Data derived query (auto-parameterized)
List<User> findByEmailAndActiveTrue(String email);
PasswordEncoder bean, not manual hashing@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(12); // cost factor 12
}
// In service
public User register(CreateUserDto dto) {
String hashedPassword = passwordEncoder.encode(dto.password());
return userRepository.save(new User(dto.email(), hashedPassword));
}
…
通过双评审智能体对结果进行对抗式校验，提升输出发布前的可靠性
提供 Quarkus 安全开发最佳实践，覆盖认证授权、密钥与依赖风险防护。