---

name: spring-boot-security description: Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.

Spring Security 7 for Spring Boot 4

Implements authentication and authorization with Spring Security 7's mandatory Lambda DSL.

Critical Breaking Changes

Core Workflow

1. Create SecurityFilterChain bean → Configure with Lambda DSL
2. Define authorization rules → authorizeHttpRequests() with requestMatchers()
3. Configure authentication → Form login, HTTP Basic, or OAuth2
4. Add method security → @EnableMethodSecurity + @PreAuthorize
5. Handle CORS/CSRF → Configure for REST APIs

Quick Patterns

See EXAMPLES.md for complete working examples including:

• REST API Security with JWT/OAuth2 (Java + Kotlin)
• Form Login with Session Security and CSRF
• Method Security with @PreAuthorize and SpEL
• CORS Configuration for cross-origin APIs
• Password Encoder (Argon2 for Security 7)

Spring Boot 4 Specifics

• Lambda DSL is mandatory (no and() chaining)
• Argon2 password encoder: Argon2PasswordEncoder.defaultsForSpring7()
• CSRF for SPAs: CookieCsrfTokenRepository.withHttpOnlyFalse()
• @EnableMethodSecurity replaces @EnableGlobalMethodSecurity

Detailed References

• Examples: See EXAMPLES.md for complete working code examples
• Troubleshooting: See TROUBLESHOOTING.md for common issues and Boot 4 migration
• Security Configuration: See references/SECURITY-CONFIG.md for complete SecurityFilterChain patterns
• Authentication: See references/AUTHENTICATION.md for UserDetailsService, password encoding
• JWT/OAuth2: See references/JWT-OAUTH2.md for resource server, token validation

Anti-Pattern Checklist

Critical Reminders

1. Lambda DSL is mandatory — No more and() chaining in Security 7
2. Order matters — More specific requestMatchers before general ones
3. CSRF for sessions — Only disable for stateless JWT APIs
4. Method security needs enabling — Add @EnableMethodSecurity
5. Test security configuration — Use @WithMockUser and JWT test support (see spring-boot-testing)