Security Review Checklist

Organized by OWASP Top 10:2025. Targets Spring Boot 4 / Spring Security 7. Report exploitability and the affected entry point, not only the rule.

Contents

1. OWASP Top 10:2025
2. Spring Security 7 configuration
3. Tokens and JWT
4. Review checklist

OWASP Top 10:2025

A01 Broken Access Control (includes SSRF)

SSRF. Flag any outbound call to a URL or host that comes from the request.

• Use an allowlist of hosts, and fail closed when the host is missing or not on it.
• Disable redirects for those calls, or re-check the target after a redirect. An allowed host can redirect to an internal one.
• If an allowlist is not possible, resolve the host and reject loopback, site-local, link-local, and any-local addresses (InetAddress.isLoopbackAddress(), isSiteLocalAddress(), isLinkLocalAddress(), isAnyLocalAddress()), plus 169.254.169.254. Check every resolved address, and connect to the checked address so DNS rebinding cannot swap it. String prefix checks like host.startsWith("172.16.") miss 172.17-172.31, IPv6, and encoded forms.

A02 Security Misconfiguration

A03 Software Supply Chain Failures

• Versions come from the Boot BOM; no unmanaged overrides of Spring, Jackson, or Netty without a reason.
• A dependency scanner runs in CI (OWASP Dependency-Check, GitHub Dependabot/Renovate, or similar).
• No unmaintained libraries or end-of-life runtimes.
• Build plugins and Maven/Gradle wrappers come from trusted repositories, with wrapper checksums verified.

A04 Cryptographic Failures

For key derivation (not passwords), see java-25-features.md (javax.crypto.KDF, HKDF).

A05 Injection

A06 Insecure Design

• Login, password reset, and OTP endpoints have rate limits (gateway, Bucket4j, or Resilience4j @RateLimiter). In-memory counters do not work across instances.
• Failed-login handling slows attackers without letting them lock out any account at will (progressive delays, CAPTCHA, or MFA rather than hard lockout).
• Error messages do not reveal whether a user exists ("Invalid credentials").
• Business limits are enforced on the server (quantities, amounts, workflow order).

A07 Authentication Failures

• Passwords: minimum length (NIST SP 800-63B rev. 4: 15 characters without MFA, 8 with MFA), maximum at least 64, all characters allowed, checked against breached-password lists. No forced character-class rules and no periodic forced changes. Flag regexes that require "uppercase + digit + special".
• MFA for admin and sensitive operations.
• Session fixation protection stays on (Spring Security default); session cookies Secure, HttpOnly, SameSite.
• Idle session timeout set (server.servlet.session.timeout).

A08 Software or Data Integrity Failures

• No ObjectInputStream.readObject() on untrusted data.
• No Jackson default typing on untrusted input (activateDefaultTyping, enableUnsafeDefaultTyping). If polymorphic types are needed, use a PolymorphicTypeValidator limited to app packages.
• Webhooks and callbacks verify signatures.
• CI artifacts are signed or checksummed.

A09 Security Logging and Alerting Failures

• Login success/failure, access denied, password and role changes are logged with time, user, source IP, and action. Spring Security publishes AuthenticationSuccessEvent / AbstractAuthenticationFailureEvent / AuthorizationDeniedEvent; listen to them instead of logging in controllers.
• Logs never contain passwords, tokens, or full personal data.
• User input in logs cannot forge log lines (structured logging, or strip CR/LF).
• Alerts exist for spikes in authentication failures.

A10 Mishandling of Exceptional Conditions

Spring Security 7 configuration

@Configuration
@EnableMethodSecurity
class SecurityConfig {

    // Stateless JSON API with bearer tokens: only requests under /api/**
    @Bean
    @Order(1)
    SecurityFilterChain api(HttpSecurity http) throws Exception {
        http
            .securityMatcher("/api/**")
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/public/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated())
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .csrf(csrf -> csrf.disable())   // no cookies carry credentials here
            .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()));
        return http.build();
    }

    // Fallback for every other path. Without it, requests outside /api/**
    // match no chain and Spring Security does not protect them.
    @Bean
    @Order(2)
    SecurityFilterChain fallback(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/actuator/health/**").permitAll()
                .anyRequest().denyAll());
        return http.build();
    }

    @Bean
    PasswordEncoder passwordEncoder() {
        return PasswordEncoderFactories.createDelegatingPasswordEncoder();
    }
}

Review rules:

• CSRF: keep it on for browser apps that use session cookies. Disabling it is correct only when no cookie carries credentials (bearer-token APIs). Flag csrf.disable() together with form login or session cookies.
• Spring Security 7 removals: AntPathRequestMatcher and MvcRequestMatcher are gone (use requestMatchers("/path/**") or PathPatternRequestMatcher), and the .and() chaining DSL is gone (use lambda customizers). Old code does not compile.
• @EnableWebSecurity is optional in Boot. @EnableMethodSecurity already enables @PreAuthorize/@PostAuthorize (prePostEnabled defaults to true).
• Flag a securityMatcher(...) chain with no catch-all chain. Requests that match no chain bypass Spring Security entirely. Give scoped chains @Order and add a last chain without a matcher that ends in anyRequest().authenticated() or denyAll(). If there is only one chain, drop the matcher and use requestMatchers(...) inside authorizeHttpRequests.
• Test rules with spring-boot-starter-security-test (@WithMockUser, SecurityMockMvcRequestPostProcessors.jwt()).

Tokens and JWT

• Prefer Spring Security's resource server (spring-boot-starter-oauth2-resource-server, spring.security.oauth2.resourceserver.jwt.issuer-uri or jwk-set-uri) over hand-written JWT parsing. It validates signature, expiry, and issuer.
• If the code parses JWTs itself (JJWT 0.12+): Jwts.parser().verifyWith(key).build().parseSignedClaims(token). Flag the pre-0.12 parserBuilder()/setSigningKey()/parseClaimsJws() API.
• HS256 keys need at least 256 bits from a secret store. Prefer asymmetric keys (RS256/ES256) when other services verify tokens.
• Check exp, iss, and aud. Reject alg: none. Access tokens are short-lived (minutes); refresh tokens are revocable.
• Do not put tokens in URLs or localStorage for browser apps when an HttpOnly cookie (with CSRF protection) is possible.

Review checklist

Critical:

• Every privileged endpoint and service method has an authorization rule; object-level ownership is checked
• Every request matches some SecurityFilterChain (a catch-all chain exists when others use securityMatcher)
• No string-built SQL/JPQL/Mongo queries; no user input in sort fields without an allowlist
• Passwords via DelegatingPasswordEncoder/bcrypt/Argon2; no secrets in source or logs
• CSRF on for cookie-based sessions; disabled only for bearer-token APIs
• No SSRF: user-supplied URLs allowlisted, redirects controlled
• No unsafe deserialization or Jackson default typing on untrusted input
• Errors fail closed and do not leak details

Important:

• Actuator exposure minimal; H2 console off; CORS explicit
• Rate limits on authentication endpoints; no account-enumeration messages
• Password policy follows NIST length rules, not composition rules
• Security events logged; dependency scanning in CI
• Spring Security 7 APIs (no AntPathRequestMatcher, no .and())

Official documentation

• OWASP Top 10:2025, OWASP Cheat Sheet Series
• Spring Security Reference
• NIST SP 800-63B
• JWT Best Current Practices (RFC 8725)