Security defaults that belong in every Spring Boot application from day one.
88
83%
Does it follow best practices?
Impact
97%
1.79xAverage score across 5 eval scenarios
Passed
No known issues
A startup needs a user management API built with Spring Boot and Java. The API handles user registration, login, and profile management. A React single-page app hosted on a separate domain will consume this API. The backend will run on AWS behind an Application Load Balancer.
The API needs the following endpoints:
POST /api/auth/register -- create a new user account (accepts name, email, password)POST /api/auth/login -- authenticate and return user infoGET /api/users/me -- return the current user's profilePATCH /api/users/me -- update the current user's profile (name, email)GET /api/users -- list all users (admin only)DELETE /api/users/{id} -- delete a user account (admin only)Use an in-memory Map or List as the data store (no database required). Users should have id, name, email, password, role (USER or ADMIN), and createdAt fields.
Produce:
SecurityConfig.java -- Spring Security configurationUserController.java -- REST controller with all endpointsUserService.java -- Business logic for user operationsUser.java -- User entity/modelpom.xml -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
springboot-security-basics
verifiers