Security defaults that belong in every Spring Boot application from day one.
88
83%
Does it follow best practices?
Impact
97%
1.79xAverage score across 5 eval scenarios
Passed
No known issues
A coworking space needs a REST API for managing room bookings. The API is built with Spring Boot and Java. An Angular frontend running on a separate domain will consume it. Users must register and log in to make bookings.
The API needs the following endpoints:
POST /api/auth/register -- register a new user (accepts name, email, password)POST /api/auth/login -- authenticate and return user infoGET /api/rooms -- list all available roomsPOST /api/bookings -- create a booking (accepts roomId, date, startTime, endTime)GET /api/bookings/mine -- list the current user's bookingsDELETE /api/bookings/{id} -- cancel a booking (only the booking owner or admin)GET /api/admin/bookings -- list all bookings (admin only)Use an in-memory data store. Rooms have id, name, capacity. Bookings have id, roomId, userId, date, startTime, endTime, createdAt. Users have id, name, email, password, role (USER/ADMIN).
Produce:
SecurityConfig.java -- Spring Security configurationAuthController.java -- Registration and login endpointsBookingController.java -- Booking CRUD endpointsRoomController.java -- Room listing endpointUserService.java -- User registration and authentication logicpom.xml -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
springboot-security-basics
verifiers