Security defaults that belong in every Spring Boot application from day one.
88
83%
Does it follow best practices?
Impact
97%
1.79xAverage score across 5 eval scenarios
Passed
No known issues
An e-commerce team needs a REST API for managing their product catalog. The API is built with Spring Boot and Java. A Vue.js storefront running on a separate domain will consume it. The API will be deployed on a cloud VM behind an nginx reverse proxy.
The API needs the following endpoints:
GET /api/products -- list all products (supports ?category=electronics&sort=price query parameters)GET /api/products/{id} -- get a single product by IDPOST /api/products -- create a new product (accepts name, description, price, category, stockQuantity)PATCH /api/products/{id} -- update an existing productDELETE /api/products/{id} -- delete a productPOST /api/products/{id}/reviews -- add a review (accepts author, rating 1-5, comment)Use an in-memory List as the data store. Products should have id, name, description, price, category, stockQuantity, reviews, and createdAt fields.
Produce:
ProductController.java -- REST controller with all CRUD endpointsProduct.java -- Product modelCreateProductRequest.java -- DTO for product creationSecurityConfig.java -- Application security configurationpom.xml -- With all required dependenciesevals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
skills
springboot-security-basics
verifiers