spring-security-configurator-auditor

Spring Security Configurator Auditor

Source mapping: Tier 2 high-value skill derived from Kotlin_Spring_Developer_Pipeline.md (SK-13).

Mission

Produce a security model that is explicit, minimal, and testable. Optimize for least privilege and correct failure semantics, not for shortest config.

Read First

• Current SecurityFilterChain or chains.
• Endpoint inventory, including actuator, docs, and internal admin routes.
• Authentication model: session, JWT, OAuth2 resource server, API keys, mTLS, or mixed.
• Authorization model: roles, scopes, claims, method security, tenant boundaries.
• CORS, CSRF, and security-related tests.

Design Sequence

1. Define who the clients are: browser, internal service, public API consumer, job, or operator.
2. Define authentication mechanism and token trust boundaries.
3. Enumerate public endpoints explicitly.
4. Define authorization at URL and method level.
5. Define 401 and 403 behavior.
6. Add tests for the critical allowed and denied paths.

Core Security Rules

• Prefer explicit allowlists for public endpoints.
• Validate JWT issuer, audience, expiration, signature, and clock-skew assumptions deliberately.