10 Excellent Ways to Secure Your Spring Boot Application
summary
Covers concrete fixes: enable TLS everywhere using Let's Encrypt and certbot (including localhost cert tips), run dependency scanning (demo finds 12 high vulnerabilities and shows a repo with 19 direct deps turning into 191,155 lines of transitive code and auto-created fix PRs), enable CSRF tokens accessible to SPAs, add a restrictive CSP and security headers for an A+ score, use OIDC via Spring Security 5.x (spring CLI demo logs users), use scrypt/Argon2 password encoders and Spring Vault for secrets, run ZAP and focused security code reviews.
AI-written summary · about
chapters (11)
- 0:00Intro
- 3:19Use HTTPS
- 6:26Scan Dependencies
- 11:37Upgrade Libraries
- 15:07Enable CSRF
- 18:37Use a CSP
- 22:466. Use OIDC for Auth
- 30:56Hash Passwords
- 36:49Use Secure Secrets
- 40:58Test with ZAP
- 42:26Security Reviews
related talks
56mHow to avoid vulnerabilities and adopt security best practices?
51mSecuring SPAs with Spring
49mDon't Get Burned: Secure Coding Essentials in Java to protect your application
44mShift-Left-Security with the Security Test Pyramid
52mSpring Security for N00bz: A quick introduction for the terminally insecure
47mDon't Get Burned! Secure Coding Essentials to Protect Your Application
52mManaging Spring Boot Application Secrets
33mSpring Security Patterns