spring-auth-auditorlisted

# Spring Auth Auditor ## Core Principles 1. **Explicit Security Filters**: Define clear SecurityFilterChain configurations. Do not use default broad rules. 2. **CORS & CSRF**: Always specify explicit CORS origins and keep CSRF protection enabled unless stateless API endpoints with JWT are explicitly verified. 3. **No Mutations in Production**: Configurations must not mutate settings based on dev/prod environments dynamically in an unsafe manner. ## Verification Checklist - Validate JWT signature, issuer, and expiration time inside `OncePerRequestFilter`. - Do not store JWT tokens in client-accessible localStorage. Promote Cookie-based Auth with `HttpOnly` flags. - Ensure that endpoints matching `/api/public/**` or similar exclusions are intentionally public.