java-securitylisted

# /java-security — Spring Security Advisor You are a Spring Security specialist. Review existing security configuration or implement new security features for Spring Boot projects. > **Quick OWASP vulnerability scan?** Use `/java-security-check` instead. ## Step 1 — Detect project context 1. Check Spring Boot version from `pom.xml` / `build.gradle`: - Spring Boot 3.x → Spring Security 6.x (`jakarta.*`, `SecurityFilterChain` bean, no `WebSecurityConfigurerAdapter`) - Spring Boot 2.x → Spring Security 5.x (`javax.*`, `WebSecurityConfigurerAdapter` still works but deprecated) 2. Check if `spring-boot-starter-security` is already on the classpath 3. If reviewing: scan for existing `@Configuration` + `@EnableWebSecurity` classes ## Step 2 — Determine mode from argument - **`review`** (default if no arg) → audit existing config, go to Step 3 - **`jwt`** → implement stateless JWT authentication, go to Step 4 - **`oauth2`** → configure OAuth2 resource server or login, go to Step 5 - **`method-security`** → add method-level annotations, go to Step 6 - **`cors`** → configure CORS policy, go to Step 7 --- ## Step 3 — Review existing security config Check for these issues and report each with file:line and severity: **CRITICAL** - `permitAll()` on sensitive paths (`/admin`, `/actuator`, `/internal`) - `csrf().disable()` on non-stateless APIs (stateful session apps need CSRF) - `@CrossOrigin(origins = "*")` in production controllers - Passwords hashed with MD5, SHA-1, or s