Spring Security 7 implementation for Spring Boot 4. Use when configuring authentication, authorization, OAuth2/JWT resource servers, method security, or CORS/CSRF. Covers the mandatory Lambda DSL migration, SecurityFilterChain patterns, @PreAuthorize, and password encoding. For testing secured endpoints, see spring-boot-testing skill.
/plugin marketplace add joaquimscosta/arkhe-claude-plugins/plugin install spring-boot@arkhe-claude-pluginsThis skill inherits all available tools. When active, it can use any tool Claude has access to.
EXAMPLES.mdTROUBLESHOOTING.mdreferences/authentication.mdreferences/jwt-oauth2.mdreferences/security-config.mdImplements authentication and authorization with Spring Security 7's mandatory Lambda DSL.
| Removed API | Replacement | Status |
|---|---|---|
and() method | Lambda DSL closures | Required |
authorizeRequests() | authorizeHttpRequests() | Required |
antMatchers() | requestMatchers() | Required |
WebSecurityConfigurerAdapter | SecurityFilterChain bean | Required |
@EnableGlobalMethodSecurity | @EnableMethodSecurity | Required |
authorizeHttpRequests() with requestMatchers()@EnableMethodSecurity + @PreAuthorizeSee EXAMPLES.md for complete working examples including:
and() chaining)Argon2PasswordEncoder.defaultsForSpring7()CookieCsrfTokenRepository.withHttpOnlyFalse()@EnableGlobalMethodSecurity| Anti-Pattern | Fix |
|---|---|
Using and() chaining | Use Lambda DSL closures |
antMatchers() | Replace with requestMatchers() |
authorizeRequests() | Replace with authorizeHttpRequests() |
| CSRF disabled without JWT | Keep CSRF for session-based auth |
| Hardcoded credentials | Use environment variables or Secret Manager |
permitAll() on sensitive endpoints | Audit all permit rules |
Missing authenticated() default | End with .anyRequest().authenticated() |
and() chaining in Security 7requestMatchers before general ones@EnableMethodSecurity@WithMockUser and JWT test support (see spring-boot-testing)