spring-security

Deny by default, permit explicitly, test as an attacker.

Activate when

Adding login, JWT/OAuth2 resource-server setup, method security, CSRF/CORS, session handling, or password storage to Spring apps.

Non-Spring auth (see backend/authentication); general service structure (see frameworks/spring-boot).

Version: detect Spring Boot/Security generation from build files; research in https://docs.spring.io/spring-security/reference/ for THAT generation (configuration style changed across generations — never copy config across generations without checking).
Architecture: filter chain explicit; authorization rules most-specific-first with deny-by-default tail; method security (@PreAuthorize) for service boundaries, URL rules for coarse gates.
Authentication: form/oauth2Login for interactive, JWT validation for resource servers (issuer/audience/expiry enforced, JWKS cached); passwords with adaptive hashing (bcrypt/scrypt/argon2, work factor reviewed); sessions with fixation protection, concurrency limits, and logout invalidation.
CSRF/CORS: CSRF tokens for cookie/session flows (disabled only for stateless token APIs, deliberately); CORS allowlisted origins/methods/headers, never * with credentials.
Secrets/headers: credentials externalized; security headers enabled; error responses free of stack traces and user-enumeration oracles.
Testing: @WithMockUser/@WithUserDetails for slices plus at least one full-chain test per critical rule; cross-user access tests fail closed.
Verify: unauthenticated, low-privilege, and cross-tenant probes against every new endpoint; config diff reviewed line by line.

Permit-all ordering mistakes; CSRF disabled globally; JWT accepted without issuer/audience checks; method security enabled nowhere (annotation present, enforcement off).

Registry: ../../research/documentation-search/references/framework-registry.yaml (spring-security, spring-boot, oauth, oidc).
Related: ../spring-boot/, ../../backend/authorization/, ../../security/secure-baseline/.