Java and Spring Security Pitfalls
Spring Security is, in default configuration, one of the more solid authentication and authorization frameworks available. The pitfalls come from the bits developers customize — and developers customize a lot. Here are seven patterns that turn up in Spring code reviews.
Source code · By Thimmagurudu Bathini · Published · 6 min read · Last reviewed
1. Permissive antMatchers
SecurityFilterChain rules with broad permitAll() matchers that accidentally cover sensitive endpoints. antMatchers("/api/**", "/health/**").permitAll() is a typical example, covering more than intended.
2. Method-level security disabled
@EnableGlobalMethodSecurity not enabled, so @PreAuthorize annotations on service methods do nothing. Or method-level security enabled but service methods called from within the application (not through the controller) bypassing the check.
3. CSRF disabled for stateful endpoints
Many Spring tutorials show http.csrf().disable() for REST APIs. Fine for stateless JWT APIs. Wrong for endpoints that use cookies for session.
4. JWT validation too lax
Custom JWT filter that does not pin the algorithm, does not validate expiry, or trusts the JWT payload's user ID without verifying the signature first. Spring Security's resource server module is fine; the home-rolled filters are where bugs hide.
5. Authentication-bypass via H2 console
Spring Boot ships with the H2 console enabled and reachable at /h2-console. In dev, fine. In production, a clear-text database admin panel. Disable explicitly.
6. SpEL injection
Spring Expression Language is a powerful template engine that, given user input as the template, will execute arbitrary code. Anywhere a user-controlled string flows into SpelExpressionParser.parseExpression() is a finding.
7. Logging credentials
Default Spring HTTP request logging at DEBUG level includes the Authorization header. Anyone with access to logs has the bearer token.
See source code review.
Written by Thimmagurudu Bathini, BERRY9 IT SERVICES PRIVATE LIMITED, Hyderabad. Questions about your own systems? Request a scoping call or call +91 86868 92922.
Plan your next security test
Tell us what needs testing and when you need it done, and we will propose a scope and timeline. We respond within 24 hours. If you would rather talk first, call or write to us.
- +91 86868 92922
- contact@berry9.com
- H.No: 8-3-945/A/12 & 13, Sri Venkata Sai Nest Apartments, Nagarjuna Nagar Colony, Yellareddyguda, Hyderabad 500073, Telangana