spring-projects / spring-projects/spring-security

Consider adding common scenario/pattern based security configurations

Open
#13,296 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

theme: partner-use-cases type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Spring security has a massive number of configuration options and it can be quite overwhelming to know which combination of security configurations to use. It would be nice to provide some out of the box common configuration settings that configure spring security with "reasonable" secure defaults for a specific use case. For example something like CommonSecurityConfigurations.restApi(); should turn on all recommend spring security configuration for securing a rest api without having to configure every setting. A brain storm of possible scenario / pattern based configuration settings:

  • configure security for a Rest API
  • configure security for a GraphQL API
  • configure security for a server side rendered web app

The key goal is to enable the developer to think in terms of higher level capabilities so that they can declare to spring security my app needs pattern x, y, and z and have spring security provide a configuration that is recommend for x,y,z. Ideally the scenarios can be composed together but I am ok if they can't be.

Related gh-13266

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the existing Spring Security configuration options and the related issue gh-13266. Define which common scenarios and secure defaults are in scope, how scenarios should compose, and how the proposed API would be validated. Done means the supported scenario configurations are clearly specified and implemented with appropriate coverage.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.