spring-projects / spring-projects/spring-security
Consider adding common scenario/pattern based security configurations
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Spring security has a massive number of configuration options and it can be quite overwhelming to know which combination of security configurations to use. It would be nice to provide some out of the box common configuration settings that configure spring security with "reasonable" secure defaults for a specific use case. For example something like CommonSecurityConfigurations.restApi(); should turn on all recommend spring security configuration for securing a rest api without having to configure every setting. A brain storm of possible scenario / pattern based configuration settings:
- configure security for a Rest API
- configure security for a GraphQL API
- configure security for a server side rendered web app
The key goal is to enable the developer to think in terms of higher level capabilities so that they can declare to spring security my app needs pattern x, y, and z and have spring security provide a configuration that is recommend for x,y,z. Ideally the scenarios can be composed together but I am ok if they can't be.
Related gh-13266
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the existing Spring Security configuration options and the related issue gh-13266. Define which common scenarios and secure defaults are in scope, how scenarios should compose, and how the proposed API would be validated. Done means the supported scenario configurations are clearly specified and implemented with appropriate coverage.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100