From qe-framework
Reviews Spring Boot security best practices: authentication (JWT, OAuth2), authorization (role-based), input validation, CSRF, secrets management, security headers, rate limiting, and dependency scanning.
How this skill is triggered — by the user, by Claude, or both
Slash command
/qe-framework:Qspringboot-securityThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This skill is a **security best practices reference only**. It does NOT auto-modify security configurations.
This skill is a security best practices reference only. It does NOT auto-modify security configurations.
| Request | Correct action |
|---|---|
| "Review security checklist", "security review" | This skill — provide checklist and recommendations |
| "Change security configuration", "Add CSRF configuration" | NOT this skill — use standard code implementation with this skill's recommendations as reference |
Use when adding authentication, handling input, creating endpoints, or managing secrets.
httpOnly, Secure, SameSite=Strict cookies for sessionsOncePerRequestFilter@Component
public class JwtAuthFilter extends OncePerRequestFilter {
private final JwtService jwtService;
public JwtAuthFilter(JwtService jwtService) {
this.jwtService = jwtService;
}
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
FilterChain chain) throws ServletException, IOException {
String header = request.getHeader(HttpHeaders.AUTHORIZATION);
if (header != null && header.startsWith("Bearer ")) {
String token = header.substring(7);
Authentication auth = jwtService.authenticate(token);
SecurityContextHolder.getContext().setAuthentication(auth);
}
chain.doFilter(request, response);
}
}
@EnableMethodSecurity@PreAuthorize("hasRole('ADMIN')") or @PreAuthorize("@authz.canEdit(#id)")@PreAuthorize("hasRole('ADMIN')")
@GetMapping("/users")
public List<UserDto> listUsers() { return userService.findAll(); }
@PreAuthorize("@authz.isOwner(#id, authentication)")
@DeleteMapping("/users/{id}")
public ResponseEntity<Void> deleteUser(@PathVariable Long id) {
userService.delete(id);
return ResponseEntity.noContent().build();
}
@Valid@NotBlank, @Email, @Sizepublic record CreateUserDto(
@NotBlank @Size(max = 100) String name,
@NotBlank @Email String email,
@NotNull @Min(0) @Max(150) Integer age
) {}
@PostMapping("/users")
public ResponseEntity<UserDto> createUser(@Valid @RequestBody CreateUserDto dto) {
return ResponseEntity.status(HttpStatus.CREATED).body(userService.create(dto));
}
// BAD: string concatenation
@Query(value = "SELECT * FROM users WHERE name = '" + name + "'", nativeQuery = true)
// GOOD: parameter binding
@Query(value = "SELECT * FROM users WHERE name = :name", nativeQuery = true)
List<User> findByName(@Param("name") String name);
// GOOD: Spring Data derived query
List<User> findByEmailAndActiveTrue(String email);
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder(12);
}
http.csrf(csrf -> csrf.disable())
.sessionManagement(sm -> sm.sessionCreationPolicy(SessionCreationPolicy.STATELESS));
# BAD: hardcoded
spring:
datasource:
password: mySecretPassword123
# GOOD: environment variable
spring:
datasource:
password: ${DB_PASSWORD}
http.headers(headers -> headers
.contentSecurityPolicy(csp -> csp.policyDirectives("default-src 'self'"))
.frameOptions(HeadersConfigurer.FrameOptionsConfig::sameOrigin)
.xssProtection(Customizer.withDefaults()));
* in production@Bean
public CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration config = new CorsConfiguration();
config.setAllowedOrigins(List.of("https://app.example.com"));
config.setAllowedMethods(List.of("GET", "POST", "PUT", "DELETE"));
config.setAllowCredentials(true);
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/api/**", config);
return source;
}
Core principle: default deny, validate inputs, least privilege, prefer config-driven security.
npx claudepluginhub inho-team/qe-framework --plugin qe-frameworkCreates, edits, and optimizes skills for Claude Code, including drafting, evaluating with test prompts, iterating on performance, and improving skill descriptions for better triggering accuracy.