Intermediate5 min read
CSRF Protection
How CSRF works, how Spring CsrfFilter stops it, SameSite cookies as a second layer, the double-submit pattern for SPAs, and exactly when disabling CSRF is correct.
Read tutorialSpring Security · Phase 2
Web Security & OWASP Defence
Each major web attack class, how it actually works against a Spring application, and the specific configuration or code that stops it — CSRF, CORS, headers, TLS, injection, XSS, uploads, SSRF and deserialisation.
Intermediate5 min read
CORS Configuration
Understanding the same-origin policy, what preflight actually checks, configuring CORS in Spring correctly, and why allowedOrigins star with credentials is refused.
Read tutorialBeginner5 min read
HTTP Security Headers
Every security header worth setting: what each one prevents, the values to use, Spring configuration, and how to roll out a Content Security Policy without breaking the site.
Read tutorialIntermediate5 min read
SSL/TLS & HTTPS in Spring Boot
Configuring TLS properly: the handshake, keystores and PKCS12, HTTP to HTTPS redirect, mutual TLS for service-to-service, cipher policy, and where to terminate.
Read tutorialIntermediate7 min read
SQL Injection Prevention
How SQL injection actually works, why parameterised queries stop it, the JPA and JdbcTemplate patterns that are safe, the ones that are not, and how to test for it.
Read tutorialIntermediate6 min read
XSS Prevention
Stopping cross-site scripting: the three XSS types, why encoding must be context-aware, Thymeleaf escaping, OWASP Java Encoder, nonce-based CSP and sanitising rich text.
Read tutorialIntermediate6 min read
File Upload Security
Every attack a file upload enables and its defence: extension allowlists, real content-type detection with Tika, path traversal, polyglot files, SVG, and safe serving.
Read tutorialIntermediate6 min read
SSRF Prevention
Stopping server-side request forgery: why cloud metadata endpoints are the prize, validating URLs correctly, defeating DNS rebinding, and egress controls as a second layer.
Read tutorialAdvanced5 min read
Insecure Deserialisation
Why readObject on untrusted data is remote code execution, how gadget chains work, ObjectInputFilter as a mitigation, and the Jackson polymorphic typing configuration to avoid.
Read tutorialAdvanced6 min read
OWASP Top 10 for LLM Applications
Securing AI features in a Spring application: why prompt injection cannot be fully solved, treating model output as untrusted, capability scoping for agents, and cost-based denial of service.
Read tutorial