Social Media Ideas for Spring Security

Article: Server-Side DPoP and Token Exchange in Spring Security 7

Spring Authorization Server now lives inside Spring Security 7 under the same Maven coordinates, so the upgrade is a version bump. This server-side guide covers enabling DPoP and R...

Spring Boot SSRF Mitigation with InetAddressFilter

Spring Boot applications often make HTTP requests to external services using clients such as RestClient, WebClient, or other HTTP client implementations. When the application contr...

Авторизация как код, но не в коде: ABAC для Spring Boot на Open Policy Agent

Авторизация в Spring обычно живёт в аннотациях и SpEL — и ломается на иерархии ресурсов и фильтрации списков. Как вынести правила доступа в OPA, не потеряв ни фильтрацию в SQL, ни...

Access Request and Response Body in HandlerInterceptor

In a Spring Boot application, we sometimes need to inspect or log the HTTP request body and response body. This can be useful for debugging, auditing, troubleshooting, or request-r...

Spring News Roundup: Second Milestone Releases of Boot, Framework, Data, Security, Integration

There was a flurry of activity during the week of September 21st, 2026, highlighting: second milestone releases of: Spring Boot, Spring Batch, Spring Security, Spring AMQP, Spring...

A Security Collection for the Security Chapter

Security Baked Into the JVM: no single party controls the outcome

A URL is a name, and names get reused. Replace the bytes behind https://repo.example.org/order-processor.jar and every permission granted to that URL still applies, now to code nob...

Implementing defense-in-depth authorization for MCP tools on Amazon Quick

Learn how to enforce defense-in-depth authorization for Model Context Protocol (MCP) tools on Amazon Quick. This walkthrough wires Microsoft Entra ID group and claims-based JWTs th...

Article: Post-Quantum Cryptography in Spring Boot: Four Patterns You Can Ship This Sprint

There are four patterns that bring PQC into a Spring Boot fleet: encrypting payloads between services, locking down database fields, signing documents that need to hold up for deca...

Spring News Roundup: First Milestone Releases for Boot, Framework, Data, Security, Modulith, Batch

After a 10-week hiatus since the last batch of Spring ecosystem releases, there was a flurry of activity during the week of August 17th, 2026, highlighting first milestone releases...

Dynamic Link Generation Based on OAuth2 User Permissions

Most REST APIs treat pagination and navigation as a solved problem, and then quietly ignore a much messier one: what happens when two different users hit the same endpoint and get...

Safeguarding LLM Output in Spring AI

Learn to create a custom advisor that inspects the model's response before Spring AI ChatClient hands it back to the user. The post Safeguarding LLM Output in Spring AI first appe...

MCP Logging in Spring AI

The Model Context Protocol (MCP) lets an AI application call out to external tools and data sources through a standard client-server interface. When a tool runs on the server, the...

CVE-2026-16723: Pre-Auth RCE in Fastjson 1.x via the @JSONType Trust Branch

Overview CVE ID CVE-2026-16723 Affected Fastjson 1.2.68 – 1.2.83 (every 1.x release still receiving use) Preconditions Spring Boot executable fat-JAR, safeMode disab...

MCP Logging in Spring AI

Learn about MCP logging in Spring AI, both in an MCP server and a client. The post MCP Logging in Spring AI first appeared on Baeldung.