Spring Boot 3 REST, Security & JPA Implementation
Production-ready Spring Boot 3 code: REST controllers, Security 6 JWT, JPA without N+1, WebFlux, plus tests and config.
Before & after
Same prompt, same agent — the only difference is the skill.
Here's how you can add JWT authentication to your Spring Boot application: First, you'll need to add the JWT dependency to your pom.xml. Then create a JwtUtil class to generate and validate tokens. You'll also want to create a filter that extends OncePerRequestFilter to intercept requests and validate the token. Finally, configure your SecurityConfig to use the filter. Note that WebSecurityConfigurerAdapter is deprecated in newer versions, so you may need to adjust depending on your Spring Security version. Let me know if you'd like me to expand on any of these steps!
Spring Security 6 — no WebSecurityConfigurerAdapter (removed in 6.x). SecurityFilterChain bean instead.
SecurityConfig.java
@Bean SecurityFilterChain filterChain(HttpSecurity http)
.csrf(AbstractHttpConfigurer::disable)
.sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
.authorizeHttpRequests(a -> a
.requestMatchers("/api/auth/**").permitAll()
.anyRequest().authenticated())
.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
JwtAuthFilter.java extends OncePerRequestFilter
Reads Authorization: Bearer, validates, sets SecurityContextHolder.
Skips the chain on a malformed header rather than throwing — a bad token
is a 401, not a 500.
JwtService.java
HS256, secret from application.yml (not hardcoded), 15-min access token.
application.yml
jwt.secret: ${JWT_SECRET}
jwt.expiration: 900000
TWO THINGS THAT BITE ON 3.x
• spring-boot-starter-security pulls Security 6 — the old adapter class is
gone entirely, not deprecated. Guides written for Boot 2.x won't compile.
• @EnableGlobalMethodSecurity is replaced by @EnableMethodSecurity.
Want the refresh-token rotation endpoint or the JPA UserDetailsService next?About this skill
Your Spring Security config compiles in a tutorial and fails in your Boot 3 app. Your JPA list endpoint fires 200 selects. Your @Transactional silently doesn't roll back. This skill writes Spring Boot 3 code the way an engineer who has debugged those failures in production would, and it reviews your existing code for the same traps.
What it does
- Builds Spring Security 6 filter chains with the lambda DSL and JWT resource-server auth instead of hand-rolled token filters. It also fixes "valid token, still 403" authority-mapping bugs.
- Maps JPA/Hibernate 6 entities that avoid N+1 queries, LazyInitializationException, in-memory pagination, and broken batching.
- Catches transaction traps: self-invocation proxy bypass, checked exceptions that don't trigger rollback, and remote calls made inside a transaction.
- Writes controllers with record DTOs, validation, ProblemDetail errors, correct status codes, and ownership checks that prevent IDOR.
- Tells you when WebFlux is the wrong choice and when virtual threads are the better fit, and keeps reactive code free of blocking calls.
- Ships slice tests with Testcontainers and security test post-processors, plus Boot 2 to 3 migration checklists.
What you get
Working code file by file, with the config properties, the Flyway migration, and a test for the riskiest part. For pasted code, you get a severity-ordered review with concrete fixes.
Best for
Java backend developers building or maintaining Spring Boot 3 services, teams migrating from Boot 2, and reviewers who want security and data-access bugs caught before merge.
SKILL.md preview
---
name: spring-boot-3-rest-security-jpa
description: Writes and reviews Spring Boot 3.x code (REST controllers, Spring Security 6 filter chains and JWT resource servers, Spring Data JPA/Hibernate 6 mappings, transactions, WebFlux endpoints, config and slice tests) and checks each layer against the version-specific traps that break Boot 3 apps in production. Use when the user says "add a JWT-secured endpoint", "set up Spring Security 6", "my JPA list endpoint runs hundreds of selects", "LazyInitializationException again", "my @Transactional isn't rolling back", "valid token but still 403", "migrate us from Spring Boot 2 to 3", "should we use WebFlux", "review my Spring controller".
---
… (sign up to view the full skill)More development skills
View all Development skills →Production Go: Concurrency, Services & Profiling
Production Go code with leak-free goroutines, context-correct services, wrapped errors, and pprof-driven performance fixes.
Backend Feature Build Plan
Builds one backend feature through gates: confirmed requirements, one-screen design, small tested slices, and a deploy/rollback handoff.
Consistent, Safe Application Logging
Adds structured, correlated logs with useful severity, safe fields, bounded volume, and targeted verification.
Reliable WebSocket Messaging and Scaling
Build WebSocket and Socket.IO systems with authorized rooms, reconnect recovery, bounded queues, and multi-node presence.