Skip to main content

Java

Ankur in Java

HTTP Client SSRF Mitigation in Spring Boot 4.1: The InetAddressFilter Everyone Will Configure Backwards

Spring Boot 4.1 added InetAddressFilter, a one-bean SSRF control for every auto-configured HTTP client. The release notes call it a way to "block" addresses; the reference documentation says it only allows addresses that match. They are opposite instructions, and acting on the first one produces a service that still leaks internal data and can no longer reach the internet. A working exploit, the allow-versus-block inversion reproduced end to end, why internalAddresses().negate() is not externalAddresses(), how the strength of the filter depends on which HTTP client is on your classpath, and the vararg overload that silently matches nothing.

2 min read
Ankur in Java

Securing Spring Boot Microservices: Token Relay, Service-to-Service JWT and mTLS

Four real processes on Spring Boot 4.1.1 and Spring Security 7.1.1, and one uncomfortable finding: by default a resource server accepts any structurally valid, unexpired token from its issuer, including one minted for a completely different service. Relay, client credentials and RFC 8693 token exchange compared by transcript; what Spring Cloud Gateway's TokenRelay actually relays; and why terminating mTLS in a sidecar takes certificate-bound access tokens off the table.

2 min read
Ankur in Java

CORS, CSRF and SameSite in Spring Boot 4: The Three Settings Everyone Gets Wrong

A preflight rejected by Spring Security looks exactly like a CORS misconfiguration, a CSRF token that never reached the browser looks exactly like a bad credential, and a cookie the browser silently refused to store looks exactly like a server that forgot to send it. Verified against Spring Boot 4.1.1 and Spring Security 7.1.1: why MVC-layer CORS cannot fix a security-layer rejection, the bean name that decides whether your configuration is read at all, what csrf.spa() actually assigns, and why SameSite=None without Secure is not a weaker cookie but no cookie.

2 min read
Ankur in Java

Passkeys and WebAuthn with Spring Security 7: Passwordless Login That Actually Works

Passkeys on Spring Security 7.1 and Spring Boot 4.1: the registration and authentication ceremonies, WebAuthnRelyingPartyOperations, and the one-time-token fallback that solves the bootstrap problem. Every transcript comes from a real run driven by a software authenticator — including the run that shows the signature counter being written on every login and compared against on none, user verification being optional by default, and a request for DIRECT attestation being satisfied by an authenticator that attests to nothing.

2 min read
Ankur in Java

Method Security in Spring Security 7: @PreAuthorize, @PostAuthorize and the Proxy Traps

@PreAuthorize is advice on a proxy, and there are three ways a call reaches an annotated method without the check ever running — self-invocation, methods the proxy cannot override, and @PreFilter handed an immutable collection. A verified tour of Spring Security 7.1 method security: the full SpEL reference, filterObject, interceptor ordering against @Transactional, and the tests that catch a check that silently is not there. Every transcript comes from a runnable companion repository.

2 min read
Ankur in Java

Spring Authorization Server: Running Your Own OAuth2 / OIDC Provider (Spring Boot 4.1)

Building a real OAuth2 / OIDC provider on Spring Boot 4.1 with Spring Authorization Server 7.1: client registration, PKCE, a custom consent page and token customisation, across an authorization server, a relying party and a resource server. The 7.0 move into Spring Security deleted applyDefaultSecurity and relocated both configuration classes, and it flipped the requireProofKey default from false to true on the server and the client alike — verified by compiling against both versions of the jars. Every transcript comes from a run you can reproduce.

2 min read
Ankur in Java

Spring Security OAuth2 Resource Server: JWT Validation, JWKS and Key Rotation

Spring Boot 4.1 and Spring Security 7.1 make a resource server one property long. That property does not validate the audience, cannot see Keycloak's roles, and caches the JWK Set in a way that decides whether a leaked signing key stops working in five minutes or never. Read from the sources, then measured: a retired key accepted indefinitely, and 25 bad tokens producing 25 JWKS fetches at the issuer.

3 min read
Ankur in Java

Spring Security 7.1 JWT Authentication: The Complete Guide (Spring Boot 4.1)

A three-part guide to JWT authentication on Spring Security 7.1 and Spring Boot 4.1, written to be useful whether you have never issued a token or already run one in production. Part 1 starts from zero: what a token is, what is inside it, the two paths through the application, and the smallest configuration that verifies one. Part 2 opens the filter chain — writing the OncePerRequestFilter by hand, where it goes, what really decides 401 versus 403, why a permitAll() login endpoint still returns 403 with CSRF on, and how to choose a signing algorithm. Part 3 is everything the defaults do not check.

2 min read
Ankur in AI & Machine Learning

Spring AI 1.x to 2.0: The Migration Guide (What Breaks, and What Breaks Silently)

A complete Spring AI 1.x to 2.0 migration guide, verified against Spring AI 2.0.0 on Spring Boot 4.1. Boot 4 is mandatory and Jackson moves to 3. internalToolExecutionEnabled and toolNames are removed outright, not renamed. Chat memory becomes stricter: 2.0 removes the remaining default-ID and builder-based configuration paths, while explicit per-request conversation IDs — introduced during the 1.x line — become the only safe migration target. Plus the changes that produce no compile error at all.

1 min read