OWASP Top 10 for Spring Apps

The OWASP Top 10 is the industry list of the most common web application risks. Here is each one with what to do in a Spring Boot app:

// BAD: customerId and price come from the request
@PostMapping("/api/orders")
public Order place(@RequestBody OrderRequest req) {
    return orderService.create(req.customerId(), req.items(), req.totalPrice());
}

// GOOD: identity from the token, prices from the database
@PostMapping("/api/orders")
public OrderDto place(@AuthenticationPrincipal Jwt jwt, @Valid @RequestBody PlaceOrderRequest req) {
    return orderService.create(jwt.getSubject(), req.items());   // service loads each Product.price itself
}

management:
  endpoints:
    web:
      exposure:
        include: health, info, prometheus     # never "*" in production
  endpoint:
    health:
      show-details: when-authorized
server:
  error:
    include-stacktrace: never
    include-message: never

.requestMatchers(EndpointRequest.to(HealthEndpoint.class, InfoEndpoint.class)).permitAll()
.requestMatchers(EndpointRequest.toAnyEndpoint()).hasRole("OPS")