Real World Example · Security Fundamentals in Spring Security | Spring Security

Securing the ShopEase Basics

Before customers trust ShopEase with their addresses and payments, the team applies the fundamentals from this module. Each item maps to a real incident that has hit Indian and global companies:

Fundamental	ShopEase decision
Password storage	BCrypt (cost 12) via `PasswordEncoder`; never logged, never emailed
Sessions vs tokens	session cookie for the admin web panel; JWT for the React store and Android app (medium level)
HTTPS	TLS at the cloud load balancer, HSTS on, `server.forward-headers-strategy=framework`
CSRF	on for the admin panel (cookies); off for the stateless `/api/**` chain
CORS	only `https://shopease.in` and the local dev origin allowed
Attacks	JPA everywhere (no string SQL), React escapes output, rate limit on `/login`

Production Configuration

Configuration

Cookie and proxy settings for production:

application-prod.yml

server:
  forward-headers-strategy: framework
  servlet:
    session:
      timeout: 30m
      cookie:
        http-only: true
        secure: true
        same-site: lax

Checking the Login Response

Example

A login on the admin panel; notice the hardened cookie and the redirect:

curl -i -X POST https://admin.shopease.in/login \
  -b cookies.txt -c cookies.txt \
  -d "username=ravi&password=Ravi%40Secure2024&_csrf=4f1d0e8a-2b6c-4b0e-9d7a-6c3a1f2e9b55"

Example output

HTTP/1.1 302
Location: https://admin.shopease.in/dashboard
Set-Cookie: JSESSIONID=8C1F4A0D3E2B...; Path=/; Secure; HttpOnly; SameSite=Lax
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
X-Frame-Options: DENY

Exercise: The ShopEase mobile team says: "Our app gets 403 on every POST, but GET works." The app uses a session cookie. What is the most likely cause, and what are two possible fixes?

Show answer

Cause: CSRF protection. POST/PUT/DELETE need a CSRF token, the app does not send one.
Fix 1: read the token (CookieCsrfTokenRepository / an endpoint) and send it in the X-XSRF-TOKEN header.
Fix 2: stop using cookies for the API (HTTP Basic or JWT Bearer tokens) and disable CSRF for the stateless /api/** chain.