Java and Spring Boot: fix cards and security baseline

Keep Spring Security's CSRF protection on (it is the default) and never call csrf.disable() for browser-facing routes.

Get the user from Spring Security with @AuthenticationPrincipal, never from request parameters, and scope every repository query with tenant_id = :tenant AND (owner_id = :user OR :isBillingAdmin).

Refuse backslashes and control characters, then parse next with java.net.URI: return "redirect:" + next only for a path that starts with exactly one slash, or an https URL whose host is in an exact allowlist with no port or user info; otherwise redirect to a fixed page.

Compare real Path objects: base = baseDir.toRealPath(), target = base.resolve(name).toRealPath(), and serve only if target.startsWith(base). toRealPath() collapses ../ and follows symlinks, and Path.startsWith compares whole name elements, so /srv/files-secret fails.

Attach the policy to the connection, not the hostname string.

Declare a CorsConfigurationSource bean whose CorsConfiguration lists the front ends' exact origins from configuration with setAllowedOrigins and sets setAllowCredentials(true), and apply it with CorsFilter or http.cors().

Configure the XML parser to refuse the DTD: in Java set the Apache feature disallow-doctype-decl to true on the DocumentBuilderFactory, so any DOCTYPE is a fatal error and no external entity (CWE-611) or entity expansion (CWE-776) runs.

Generate the token with java.security.SecureRandom: 32 bytes (256 bits) Base64url-encoded.

Use Spring Security's DelegatingPasswordEncoder with an Argon2PasswordEncoder built from explicit parameters, new Argon2PasswordEncoder(16, 32, 1, 19456, 2), because defaultsForSpringSecurity_v5_8() is below OWASP's minimum.

Do not evaluate request input as SpEL with a StandardEvaluationContext: it allows T(...) type references and method calls, so the formula runs code.

Bind text with th:text and attributes with th:attr or th:title, which HTML-escape & < > " and ' — never th:utext for user data.

Spreadsheets run a cell that starts with =, +, -, @, tab or carriage return.

Build the filter with Spring LDAP's LdapQueryBuilder (query().where("cn").is(name)), which puts every value through LdapEncoder.filterEncode (RFC 4515), so * ( ) \ and NUL are matched as data, not parsed as syntax.

Build the process from a List so ProcessBuilder runs it directly - new ProcessBuilder(List.of(tool, "--", name)) - and no shell parses the arguments; the "--" makes a leading-dash operand data, not an option.

Evaluate user templates with a restricted context: SimpleEvaluationContext.forReadOnlyDataBinding() allows only property access on your data, so T(...) type references, constructors and reflection fail.

Bind values with NamedParameterJdbcTemplate: write :name placeholders and pass a MapSqlParameterSource (or use JdbcTemplate with ? and arguments).

Parameterize the XPath. Compile the query with $username and $password variables and supply their values through an XPathVariableResolver, so a value such as ' or '1'='1 is compared as a literal and can never become query structure.

On JDK 9+ java.util.regex memoizes to defuse many catastrophic patterns - but a backreference turns that off, so a nested quantifier backtracks exponentially again, and the engine has no timeout.

Decide the type from the bytes, and never let the client pick the name.

Bind the key from the Spring Environment with @ConfigurationProperties and check it in the record's constructor, so a missing or blank value stops the app at startup.

Never install a TrustManager or HostnameVerifier that accepts everything.

Build the JwtDecoder bean with NimbusJwtDecoder.withPublicKey(key).signatureAlgorithm(RS256) (or withIssuerLocation for rotating keys) and set its validators: JwtValidators.createDefaultWithValidators(timestamps, new JwtIssuerValidator(issuer), new JwtAudienceValidator(audience)), with a JwtTimestampValidator that requires exp.

Verify a credential on the server before any critical route runs.

Let Spring Security sign users in (formLogin or another built-in mechanism) and keep sessionFixation at changeSessionId, the default; a custom login endpoint must invoke the SessionAuthenticationStrategy itself.

Do not deserialize untrusted bytes with ObjectInputStream: its readObject runs code chosen by the payload.

Bind @RequestBody to a record that declares only the fields users may edit (here ProfileUpdate(displayName, bio)), never to the entity, and copy those fields onto the entity yourself.

Encode request values before they reach a log line, turning every control character into a visible escape, or use Spring Boot's structured JSON logging; never delete only LF.