Spring Boot 安全最佳实践 | 刘恩义的技术博客

在当今数字化时代，应用安全已经成为开发过程中不可或缺的一部分。Spring Boot 作为主流的 Java 开发框架，提供了强大的安全功能，特别是通过 Spring Security 模块。本文将详细介绍 Spring Boot 应用的安全最佳实践，包括认证授权、密码加密、CSRF 保护、CORS 配置、安全头设置、依赖安全等核心安全概念与实现方案，帮助你构建安全可靠的 Spring Boot 应用。

1. Spring Security 概述

1.1 什么是 Spring Security？

Spring Security 是一个功能强大且高度可定制的身份验证和访问控制框架，它是保护 Spring 应用的事实标准。Spring Security 提供了全面的安全服务，包括认证、授权、攻击防护等。

1.2 Spring Security 的核心功能

认证：验证用户身份
授权：控制用户对资源的访问权限
攻击防护：防止常见的安全攻击，如 CSRF、XSS、点击劫持等
会话管理：管理用户会话
密码加密：安全地存储密码
集成 OAuth2 和 OpenID Connect：支持第三方认证

2. 认证最佳实践

2.1 用户名/密码认证

配置示例：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeRequests(authorize -> authorize
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .formLogin(form -> form
                .loginPage("/login")
                .permitAll()
            )
            .logout(logout -> logout
                .permitAll()
            );
        return http.build();
    }
    
    @Bean
    public UserDetailsService userDetailsService() {
        return username -> {
            // 从数据库或其他存储中获取用户信息
            User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
            
            return org.springframework.security.core.userdetails.User
                .withUsername(user.getUsername())
                .password(user.getPassword())
                .roles(user.getRoles().toArray(new String[0]))
                .build();
        };
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

2.2 OAuth2 认证

依赖：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-oauth2-client</artifactId>
</dependency>

配置示例：

spring:
  security:
    oauth2:
      client:
        registration:
          github:
            client-id: ${GITHUB_CLIENT_ID}
            client-secret: ${GITHUB_CLIENT_SECRET}
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope:
              - user:email
              - read:user
          google:
            client-id: ${GOOGLE_CLIENT_ID}
            client-secret: ${GOOGLE_CLIENT_SECRET}
            redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
            scope:
              - email
              - profile

安全配置：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeRequests(authorize -> authorize
                .requestMatchers("/public/**").permitAll()
                .anyRequest().authenticated()
            )
            .oauth2Login(oauth2 -> oauth2
                .loginPage("/login")
                .defaultSuccessURL("/home")
            );
        return http.build();
    }
}

2.3 JWT 认证

依赖：

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.11.5</version>
</dependency>

JWT 工具类：

@Component
public class JwtUtil {
    private final String secretKey = "your-secret-key";
    private final long expirationTime = 86400000; // 24小时
    
    public String generateToken(String username) {
        Date now = new Date();
        Date expiryDate = new Date(now.getTime() + expirationTime);
        
        return Jwts.builder()
            .setSubject(username)
            .setIssuedAt(now)
            .setExpiration(expiryDate)
            .signWith(SignatureAlgorithm.HS256, secretKey)
            .compact();
    }
    
    public String extractUsername(String token) {
        return Jwts.parser()
            .setSigningKey(secretKey)
            .parseClaimsJws(token)
            .getBody()
            .getSubject();
    }
    
    public boolean validateToken(String token) {
        try {
            Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token);
            return true;
        } catch (Exception e) {
            return false;
        }
    }
}

JWT 过滤器：

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Autowired
    private JwtUtil jwtUtil;
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {
        String authorizationHeader = request.getHeader("Authorization");
        
        if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
            String token = authorizationHeader.substring(7);
            String username = jwtUtil.extractUsername(token);
            
            if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
                UserDetails userDetails = userDetailsService.loadUserByUsername(username);
                
                if (jwtUtil.validateToken(token)) {
                    UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities()
                    );
                    authenticationToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                    SecurityContextHolder.getContext().setAuthentication(authenticationToken);
                }
            }
        }
        
        filterChain.doFilter(request, response);
    }
}

安全配置：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .authorizeRequests(authorize -> authorize
                .requestMatchers("/api/auth/**").permitAll()
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}

3. 授权最佳实践

3.1 基于角色的授权

配置示例：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/user/**").hasRole("USER")
            .requestMatchers("/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        );
    return http.build();
}

3.2 基于权限的授权

配置示例：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/read/**").hasAuthority("READ")
            .requestMatchers("/write/**").hasAuthority("WRITE")
            .anyRequest().authenticated()
        );
    return http.build();
}

3.3 基于表达式的授权

配置示例：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .authorizeRequests(authorize -> authorize
            .requestMatchers("/public/**").permitAll()
            .requestMatchers("/user/{id}").access("@userSecurity.checkUserId(authentication, #id)")
            .anyRequest().authenticated()
        );
    return http.build();
}

@Component("userSecurity")
public class UserSecurity {
    public boolean checkUserId(Authentication authentication, Long id) {
        User user = (User) authentication.getPrincipal();
        return user.getId().equals(id) || user.hasRole("ADMIN");
    }
}

3.4 方法级安全

启用方法级安全：

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class MethodSecurityConfig {
}

使用示例：

@RestController
@RequestMapping("/api/users")
public class UserController {
    @Autowired
    private UserService userService;
    
    @PreAuthorize("hasRole('USER')")
    @GetMapping("/me")
    public User getCurrentUser() {
        return userService.getCurrentUser();
    }
    
    @PreAuthorize("hasRole('ADMIN') or @userSecurity.checkUserId(authentication, #id)")
    @GetMapping("/{id}")
    public User getUser(@PathVariable Long id) {
        return userService.getUserById(id);
    }
    
    @PreAuthorize("hasAuthority('WRITE')")
    @PostMapping
    public User createUser(@RequestBody User user) {
        return userService.createUser(user);
    }
    
    @Secured("ROLE_ADMIN")
    @DeleteMapping("/{id}")
    public void deleteUser(@PathVariable Long id) {
        userService.deleteUser(id);
    }
}

4. 密码安全最佳实践

4.1 密码加密

推荐的密码加密算法：

BCrypt：默认推荐，自适应哈希函数，工作因子可调整
Argon2id：最新推荐，抵抗 GPU 破解，内存硬化
PBKDF2：基于 HMAC 的密钥派生函数

配置示例：

@Bean
public PasswordEncoder passwordEncoder() {
    // 使用 BCrypt，工作因子为 12
    return new BCryptPasswordEncoder(12);
}

// 或使用 Argon2id
@Bean
public PasswordEncoder passwordEncoder() {
    return new Argon2PasswordEncoder();
}

// 或使用 PBKDF2
@Bean
public PasswordEncoder passwordEncoder() {
    return new Pbkdf2PasswordEncoder("secret", 64, 10000, SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA256);
}

4.2 密码策略

推荐的密码策略：

长度：至少 12 个字符
复杂度：包含大小写字母、数字和特殊字符
定期更换：建议每 90 天更换一次密码
历史记录：防止使用最近使用过的密码
锁定策略：多次登录失败后锁定账户

实现示例：

@Component
public class PasswordValidator {
    public void validate(String password) {
        if (password.length() < 12) {
            throw new IllegalArgumentException("Password must be at least 12 characters long");
        }
        if (!password.matches("^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@$!%*?&])[A-Za-z\\d@$!%*?&]$")) {
            throw new IllegalArgumentException("Password must contain at least one uppercase letter, one lowercase letter, one number, and one special character");
        }
    }
}

5. 攻击防护最佳实践

5.1 CSRF 保护

启用 CSRF 保护：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .csrf(csrf -> csrf
            .csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse())
        );
    return http.build();
}

在表单中使用 CSRF 令牌：

<form th:action="@{/submit}" method="post">
    <input type="hidden" th:name="${_csrf.parameterName}" th:value="${_csrf.token}" />
    <!-- 其他表单字段 -->
    <button type="submit">Submit</button>
</form>

在 AJAX 请求中使用 CSRF 令牌：

const token = document.querySelector('meta[name="_csrf"]').getAttribute('content');
const header = document.querySelector('meta[name="_csrf_header"]').getAttribute('content');

fetch('/api/data', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        [header]: token
    },
    body: JSON.stringify(data)
});

5.2 XSS 防护

使用 Thymeleaf 自动转义：

<!-- Thymeleaf 会自动转义内容 -->
<p th:text="${userInput}"></p>

<!-- 如果需要输出原始 HTML，使用 th:utext -->
<div th:utext="${safeHtml}"></div>

使用 Content-Security-Policy 头：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .headers(headers -> headers
            .contentSecurityPolicy(csp -> csp
                .policyDirectives("default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:")
            )
        );
    return http.build();
}

5.3 CORS 配置

配置示例：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .cors(cors -> cors
            .configurationSource(corsConfigurationSource())
        );
    return http.build();
}

@Bean
public CorsConfigurationSource corsConfigurationSource() {
    CorsConfiguration configuration = new CorsConfiguration();
    configuration.setAllowedOrigins(Arrays.asList("http://localhost:3000", "https://example.com"));
    configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
    configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type"));
    configuration.setAllowCredentials(true);
    UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
    source.registerCorsConfiguration("/**", configuration);
    return source;
}

5.4 点击劫持防护

配置示例：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .headers(headers -> headers
            .frameOptions(frame -> frame
                .deny()
            )
        );
    return http.build();
}

5.5 安全头设置

配置示例：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .headers(headers -> headers
            .contentTypeOptions(contentType -> contentType.disable())
            .xssProtection(xss -> xss.headerValue(1).block(false))
            .cacheControl(cache -> cache.disable())
            .httpStrictTransportSecurity(hsts -> hsts
                .includeSubDomains(true)
                .preload(true)
                .maxAgeInSeconds(31536000)
            )
            .contentSecurityPolicy(csp -> csp
                .policyDirectives("default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:")
            )
        );
    return http.build();
}

6. 依赖安全最佳实践

6.1 依赖版本管理

使用 Spring Boot 依赖管理：

<parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.3.0</version>
    <relativePath/>
</parent>

使用依赖管理插件：

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>3.4.0</version>
    <executions>
        <execution>
            <id>enforce-dependency-versions</id>
            <goals>
                <goal>enforce</goal>
            </goals>
            <configuration>
                <rules>
                    <requireUpperBoundDeps/>
                </rules>
            </configuration>
        </execution>
    </executions>
</plugin>

6.2 依赖安全扫描

使用 OWASP Dependency Check：

<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>8.4.0</version>
    <executions>
        <execution>
            <goals>
                <goal>check</goal>
            </goals>
        </execution>
    </executions>
</plugin>

使用 Snyk：

# 安装 Snyk CLI
npm install -g snyk

# 扫描项目
snyk test

# 监控依赖
snyk monitor

6.3 定期更新依赖

使用 Maven 依赖更新插件：

<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>versions-maven-plugin</artifactId>
    <version>2.16.0</version>
    <configuration>
        <generateBackupPoms>false</generateBackupPoms>
    </configuration>
</plugin>

运行依赖更新检查：

# 检查可用更新
mvn versions:display-dependency-updates

# 更新到最新版本
mvn versions:use-latest-releases

7. 生产环境最佳实践

7.1 HTTPS 配置

在 application.properties 中配置：

server.port=8443
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=password
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=tomcat

强制使用 HTTPS：

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
        .requiresChannel(channel -> channel
            .anyRequest().requiresSecure()
        );
    return http.build();
}

7.2 环境变量和密钥管理

使用环境变量：

@Configuration
public class DatabaseConfig {
    @Value("${DB_URL}")
    private String dbUrl;
    
    @Value("${DB_USERNAME}")
    private String dbUsername;
    
    @Value("${DB_PASSWORD}")
    private String dbPassword;
    
    @Bean
    public DataSource dataSource() {
        DriverManagerDataSource dataSource = new DriverManagerDataSource();
        dataSource.setUrl(dbUrl);
        dataSource.setUsername(dbUsername);
        dataSource.setPassword(dbPassword);
        return dataSource;
    }
}

使用 Spring Cloud Config：

spring:
  cloud:
    config:
      uri: ${CONFIG_SERVER_URL}
      username: ${CONFIG_SERVER_USERNAME}
      password: ${CONFIG_SERVER_PASSWORD}

使用 Vault：

<dependency>
    <groupId>org.springframework.cloud</groupId>
    <artifactId>spring-cloud-starter-vault-config</artifactId>
</dependency>

spring:
  cloud:
    vault:
      uri: ${VAULT_URL}
      token: ${VAULT_TOKEN}
      kv:
        enabled: true
        backend: secret
        default-context: application
        profile-separator: /

7.3 日志安全

配置日志脱敏：

<appender name="CONSOLE" class="ch.qos.logback.core.ConsoleAppender">
    <encoder class="net.logstash.logback.encoder.LogstashEncoder">
        <fieldNames>
            <message>message</message>
            <timestamp>timestamp</timestamp>
            <logger>logger</logger>
            <thread>thread</thread>
            <level>level</level>
            <stack_trace>stack_trace</stack_trace>
        </fieldNames>
        <customFields>{"app":"${spring.application.name}","env":"${spring.profiles.active}"}</customFields>
    </encoder>
</appender>

<logger name="org.springframework.security" level="WARN"/>
<logger name="org.springframework.web" level="WARN"/>

防止敏感信息泄露：

@RestControllerAdvice
public class ControllerAdvice {
    @ExceptionHandler(Exception.class)
    public ResponseEntity<ErrorResponse> handleException(Exception e) {
        // 记录异常但不返回详细信息给客户端
        log.error("An error occurred", e);
        
        ErrorResponse errorResponse = new ErrorResponse();
        errorResponse.setMessage("An internal error occurred");
        errorResponse.setStatus(HttpStatus.INTERNAL_SERVER_ERROR.value());
        
        return new ResponseEntity<>(errorResponse, HttpStatus.INTERNAL_SERVER_ERROR);
    }
}

7.4 监控和审计

使用 Spring Boot Actuator：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-actuator</artifactId>
</dependency>

配置 Actuator：

management:
  endpoints:
    web:
      exposure:
        include: "health,info,metrics,auditevents"
  endpoint:
    health:
      show-details: when_authorized
      roles: ACTUATOR
    auditevents:
      enabled: true

配置审计：

@Configuration
@EnableWebSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeRequests(authorize -> authorize
                .requestMatchers("/actuator/**").hasRole("ACTUATOR")
                .anyRequest().authenticated()
            )
            .httpBasic(Customizer.withDefaults());
        return http.build();
    }
    
    @Bean
    public AuditEventRepository auditEventRepository() {
        return new InMemoryAuditEventRepository();
    }
}

8. 实战案例：安全的 REST API

8.1 功能需求

构建一个安全的 REST API
支持用户名/密码认证
支持 JWT 认证
实现基于角色的授权
提供用户注册、登录、查询等功能
防止常见的安全攻击

8.2 技术栈

Spring Boot 3.3
Spring Security 6.2
JWT
Spring Data JPA
PostgreSQL
Spring Boot Actuator

8.3 实现

用户实体：

@Entity
@Table(name = "users")
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String email;
    private String password;
    @ElementCollection(fetch = FetchType.EAGER)
    @CollectionTable(name = "user_roles", joinColumns = @JoinColumn(name = "user_id"))
    @Column(name = "role")
    private Set<String> roles = new HashSet<>();
    // getters and setters
}

用户仓库：

public interface UserRepository extends JpaRepository<User, Long> {
    Optional<User> findByUsername(String username);
    Optional<User> findByEmail(String email);
}

认证控制器：

@RestController
@RequestMapping("/api/auth")
public class AuthController {
    @Autowired
    private AuthService authService;
    
    @PostMapping("/register")
    public ResponseEntity<User> register(@RequestBody RegisterRequest request) {
        User user = authService.register(request);
        return ResponseEntity.status(HttpStatus.CREATED).body(user);
    }
    
    @PostMapping("/login")
    public ResponseEntity<AuthResponse> login(@RequestBody LoginRequest request) {
        AuthResponse response = authService.login(request);
        return ResponseEntity.ok(response);
    }
}

认证服务：

@Service
public class AuthService {
    @Autowired
    private UserRepository userRepository;
    @Autowired
    private PasswordEncoder passwordEncoder;
    @Autowired
    private JwtUtil jwtUtil;
    
    public User register(RegisterRequest request) {
        // 检查用户名是否已存在
        if (userRepository.findByUsername(request.getUsername()).isPresent()) {
            throw new BadRequestException("Username already exists");
        }
        
        // 检查邮箱是否已存在
        if (userRepository.findByEmail(request.getEmail()).isPresent()) {
            throw new BadRequestException("Email already exists");
        }
        
        // 创建新用户
        User user = new User();
        user.setUsername(request.getUsername());
        user.setEmail(request.getEmail());
        user.setPassword(passwordEncoder.encode(request.getPassword()));
        user.getRoles().add("ROLE_USER"); // 默认角色
        
        return userRepository.save(user);
    }
    
    public AuthResponse login(LoginRequest request) {
        // 查找用户
        User user = userRepository.findByUsername(request.getUsername())
            .orElseThrow(() -> new UnauthorizedException("Invalid username or password"));
        
        // 验证密码
        if (!passwordEncoder.matches(request.getPassword(), user.getPassword())) {
            throw new UnauthorizedException("Invalid username or password");
        }
        
        // 生成 JWT 令牌
        String token = jwtUtil.generateToken(user.getUsername());
        
        return new AuthResponse(token, user);
    }
}

用户控制器：

@RestController
@RequestMapping("/api/users")
public class UserController {
    @Autowired
    private UserService userService;
    
    @PreAuthorize("hasRole('USER')")
    @GetMapping("/me")
    public User getCurrentUser() {
        return userService.getCurrentUser();
    }
    
    @PreAuthorize("hasRole('ADMIN')")
    @GetMapping
    public List<User> getAllUsers() {
        return userService.getAllUsers();
    }
    
    @PreAuthorize("hasRole('ADMIN') or @userSecurity.checkUserId(authentication, #id)")
    @GetMapping("/{id}")
    public User getUser(@PathVariable Long id) {
        return userService.getUserById(id);
    }
    
    @PreAuthorize("hasRole('ADMIN')")
    @DeleteMapping("/{id}")
    public void deleteUser(@PathVariable Long id) {
        userService.deleteUser(id);
    }
}

安全配置：

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(prePostEnabled = true)
public class SecurityConfig {
    @Autowired
    private JwtAuthenticationFilter jwtAuthenticationFilter;
    @Autowired
    private UserDetailsService userDetailsService;
    
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable())
            .cors(cors -> cors.configurationSource(corsConfigurationSource()))
            .authorizeRequests(authorize -> authorize
                .requestMatchers("/api/auth/**").permitAll()
                .requestMatchers("/actuator/health").permitAll()
                .requestMatchers("/actuator/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
            .headers(headers -> headers
                .contentSecurityPolicy(csp -> csp
                    .policyDirectives("default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:")
                )
                .frameOptions(frame -> frame.deny())
                .httpStrictTransportSecurity(hsts -> hsts
                    .includeSubDomains(true)
                    .preload(true)
                    .maxAgeInSeconds(31536000)
                )
            );
        return http.build();
    }
    
    @Bean
    public CorsConfigurationSource corsConfigurationSource() {
        CorsConfiguration configuration = new CorsConfiguration();
        configuration.setAllowedOrigins(Arrays.asList("http://localhost:3000"));
        configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS"));
        configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type"));
        configuration.setAllowCredentials(true);
        UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
        source.registerCorsConfiguration("/**", configuration);
        return source;
    }
    
    @Bean
    public UserDetailsService userDetailsService() {
        return username -> {
            User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
            
            return org.springframework.security.core.userdetails.User
                .withUsername(user.getUsername())
                .password(user.getPassword())
                .roles(user.getRoles().stream().map(role -> role.replace("ROLE_", "")).toArray(String[]::new))
                .build();
        };
    }
    
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder(12);
    }
}

9. 安全最佳实践总结

9.1 认证与授权

使用强密码加密：使用 BCrypt 或 Argon2id 加密密码
启用多因素认证：为敏感操作启用多因素认证
使用 OAuth2/OpenID Connect：对于第三方认证，使用标准协议
基于最小权限原则：只授予用户必要的权限
使用方法级安全：对敏感方法使用 @PreAuthorize 等注解

9.2 攻击防护

启用 CSRF 保护：对于基于会话的认证，启用 CSRF 保护
配置 CORS：限制跨域请求
设置安全头：使用 Content-Security-Policy、X-XSS-Protection 等头
防止点击劫持：使用 X-Frame-Options 头
使用 HTTPS：在生产环境中使用 HTTPS

9.3 依赖与配置

定期更新依赖：及时更新有安全漏洞的依赖
扫描依赖安全：使用 OWASP Dependency Check 等工具扫描依赖
使用环境变量：避免硬编码敏感信息
使用密钥管理服务：对于生产环境，使用 Vault 等密钥管理服务
配置管理：使用 Spring Cloud Config 等配置管理服务

9.4 监控与审计

使用 Spring Boot Actuator：监控应用健康状态
启用审计：记录重要操作的审计日志
配置日志脱敏：防止敏感信息出现在日志中
监控异常：及时发现和处理异常
定期安全评估：定期进行安全评估和渗透测试

10. 总结

Spring Boot 提供了强大的安全功能，特别是通过 Spring Security 模块。通过本文的学习，你应该已经掌握了 Spring Boot 应用的安全最佳实践，包括认证授权、密码加密、CSRF 保护、CORS 配置、安全头设置、依赖安全等核心安全概念与实现方案。

安全是一个持续的过程，而不是一次性的任务。你需要不断学习和更新安全知识，及时了解最新的安全漏洞和防护措施，定期进行安全评估和渗透测试，确保你的 Spring Boot 应用始终保持安全。

通过遵循本文介绍的最佳实践，你可以构建更加安全可靠的 Spring Boot 应用，保护用户数据和系统资源，提高用户信任度和满意度。