Explaining Basics API Security Enchancements in Spring Boot Applications

Nikita Blud — Tue, 17 Mar 2026 16:39:16 +0000

Introduction:

Welcome to this article. You will learn how to enhance API security in Spring Boot applications. We will focus on preventing common vulnerabilities.

Requirements:

Before starting, ensure you have:

Basic knowledge of Java and Spring Boot
A Spring Boot application for testing
An Integrated Development Environment (IDE) like IntelliJ IDEA or Eclipse
Postman or similar tool for API testing

1. Securing API Endpoints

Spring Security is a powerful framework. It helps to secure our Spring Boot applications. We will use it to secure our API endpoints.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
            .antMatchers("/api/**").authenticated()
            .and()
            .httpBasic();
    }
}

Usage:
This code secures all API endpoints under "/api". Only authenticated users can access them. To test, try accessing an API endpoint without authentication. You should receive a 401 Unauthorized response.

2. Preventing Cross-Site Request Forgery (CSRF)

CSRF is a common vulnerability. We can prevent it using Spring Security's built-in CSRF protection.

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests()
            .antMatchers("/api/**").authenticated()
            .and()
            .httpBasic();
    }
}

Usage:
This code disables CSRF protection. It is useful when our API is stateless. Stateless APIs are not vulnerable to CSRF attacks.

3. Enabling CORS for Specific Domains

CORS is a security feature. It prevents requests from unknown domains. We can allow specific domains using Spring's CORS configuration.

@Configuration
public class WebConfig implements WebMvcConfigurer {
    @Override
    public void addCorsMappings(CorsRegistry registry) {
        registry.addMapping("/api/**")
            .allowedOrigins("http://trusted-domain.com");
    }
}

Usage:
This code allows CORS requests from "trusted-domain com". Other domains will receive a CORS error. Test this by making a request from a different domain.

Conclusion:

You have learned to improve API security in Spring Boot. We covered securing endpoints, preventing CSRF, and enabling CORS. Next, try applying these techniques to your own Spring Boot application.

Stop Writing Micrometer Boilerplate in Spring Boot

Nikita Blud — Mon, 16 Mar 2026 19:04:54 +0000

If you use Micrometer in Spring Boot you know this problem.

@Timed works great. But the moment you need a gauge you have to write this:

public OrderService(MeterRegistry registry) {
    Gauge.builder("orders.active", activeOrders, AtomicInteger::get)
         .register(registry);
}

Inject MeterRegistry. Create a field. Write a builder. Repeat for every metric.

So I built Metrify. Let me know what do you think

What it does

Metrify is a Spring Boot starter that adds the annotations Micrometer is missing.

<dependency>
    <groupId>io.github.wtk-ns</groupId>
    <artifactId>metrify-spring-boot-starter</artifactId>
    <version>0.1.0</version>
</dependency>

You don't need extra configuration of additional @Enable annotaion

@MetricGauge
java@MetricGauge(name = "orders.active")
public int getActiveOrderCount() {
    return orders.size();
}

Works on fields too:

@MetricGauge(name = "connections.active")
private final AtomicInteger connections = new AtomicInteger(0);

@MetricCounter

@MetricCounter(name = "orders.created")
public Order createOrder(OrderRequest request) { ... }

Dynamic tags via SpEL

@MetricCounter(
    name = "orders.processed",
    dynamicTags = {
        @MetricTag(key = "region", expression = "#order.region")
    }
)
public void processOrder(Order order) { ... }

@CachedGauge
For calls you do not want running on every Prometheus scrape:

@CachedGauge(name = "db.connections", ttl = 30, ttlUnit = TimeUnit.SECONDS)
public int getConnectionCount() {
    return dataSource.getActiveConnections();
}

Startup tag validation
If you register the same metric name with different tag keys in two places. Micrometer silently fails. Metrify tells you at startup:

ERROR: Metric 'orders.processed' has inconsistent tag keys.
  OrderService   -> [region, tier]
  LegacyService  -> [region]

One thing to know about @MetricGauge on methods
It caches the last returned value. Prometheus gets that cached value at scrape time.

If you need a true real time gauge. Use field annotation with AtomicInteger or AtomicLong instead. That is a live reference and always reflects the current value.

Why Micrometer does not have this

The Micrometer team decided it should stay a low level facade. Not an annotation framework. That is a fair call. But it left a gap.
The old metrics-spring library had @Gauge and more. It has not been updated since 2016 and does not work with Spring Boot 3.
Metrify fills that gap for modern Spring Boot.

GitHub: https://github.com/wtk-ns/metrify-spring-boot-starter
Feedback and PRs are welcome.

DEV Community: Nikita Blud