Spring Boot 4.1

Apply the Java 25 and Spring Framework 7.0 prompts first.

Configuration ownership

• Treat command-line arguments, system properties, environment variables, imported files, and remote configuration as privileged; higher-precedence sources replace packaged security settings.
• Allowlist spring.config.import locations; optional: can hide missing production policy, and configtree: maps mounted filenames into configuration keys.
• Bind security configuration with @Validated @ConfigurationProperties, a Jakarta Validation provider, and @Valid on nested properties, failing on missing production values, with no permissive placeholder defaults for issuer, origin, proxy, TLS, or credentials.
• Keep secrets out of /env, /configprops, startup logs, failure analyzers, build metadata, and image layers, even when Actuator masks values.
• Separate developer and production profiles, and never let request data choose spring.profiles.active, config imports, bean conditions, or feature flags.
• Treat spring.security.oauth2.resourceserver.jwt.authorities-claim-expressions as privileged code: Boot parses each entry as SpEL, which Spring Security evaluates against token claims in a default StandardEvaluationContext allowing type references, constructors, and arbitrary method calls. Set it only from deployment-controlled configuration, never tenant-editable, request, or token-derived values.

Auto-configuration and server boundaries

• A servlet SecurityFilterChain or reactive SecurityWebFilterChain replaces default access rules; provide a complete catch-all chain