Spring for Apache Kafka 4.1

Last reviewed Sep 11, 2026

Export as PDF

Prompt Details

Prompt Composition

4prompts
  1. Java 25113 lines · 2.8K tokens
  2. Spring Framework 7.070 lines · 2.4K tokens
  3. Spring Boot 4.162 lines · 2.7K tokens
  4. Spring for Apache Kafka 4.156 lines · 1.6K tokens
Total301 lines · 9.5K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 295
  • 297
  • 306
  • 319
  • 323
  • 327
  • 338
  • 346
  • 347
  • 352
  • 362
  • 367
  • 378
  • 409
  • 427
  • 470
  • 471
  • 494
  • 502
  • 524
  • 532
  • 611
  • 653
  • 681
  • 732
  • 749
  • 770
  • 772
  • 776
  • 789
  • 807
  • 829
  • 862
  • 863
  • 913
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333

Prompt Preview

Apply the Spring Boot 4.1 baseline first. These rules cover Spring Kafka 4.1.1 serialization, listeners, acknowledgments, retries, transactions, and dead-letter topics.

Cluster and topic boundaries

  • Configure bootstrap servers, security protocol, SASL mechanism, JAAS data, trust stores, and topic names from trusted deployment configuration, never message or request content.
  • Require TLS hostname verification and broker authentication, and grant producers, consumers, transactional IDs, and admin clients only the topic/group operations they need.
  • Use fixed or allowlisted producer topics; routing by model output, record headers, or request data can cross tenant and data-classification boundaries.
  • Separate consumer groups, topics, keys, and transactional ID prefixes by trust domain, and make every instance's transaction ID prefix unique.
  • Treat Kafka headers as attacker-controlled metadata unless an authenticated producer contract explicitly protects them.

JSON and type handling

  • Prefer a fixed target type and TYPE_MAPPINGS; call ignoreTypeHeaders() or setUseTypeHeaders(false) with the default type mapper when producers must not select the Java type, and restrict custom type mappers and resolvers separately.
  • Never configure spring.json.trusted.packages=* or trustedPackages("*"); JacksonJsonDeserializer initially trusts only java.util and java.lang and automatically adds target and mapped classes' packages and subpackages. Treat TYPE_MAPPINGS as token translation, not a closed class allowlist.
  • Remember that JSON type headers are used by