Spring Security 7.1

Apply the Spring MVC 7.0 baseline first. These rules cover Spring Security 7.1.1.

Filter-chain coverage

• Define ordered SecurityFilterChain beans with explicit securityMatchers; only the first matching chain runs, and a request matching no chain receives no Spring Security protection.
• End with a catch-all chain and anyRequest().authenticated() or an explicit denial; requestMatchers authorize inside a chain but do not expand its securityMatcher.
• Prefer permitAll to WebSecurityCustomizer.ignoring; ignored requests skip the filter chain, security context, and security headers, though the HttpFirewall still validates them.
• Keep the default StrictHttpFirewall; treat setAllowSemicolon, encoded-separator allowances, permissive header or parameter predicates, and especially setUnsafeAllowAnyHttpMethod(true) as parser and policy bypasses requiring container-to-router differential tests.
• Cover request, async, error, and forward dispatches explicitly and test framework error pages and forwards against the intended chain.
• Remember that defining any custom chain replaces Spring Boot's default web security; reproduce every required login, logout, header, CSRF, and Actuator rule.

Method and object authorization

• Enable @EnableMethodSecurity; pre/post annotations are enabled by default, while securedEnabled and jsr250Enabled remain false unless selected.
• Deny or annotate every service entry point intentionally because unannotated methods are allowed and proxy-based interception can be bypassed by self-invocation.
• Authorize tenant,