The full picture
// ❌ Binding straight to the entity:
@PostMapping("/users") // {"name":"x","role":"ADMIN"} …
User create(@RequestBody User user) { // attacker sets ANY field
return repo.save(user);
}
// ✅ A DTO that lists exactly what a client may set:
public record CreateUserRequest(@NotBlank String name, @Email String email) {}
@PostMapping("/users")
UserDto create(@Valid @RequestBody CreateUserRequest req) {
return UserDto.from(service.register(req.name(), req.email()));
} // role/tenant/id are assigned by CODE, never by input- Supply chain:
bom.json(CycloneDX plugin) + OWASP Dependency-Check/Snyk in CI + Renovate auto-PRs + an org SLA ('critical CVE patched fleet-wide in 72h'). The Log4Shell question is really 'could you find and patch every affected service in a day?' - Injection breadth: JPQL/SQL concatenation (even 'internal' values), LDAP/command injection in integrations, and log injection (encode user input in logs — protects log4j-style parsing and SIEM integrity).
- SSRF: any user-influenced outbound fetch (webhooks, image URLs, importers) gets scheme/host allowlists + no redirects-to-internal + metadata-endpoint blocking — cloud-credential theft via 169.254.169.254 is the canonical kill chain.
- Headers & posture: HSTS, X-Content-Type-Options, minimal CSP for any served HTML; generic error bodies (your ProblemDetail work doubles as info-leak prevention); TLS everywhere including service-to-service (mesh/mTLS).
- Detection: authz failures, authn anomalies and admin actions to structured audit logs → SIEM; an attack you can't see is one you can't answer for.