Spring Security Inspector

Current release: 0.2.0

Static analysis for Spring Security configurations — directly in VS Code.

Inspect your Spring Security setup, reconcile controller endpoints with security rules, detect authorization vulnerabilities, and simulate access rights — all without leaving the editor.

✨ Features

📊 Interactive Security Dashboard

Open the full-page dashboard with Spring Security: Open Security Dashboard:

• KPI Cards — Total security matchers, controller endpoints detected, findings by severity, Spring Security version.
• Access Control Matrix — Cross-references every @RestController endpoint with its matched Spring Security rule. Filterable and searchable.
• Request Authorization Simulator — Pick a method (GET, POST…), a path (/api/admin/users) and a role (ROLE_USER), and get an instant ALLOWED / DENIED verdict with the matched rule and reason. Custom expressions are marked manual review required instead of being assumed safe. Runs entirely against your actual security configuration.
• One-click Exports — Generate a full audit report in Markdown or export raw data as JSON.
• CI Export — Export findings as SARIF for GitHub Code Scanning and other CI security tools.
• Findings Tab — All detected issues ranked by severity with CWE links and file locations.

🌲 Security Overview (Activity Bar)

A structured tree view of your entire Spring Security setup:

Click any item to jump directly to the exact file and line in the editor.

🔍 Vulnerability Detection Engine (OWASP / CWE)

⚙️ Controller & Route Reconciliation

The extension automatically reconciles your @RestController endpoints against your SecurityFilterChain rules:

• Resolves full paths by combining class-level @RequestMapping with method-level @GetMapping, @PostMapping, etc.
• Detects endpoints with no explicit matcher (potentially exposed via a catch-all).
• Detects security matchers with no matching controller (dead configuration).
• Supports path variables (/users/{id}), wildcards (/api/**), and multi-pattern matchers (.requestMatchers("/a", "/b")).
• Accounts for method-level security annotations such as @PreAuthorize, @Secured, and @RolesAllowed when identifying protected endpoints.

Custom access(...) expressions are reported as manual review required in the simulator because static analysis cannot safely determine their runtime result.

💡 Quick Fixes & Code Actions

One-click fixes available directly in the editor:

• .anyRequest().permitAll() → .anyRequest().authenticated()
• NoOpPasswordEncoder.getInstance() → new BCryptPasswordEncoder()
• AbstractHttpConfigurer::disable (CSRF) → Customizer.withDefaults()

Also includes CodeLens on @Bean SecurityFilterChain methods and hover tooltips with detailed explanations on matchers and annotations.

🔇 Inline Suppressions

Suppress a specific rule on a line with a comment:

// @ssi-ignore SPRING_SEC_CSRF_DISABLED: Stateless REST API — CSRF not needed
http.csrf(AbstractHttpConfigurer::disable);

Also supported: // @spring-security-ignore RULE_ID

Spring Security Compatibility

Configuration

In VS Code settings (settings.json):

{
  "springSecurityInspector.enableDiagnostics": true,
  "springSecurityInspector.scanOnSave": true,
  "springSecurityInspector.enableCodeLens": true,
  "springSecurityInspector.ignorePatterns": [
    "**/test/**"
  ]
}

Commands

License

MIT — Houssam OUATMANI