42Crunch for Spring Boot

Spring Boot simplifies building REST services, but it does not automatically secure them. Common defaults, such as permissive CORS, exposed actuator endpoints, and verbose error responses, create risk if left unchanged. This section frames how a scanner evaluates a Spring Boot surface and where framework-specific checks matter.

The scanner inspects whether authentication is consistently enforced and whether security headers align with best practices. Checks include verifying JWT configurations such as alg=none, weak algorithms like HS256 where asymmetric verification should be used, expired tokens, missing claims, and sensitive data placed inside claims. It also validates the presence and correctness of WWW-Authenticate headers and security headers such as Content-Security-Policy and X-Content-Type-Options. For Spring Boot, the tool cross-references these findings against the defined security filters to highlight gaps between intended and actual configuration.

If your project exposes an OpenAPI 3.0, 3.1, or Swagger 2.0 document, the scanner parses it with recursive $ref resolution. It compares declared security schemes, paths, and parameters against runtime responses to detect mismatches. Findings include undefined security schemes, deprecated operations, missing pagination on list endpoints, and sensitive fields returned without protection. For Spring Boot applications, this helps verify that annotations and controller mappings align with the published contract and that declared mitigations are reflected in behavior.

With Starter tier and above, authenticated scanning supports Bearer tokens, API keys, Basic auth, and cookies. Access requires domain verification via DNS TXT record or an HTTP well-known file to ensure only the domain owner can submit credentials. The scanner forwards a strict allowlist of headers, including Authorization, X-API-Key, Cookie, and X-Custom-*, to prevent credential leakage. Note that the tool reports findings and does not modify, patch, or block endpoints.

Findings map to OWASP API Top 10 (2023), and where applicable, to SOC 2 Type II and PCI-DSS 4.0 using direct mapping language. The scanner surfaces findings relevant to audit evidence for other frameworks and helps you prepare for security reviews, but it does not certify compliance. It does not perform intrusive injection tests, does not detect business logic flaws that require domain knowledge, and cannot replace a human pentester for high-stakes assessments.