Why this matters
Aligns with SOC 2 encryption and session security.
Use Spring Security to require HTTPS, enable HSTS, set session fixation protection, and configure SameSite, Secure, HttpOnly cookies.
Aligns with SOC 2 encryption and session security.
Side-by-side examples engineers can pattern-match during review.
@Bean SecurityFilterChain f(HttpSecurity http) throws Exception { return http.build(); }@Bean SecurityFilterChain f(HttpSecurity http) throws Exception { http.requiresChannel(c->c.anyRequest().requiresSecure()).headers(h->h.httpStrictTransportSecurity().includeSubDomains(true).maxAgeInSeconds(31536000)); return http.build(); }http.requiresChannel(c->c.anyRequest().requiresSecure())http.requiresChannel(c->c.anyRequest().requiresInsecure())From the same buckets as this rule.
Public services must require TLSv1.2 or higher and set HSTS (max-age ≥ 15552000, includeSubDomains). Reject plaintext HTTP and weak ciphers; cookies must be Secure and HttpOnly with SameSite set.