Fix Insecure API Management in Spring Boot

@RestController
@RequestMapping("/api/internal/users")
public class UserOpsController {
    @Autowired
    private UserRepository userRepository;
// VULNERABILITY: No authentication, no rate limiting, and direct IDOR/BOLA risk
@GetMapping("/{id}")
public User getUser(@PathVariable Long id) {
    return userRepository.findById(id).orElseThrow();
}

// VULNERABILITY: Sensitive Actuators exposed in application.properties
// management.endpoints.web.exposure.include=*
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {
    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        return http
            .csrf(csrf -> csrf.disable())
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/v1/public/**").permitAll()
                .requestMatchers("/api/v1/users/**").authenticated()
                .requestMatchers("/actuator/health").permitAll()
                .anyRequest().denyAll())
            .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))
            .build();
    }
}
@RestController
@RequestMapping(“/api/v1/users”)
public class UserOpsController {
@GetMapping(”/{id}”)
@PreAuthorize(“#id == authentication.principal.claims[‘user_id’] or hasRole(‘ADMIN’)”)
public UserDTO getUser(@PathVariable Long id) {
// Logic with Rate Limiting (e.g., Bucket4j) and DTO projection
return service.findByIdSecurely(id);
}
}