Could somebody please demonstrate a small code for spring security for StrictHttpFirewall and Websecurity classes? I want to defend against XSS attacks, SQL injections, be it POST or GET, on all the URLs. Where should we instantiate and inject these beans?
All of the attacks you referenced can all be mitigated with user input validation.
SQL Injection can also be mitigated by user input validation. Make sure that if you're looking for a persons name in a variable, you're only allowing characters appropriate for the names you want (no extraneous characters: <, >, $, %, *, etc.). You can also help mitigate this by using a database user who has catered access to the tables in question: SELECT and INSERT but not DELETE, etc.