I would like to know if there is a remote way to understand if a web app uses the Spring framework. In particular Spring security.

Is there any kind of analysis on HTTP headers that can provide information about it?

  • If you can get the app to expose stack traces it should be pretty easy to spot spring security filters in the stack.
    – Affe
    Commented Mar 19, 2019 at 22:49

1 Answer 1


Welcome to Security.SE. :)

Yes, there are a few things you can do to find Spring Framework, or more specifically Spring Boot. Spring Security is a little more awkward, but you can look for /login and see what it does. Here's some things I do:

Aside from that, look at the HTML responses. Especially on /login. It has a boilerplate response.

  • Would this be considered a type of fingerprinting then?
    – Daisetsu
    Commented Mar 20, 2019 at 8:19
  • Yes. :) Just a question of where. Some applications have dead giveaways in response headers (X-Powered-By, for example), while others have standard CSS bundlers, like with Ruby on Rails framework.
    – h4ckNinja
    Commented Mar 21, 2019 at 6:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .