This article explains how to define token retrieval methods as pytest fixtures to reuse authentication tokens across multiple test cases, ensuring fresh tokens for each test and demonstrating fixture scope, cleanup, and global usage patterns.
This article explains HTTPS from the ground up, covering one‑way and two‑way authentication, the SSL/TLS handshake, asymmetric and symmetric encryption, digital signatures and hashes, key exchange, and the role of digital certificates and revocation in ensuring confidentiality, integrity, and authenticity.
This article explains the fundamentals of JSON Web Tokens (JWT), compares token‑based authentication with traditional session authentication, outlines common security threats such as theft, replay, and forgery, and presents practical measures—including HTTPS, encryption, secure storage, short lifetimes, two‑factor authentication, and safe token refresh—to protect token integrity in modern web applications.
This article demonstrates how to generate, store, and validate login tokens for both PC and mobile clients in a distributed micro‑service architecture using Spring Boot, Redis, custom annotations, AOP verification, and a Vue front‑end that manages token lifecycle and expiration.
This article explains how to implement invisible token refresh for authentication servers using Spring Boot gateway filters, JWT handling, Axios interceptors, and a client‑side timer, compares client‑ and server‑side approaches, and provides complete code examples and practical recommendations.
This article explains how JWT provides stateless user authentication while Session adds an extra security layer and state management, detailing their respective roles, the reasons for using Session alongside JWT, and offering Java code examples that illustrate their combined implementation.
This article explains the fundamentals of JSON Web Tokens (JWT), compares token-based authentication with traditional session methods, outlines common security threats such as theft, replay and forgery, and provides practical measures—including HTTPS, encryption, proper storage, expiration policies, and two-factor authentication—to safeguard token integrity.
This article explains the fundamentals of JSON Web Tokens (JWT), compares token-based authentication with traditional session methods, outlines common security threats such as theft, replay and forgery, and provides practical mitigation measures including HTTPS, encryption, secure storage, short lifetimes, two‑factor authentication, and safe token refresh strategies.
The article explains JWT fundamentals, shows how to integrate it with SpringBoot, compares JWT with a Token‑plus‑Redis approach, and argues why using JWT alone can be problematic in a system that already relies on Redis for session management.
This guide explains the JWT standard, its three‑part structure, the authentication flow, and a double‑token solution using short‑lived access tokens and long‑lived refresh tokens, with full PHP code examples, middleware interception, configuration, and client‑side renewal logic.
This tutorial walks through RBAC fundamentals, model classifications (RBAC0‑3), permission and user‑group concepts, then demonstrates practical Spring Security setups including in‑memory authentication, JWT integration, JSON‑based login, password encryption with BCrypt, and database‑backed authentication, providing complete code examples.
This tutorial explains how to use PHP's LDAP functions—ldap_connect, ldap_bind, ldap_search, and ldap_get_entries—to establish a connection to an LDAP server, bind an administrator account, and perform user authentication with example code for each step.
This article provides an in‑depth analysis of Spring Security 6.x architecture, explaining its filter‑chain design, authentication and authorization mechanisms, key components such as DelegatingFilterProxy, FilterChainProxy, SecurityFilterChain, and offers code examples and practical guidance for developers.
This article explains traditional session‑based authentication, introduces JWT and JJWT usage with Java code examples, and compares two microservice authentication designs—service‑side verification and API‑gateway unified verification—while discussing their trade‑offs, challenges, and practical implementation tips.
This article explains how to implement seamless, invisible token refresh for authentication systems, covering client‑side strategies using Axios interceptors and timers, server‑side gateway filters with Spring Boot, code examples for detecting token expiration, obtaining new tokens, and choosing between client and server approaches based on security and performance considerations.
This article explains how to implement invisible token refresh for authentication systems, covering server‑side gateway filtering in Spring Boot, client‑side Axios interceptors, timer‑based proactive checks, and practical code examples to address token expiration, parsing, and renewal challenges.
This article explains the concepts and models of Role‑Based Access Control (RBAC), demonstrates how to configure Spring Security for in‑memory and JWT‑based authentication, and provides complete Java code examples for permissions, user groups, password encryption, and custom login filters.
This article explains the OAuth 2.0 authorization framework, its core concepts, architecture, key roles, and implementation patterns for web, user‑agent, and native applications, helping readers grasp how delegated access works without sharing user credentials.
This article provides a comprehensive analysis of Spring Security 6's architecture, explaining how the framework uses a chain of servlet Filters, the DelegatingFilterProxy, and the SecurityFilterChain to implement authentication, authorization, and protection against common attacks, while also offering practical debugging tips and configuration guidance.
This article explains the key changes in Spring Boot 3, outlines the new OAuth2 components, and provides a detailed design for secure microservice authentication and authorization using Spring Authorization Server, JWT, API Gateway, and client applications, complete with architecture diagrams and implementation steps.
The article explains how HTTP’s stateless nature requires session or token mechanisms for preserving user state, compares session‑based and JWT token authentication, details JWT structure, and provides Java code examples for generating, verifying, and extracting token information, while also promoting related services.
This article demonstrates how to use PHP's LDAP functions to connect to an LDAP server, bind with credentials, and authenticate users by searching the directory, providing complete example code for each step.
This article explains what JSON Web Tokens are, outlines their typical workflow, and critically examines their drawbacks—including size overhead, redundant signatures, revocation challenges, lack of encryption, and broader security concerns—before concluding with practical recommendations for their use.
The article examines JWT's benefits such as statelessness and CSRF protection, then details its drawbacks—including revocation difficulty, XSS risk, and token size—and presents practical solutions like blacklists, short lifetimes, and refresh‑token strategies, helping readers decide when to use JWT versus session‑based authentication.
This article explains how Istio provides comprehensive security for microservices by using traffic encryption, flexible access control, TLS, mutual authentication, JWT request validation, and fine‑grained authorization policies, enabling zero‑trust networking across Kubernetes and other environments.
This article explains the OAuth2.0 authorization protocol, distinguishes it from single sign‑on, describes its core entities and step‑by‑step flow, and outlines how web servers, user agents, and native applications interact to securely obtain access tokens for protected resources.
MySQL 9.0, released July 2 2024, introduces EXPLAIN JSON output stored in variables, native EVENT DDL statements, and two new performance‑schema tables for variable metadata, while deprecating the old variables_info columns and removing the mysql_native_password plugin in favor of caching_sha2_password, enhancing observability and security.
This article explains the evolution from traditional cookie‑session authentication to token‑based JWT, detailing its structure, security mechanisms, implementation steps, advantages, limitations, and practical Java code examples, while also comparing it with modern authentication challenges in web and mobile environments.
This article explains the core architecture of Spring Security 6.x, detailing how a chain of servlet Filters implements authentication and authorization, the role of DelegatingFilterProxy, SecurityFilterChain, and the extensible components such as AuthenticationManager, UserDetailsService, and PasswordEncoder.
This article provides a comprehensive analysis of Spring Security 6.1, covering its core architecture, the role of FilterChainProxy, detailed authentication and authorization flows, key interfaces such as SecurityFilterChain, AuthenticationManager, and practical code examples to help developers understand and debug the framework.
This article explains the concept, definitions, and three deployment types of Single Sign-On (SSO), introduces the Central Authentication Service (CAS) mechanism, and details step‑by‑step login and logout processes across multiple web applications, illustrating each flow with diagrams and examples.
This article provides a comprehensive walkthrough of Single Sign‑On (SSO) concepts, common protocols, login flow diagrams, and multiple implementation options, then dives into step‑by‑step deployment of an enterprise‑grade SSO system using Keycloak with Docker or Kubernetes, including configuration, client setup, custom extensions, and practical code snippets.
This tutorial walks you through installing Laravel 11, adding Sanctum for API authentication, creating migrations, models, resources, controllers, and routes, and finally testing the API with Postman, providing complete code snippets and configuration details for a functional backend.
This tutorial walks through generating certificates, configuring kubeconfig, creating regular users, assigning roles and role bindings, using static token authentication, and managing ClusterRoles in a Kubernetes cluster to enforce the principle of least privilege.
A former NCS QA engineer in Singapore, feeling wronged after his dismissal, illegally accessed the company's internal systems, wrote malicious scripts, and deleted 180 virtual servers, causing $678,000 in losses and prompting security experts to stress the importance of account deactivation, continuous monitoring, and the impact of employee emotions on corporate security.
This article explains how HTTP's stateless nature requires session or token mechanisms for preserving user state, compares session‑based and JWT‑based authentication, details JWT structure, and provides a complete Java implementation with code examples.
This article explains the fundamentals of Role‑Based Access Control (RBAC), its model classifications, permission concepts, and user‑group usage, then demonstrates how to implement RBAC in a Spring Security application, including in‑memory authentication, JWT integration, JSON login, and password encryption techniques.
This article traces the evolution of login authentication across system architectures—from monolithic apps using cookies and sessions, through front‑end/back‑end separation and CORS, to distributed systems employing SSO and stateless JWT, highlighting their mechanisms, challenges, and trade‑offs.
This tutorial explains how to use PHP's LDAP functions to connect to an LDAP server, bind with credentials, and authenticate users by searching the directory and verifying passwords, providing complete code examples for each step.
This comprehensive guide walks you through the concepts of Single Sign-On, the mechanics of JWT, RSA asymmetric encryption, and step‑by‑step integration of Spring Security with JWT, providing full Maven project setup, configuration files, utility classes, custom filters, and testing instructions for a robust distributed authentication system.
This article explains the fundamentals of role‑based access control (RBAC), its model variants, and user‑group usage, then demonstrates how to configure Spring Security with in‑memory authentication, integrate JWT for stateless token‑based authentication, customize JSON login, and securely encrypt passwords using BCrypt.
This article provides a comprehensive guide to using Python's requests library for API testing, covering basic GET/POST requests, error handling, authentication, and concurrent requests with practical code examples.
This guide explains the security challenges of WebSocket, outlines a step‑by‑step JWT authentication flow, and presents three practical token‑passing techniques—including URL parameters, post‑connection messages, and sub‑protocols—while emphasizing the use of wss:// and safe token storage.
MaxKey is an enterprise‑grade single sign‑on solution that supports OAuth 2.x, OpenID Connect, SAML 2.0, JWT, CAS and SCIM, offering secure identity management, RBAC, multi‑tenant capabilities, robust password policies, brute‑force protection, session control, and BCrypt‑based password encryption.
This article explains how a data security governance platform protects data across its entire lifecycle—from warehouse construction and collection to application—by implementing fine‑grained permission controls, encryption, masking, authentication, and comprehensive auditing, while addressing scalability, high availability, and regulatory compliance challenges.
This article explains what a bastion host (jump server) is, why it evolved from traditional jump servers, its core 4A design (authentication, authorization, account, audit), deployment options, common features, authentication methods, and how open‑source and commercial solutions differ, helping organizations improve security and compliance.
This article explains how to implement user authentication and role‑based authorization in PHP, covering password hashing with password_hash/password_verify, database queries for credential verification, and conditional logic for granting access based on user roles, with sample code snippets illustrating each step.
This article explains what JWT and Session are, compares their storage, state management, security, performance, cross‑domain support, expiration, use cases, logout mechanisms, and one‑time use scenarios, and helps you decide which authentication approach best suits your application’s needs.
This article walks through a complete security design for third‑party APIs, covering API‑key generation, request signing with timestamps and nonces, token handling, permission granularity, database schema, and practical implementation details such as rate limiting, idempotency, and TLS encryption.
This article walks through Spring Security fundamentals, covering authentication mechanisms, authorization configuration, dependency setup, custom user details with database integration, and how to replace the default login page with a custom one, all illustrated with code snippets and screenshots.
This article walks through eight concrete techniques—firewall rules, captchas, authentication checks, IP whitelists, HTTPS encryption, rate limiting, monitoring, and an API gateway—to prevent abusive requests from draining resources or compromising critical services.
This article explains how session‑based and token‑based (JWT) authentication work in backend applications, compares their workflows, shows practical Express.js code examples, and helps you decide which method best fits your project's security and scalability needs.
This article explains the motivations behind RocketMQ ACL 2.0, outlines its six major enhancements—including fine‑grained API permissions, flexible matching modes, and cluster‑wide access control—details the RBAC/ABAC model, authentication and authorization workflows, configuration examples, command‑line usage, and migration strategies, and discusses future planning for the access control system.
This article explains how to use PHP's LDAP functions to connect to an LDAP server, bind with credentials, and authenticate users, providing step‑by‑step code examples for each stage.
Websites cannot reveal original passwords because they store only salted, one‑way hashes, not the plaintext, making recovery impossible; therefore, when users forget their credentials, the secure approach is to verify identity and issue a password reset rather than expose any stored data.
The article explains the drawbacks of token pass‑through in microservice authentication, advocates explicit parameter passing, outlines unified gateway authentication with Feign or Dubbo, explores Kubernetes‑integrated deployment options, and concludes with a promotional invitation to a technical community.
This article compares JWT and session authentication, explains their differences, advantages, and drawbacks, and provides a complete Java implementation with Redis integration, token generation, validation, renewal, and related interceptor configuration for a robust backend authentication system.
This article explains the principles of Single Sign‑On (SSO) and OAuth2.0, compares their workflows, describes the main steps of each protocol, outlines the four OAuth2.0 grant types, and clarifies the distinctions between SSO, OAuth2.0, JWT, and Java security frameworks.
This article explains why user authentication is essential for mobile mini‑programs, outlines security measures using AccessToken and RefreshToken, and provides step‑by‑step techniques—including automatic login, token refresh, request queuing, and user‑state handling—to achieve a frictionless user experience.
Alibaba Cloud Log Service’s traditional STS password‑less login suffers from slow load times, fixed session limits, cross‑origin cookie restrictions, and hard‑to‑debug flows, prompting SLS to introduce a new ticket‑based authentication that streamlines access, extends sessions, improves security, and enables one‑click dashboard sharing.
QR‑code login lets a already‑authenticated mobile app scan a code shown on a PC, using a server‑issued token tied to the user’s account and device ID; the scan creates a temporary token, the user confirms, and a permanent token is issued to the PC, enabling password‑less, secure authentication.
This article explains the technical principles behind QR code login, covering QR code basics, token‑based authentication, the step‑by‑step flow between mobile and PC, and security considerations, providing a clear guide for developers implementing secure scan‑to‑login systems.
This article explains the Central Authentication Service (CAS) single sign‑on system, detailing its token‑based architecture, the roles of the CAS server, client, and protected services, and outlines typical scenarios such as e‑commerce, enterprise intranets, online platforms, and cloud services.
This article explains why invisible token refresh is needed, describes backend automatic token renewal using Java JWT, provides full Maven dependencies and JwtUtil implementation, shows unit‑test examples, and discusses frontend token extension strategies and edge‑case handling.
This article explains a comprehensive set of techniques—including firewalls, captchas, authentication checks, IP whitelists, data encryption, rate limiting, monitoring, and API gateways—to protect interfaces from malicious abuse and ensure secure, reliable service operation.
The IPAddresses field in a server certificate restricts its validity to specific IPs, adding an extra verification layer to TLS connections, which enhances security but requires careful management of IP changes, especially in dynamic or large‑scale cloud environments.
This article walks through the fundamentals of HTTP session handling, the challenges of session sharing in clustered environments, and presents a step‑by‑step design of a Single Sign‑On solution using CAS, including concrete code examples, Redis‑based session storage, and a comparison with OAuth2.
The article explains why passing tokens between microservices is a poor design, proposes exposing explicit userId parameters, describes unified authentication via an API gateway with Feign, Dubbo or Spring Boot Web implementations, compares their pros and cons, and shows how to integrate these patterns with Kubernetes and internal API path rules.
Single Sign-On (SSO) lets users log in once to access multiple trusted applications, and this article explains its necessity, core components like CAS Server, Client, and Service, the authentication flow, and common use cases in e‑commerce, enterprises, education, and finance.
The article critiques token pass‑through for microservice authentication, explains why internal APIs should stay stateless, and presents unified authorization patterns using Spring Cloud Gateway with Feign, Dubbo, or a gateway‑less design, plus Kubernetes integration and trade‑offs.
This guide explains how Spring Security configuration changed after version 5.7, covering the shift from WebSecurityConfigurerAdapter to SecurityFilterChain beans, multiple filter chain setup, in‑memory user definitions, custom authorization decisions, and shared authentication components, with full code examples.
This article provides a comprehensive overview of API security, covering authentication and authorization, privacy and encryption, input validation, detection, rate limiting, logging, secure coding, vulnerability management, lifecycle phases, and the importance of education and training to protect modern software ecosystems.
This article explains how to install the PHP‑JWT library with Composer, generate JSON Web Tokens using JWT::encode, validate them with JWT::decode, and configure custom expiration and not‑before times to enhance authentication security in PHP applications.
This article demonstrates how to replace heavyweight Spring Security with the lightweight Sa-Token framework by configuring token generation, session management, role and permission retrieval, and global gateway filters in a Spring Cloud micro‑service architecture, including complete code examples and deployment tips.
This article demonstrates how to replace heavyweight Spring Security with the lightweight Sa-Token framework by configuring token generation, session storage in Redis, service discovery via Nacos, and permission checks in a Spring Cloud Gateway micro‑service architecture, complete with code examples and deployment settings.
This article explains how to use Spring Boot Security for authentication and improve performance by caching user details in Redis, covering dependency setup, security configuration, Redis integration, testing endpoints, and optimization tips for a robust backend authentication solution.
This article explains the concept, workflow, and step‑by‑step implementation of a seamless token refresh mechanism, providing code examples and security best practices to keep user sessions alive without interruption while maintaining strong protection against token theft and replay attacks.
This article explains how to design and implement a token generation, storage, and verification system for both PC and mobile clients in a distributed microservice architecture, using Spring Boot, Redis, custom annotations, AOP aspects, and Vue front‑end integration.
An in‑depth Spring Security guide covering custom configurations, authentication providers, user‑details services, path‑based authorization, role hierarchies, exception handling, custom filters, multiple filter chains, method security, internationalization, and session management, complete with practical code examples for Spring Boot 2.7.
This article explains the essential components of user authentication architecture, covering its importance, core principles, registration, login, session management, popular protocols like OAuth, OpenID Connect, SAML, JWT, and critical security considerations for robust protection.
This article explains the concept, advantages, and implementation methods of Single Sign‑On (SSO) and provides two complete hands‑on examples—including architecture diagrams, database schema, configuration, and Java code for token‑based, ticket‑based, and RSA/AES encrypted SSO flows—using SpringBoot, Vue and Uni‑App.
This article explains how to handle sudden login redirects caused by expired JWT access tokens in a web platform by using Axios response interceptors to automatically refresh tokens, queue failed requests, and retry them without disrupting the user experience.
This article introduces the ten most noteworthy Laravel packages for 2024, covering authentication, markdown rendering, real‑time UI, image processing, debugging, search, Excel import/export, queue handling, localization, and automatic API generation, each with concise explanations and code examples.
This guide explains how to add user impersonation to a Laravel application using the Lab404 Impersonate package, covering installation, service provider registration, session handling, helper functions, routing, and API methods for starting and ending impersonation sessions.
JustAuth is a Java library that simplifies third‑party OAuth login by providing unified interfaces, customizable state, scopes, HTTP clients, and support for dozens of platforms, with clear code examples for quick integration such as QQ login.
This article explains the concept, advantages, and three implementation methods of Single Sign-On (SSO), then provides two complete practical examples—including architecture diagrams, step‑by‑step flows, and full Java code for ticket‑based and encrypted data‑based SSO—followed by supplementary RSA key generation notes and a brief promotional note.
This article explains why WebSocket security matters, outlines authentication and authorization gaps, describes the Cross‑Site WebSocket Hijacking (CSWSH) attack, and provides practical PHP code for origin validation and signature‑based authentication to protect high‑concurrency WebSocket services.
SSH (Secure Shell) is a widely used network security protocol that replaces insecure methods like Telnet and FTP by encrypting data and authenticating users, typically operating on port 22, and employing both symmetric and asymmetric encryption, key exchange, and various authentication methods such as passwords and public‑key pairs.
This comprehensive guide walks you through setting up Spring Security in a Spring Boot project, configuring password encoding, implementing JWT-based authentication, building custom login and logout endpoints, managing user details with MyBatis Plus, and applying role‑based access control with custom permission handlers, all illustrated with complete code examples.
This article explains how to design a scalable multi‑account login system, covering self‑built phone‑number authentication, optimized password‑less flows, third‑party integrations such as Weibo and WeChat, a refactored user‑basic and authorization schema, and the steps for implementing one‑click carrier‑based login.
This article explains the SSH protocol, covering its default port, the step‑by‑step process of establishing a secure connection, the role of symmetric and asymmetric encryption, and how password and public‑key authentication work with tools like PuTTY and OpenSSH.
This article explains how the OpenAPI specification standardizes interfaces and improves security by using AppId/AppSecret pairs, RSA‑based signatures, timestamp and nonce mechanisms, parameter validation, rate limiting, and encryption best practices, accompanied by complete Java code examples.
This article outlines the design of a flexible multi‑account authentication system, covering self‑built phone‑number registration, optimized password‑less login, integration of third‑party providers such as Weibo and WeChat, a split user/base‑authorization database schema, and a carrier‑based one‑click login flow.
This guide explains how to use Postman's pre‑request and test scripts to automate request signing, switch between multiple environments, and handle JWT‑based authentication, providing step‑by‑step instructions, execution order details, and practical code snippets.
This article explains how to use OpenAPI standards to standardize interfaces, generate unique AppId/AppSecret pairs, create RSA‑based signatures, and implement practical security measures such as timestamps, nonces, rate limiting, and data validation, all illustrated with full Java code examples.
This article explains why using JSON Web Tokens for session management is unsafe, detailing misconceptions about their benefits, highlighting security, scalability, and usability drawbacks, and finally outlining appropriate use cases such as short‑lived one‑time authorization tokens.
This guide explains the limitations of traditional session authentication, introduces JSON Web Token (JWT) as a scalable cross‑domain solution, and provides step‑by‑step instructions for installing, configuring, generating, and validating JWTs in PHP applications, including supported algorithms and practical code examples.
SSH (Secure Shell) is a widely used network security protocol that replaces insecure methods like Telnet and FTP, operating over default port 22, supporting key exchange, encryption algorithms, multiple authentication methods, and session management, with tools such as PuTTY and OpenSSH for client connections.
This article explains how PHP sessions and cookies work together to manage user data, improve authentication, shopping carts, and personalization, providing code examples and best practices for secure, seamless web application development.
This article explains JWT payload claims, lists standard and custom claims, shows how to generate a token with expiration in Java, and compares single‑token and double‑token renewal strategies—including OAuth 2.0 approaches and Redis‑based storage—to manage token expiration securely.
