This article walks through the requirements, backend API design, and front‑end implementation—including TypeScript code snippets—for a QR‑code login system where the code expires after two minutes, users confirm login on mobile, and the web client polls for status updates.
This article explains how to generate, store, and validate login tokens across PC and mobile clients in a distributed microservice architecture, covering Redis storage, custom token entities, Spring service implementation, exception handling, client‑side storage utilities, and a custom annotation with an AOP aspect for request verification.
This article explains the three-stage design of a QR code login system—including pending scan, scanned‑pending‑confirmation, and confirmed phases—detailing how unique QR IDs, token exchange, and user confirmation ensure secure authentication across PC and mobile devices.
This article outlines practical strategies for building a flexible multi‑account login architecture, covering traditional phone‑number/password registration, optimized password‑less flows, integration of third‑party providers such as Weibo, WeChat and QQ, a unified user‑base and authorization schema, and the implementation of carrier‑based one‑click authentication.
This tutorial explains digital certificate fundamentals, common formats, the principles of one‑way and two‑way HTTPS authentication, and provides step‑by‑step Kubernetes configurations—including secret creation and Ingress setup—to implement secure TLS communication.
This article compares storing authentication tokens in cookies versus the Authorization header, outlining each method's implementation, advantages, drawbacks, security implications such as XSS and CSRF risks, cross‑domain considerations, and compliance with authentication standards.
This tutorial explains how to integrate Spring Security with JWT in a Spring Boot application, covering authentication and authorization concepts, filter chain principles, project setup, dependency configuration, security configuration classes, custom token filters, and the complete request‑authentication flow.
Didi hardened its massive Elasticsearch deployment—spanning 66 clusters and thousands of nodes—by adding a custom security plugin that authenticates requests at the cluster level, implementing a one‑click toggle and staged rolling upgrades, ultimately enabling authentication across all clusters and dramatically reducing data‑leak risk.
This article explains the technical principles behind QR code login, covering QR code basics, token‑based authentication, the step‑by‑step workflow between mobile and PC, and security considerations for implementing a reliable cross‑device sign‑in system.
This article provides a comprehensive introduction to OAuth 2.0, its core concepts, advantages and disadvantages, details four authorization flows, and presents step‑by‑step Java Spring Boot implementations for GitHub, QQ, and WeChat third‑party login, including database design considerations and code examples.
This guide walks through designing a User_Token table, defining roles and APIs, implementing QR‑code generation and validation endpoints, and wiring a Spring Boot WebSocket server with front‑end AJAX to achieve secure, real‑time QR‑code login for Android, web and PC clients.
This article explains the concepts, architecture, core tickets, and practical implementation steps of CAS-based Single Sign-On, including detailed API specifications, security considerations, and example code snippets for integrating SSO across multiple applications.
This tutorial explains how to secure a Spring Boot REST API using API‑key authentication by adding the necessary Maven dependency, creating a custom filter, extending AbstractAuthenticationToken, configuring Spring Security, implementing a controller, and testing the endpoint with and without the API key.
This article surveys the most common API security flaws—including information disclosure, broken object‑level and function‑level authorization, over‑exposure of data, missing rate limits, mass‑assignment, misconfigurations, injection attacks, improper asset management, and business‑logic bugs—providing examples, code snippets, and practical testing tips for security professionals.
This article outlines a comprehensive approach to building a scalable multi‑account login system that supports phone‑number/password, phone‑number/verification‑code, and various third‑party OAuth providers, detailing workflow steps, database schema, advantages, drawbacks, and a one‑click login integration.
This article explains what Kubernetes Ingress is, its core components, how to define Ingress rules with YAML, and provides practical examples using the Nginx Ingress Controller, including TLS support and basic authentication, to help manage traffic routing and load balancing in cloud‑native environments.
This article explains Spring Security's core functions, underlying filter‑based mechanism, various request‑access control methods, the distinction between hasRole and hasAuthority, how to encrypt passwords with BCryptPasswordEncoder, and the complete username‑password authentication process for securing backend applications.
This article explains how to move authentication from the gateway to individual Spring Cloud microservices by defining three custom annotations and an AOP aspect, while also covering Feign‑based calls and providing practical code examples for implementation.
This article explains the principles, structure, and workflow of token‑based authentication—including access and refresh tokens, JWT, CSRF attacks, same‑origin policy, cross‑origin solutions, and common encryption algorithms—highlighting their advantages, limitations, and practical usage in modern web and mobile applications.
This article explains OceanBase's MySQL‑compatible security features, covering the MAPI authentication process, user naming conventions, password complexity and expiration settings, and mechanisms for handling repeated login failures, with detailed comparisons to MySQL.
This article explains how the default title of the open‑source ChatGPT‑web project makes deployments vulnerable to discovery by asset‑search engines like FOFA and Shodan, leading to unauthorized API usage, and provides practical steps—changing the title and adding authentication—to protect the site and prevent unexpected costs.
This article introduces FACE-UI, a front‑back separated web application that implements facial login by capturing a photo via the browser, sending it to a Spring Boot backend, and using Tencent Cloud's face comparison API for authentication, with full setup instructions and code examples.
This tutorial explains how to build a PHP-based single sign‑on system using a main login application, a shared authentication service backed by MySQL and Redis, and multiple external applications, providing complete code examples for database setup, login handling, session sharing, and logout.
This article explains why remote access to industrial control systems is essential, outlines the risks demonstrated by high‑profile attacks, and provides detailed best‑practice guidance—including DMZ architecture, authentication, jump hosts, file transfer, and policies for direct connections—to securely manage OT environments.
This article introduces Sa-Token, a lightweight Java permission authentication framework, explains why it was chosen over Spring Security and Shiro, details its core login and permission APIs, demonstrates integration with Spring Boot and WebFlux, and lists its extensive feature set for modern backend development.
This article explains OAuth2 fundamentals, key terminology, and authorization flows, then guides you through setting up database tables, Spring Boot dependencies, resource and authorization server configurations, multiple grant types, token refresh, permission checks, and common pitfalls, providing complete code snippets and diagrams for a practical implementation.
This article introduces the lightweight Sa-Token Java framework, explains its login and permission authentication mechanisms, demonstrates essential API usage with code examples, and provides step‑by‑step integration guides for SpringBoot and WebFlux, covering configuration, session handling, role checks, wildcard permissions, and global exception handling.
This article explains the most frequent API security weaknesses—including information disclosure, broken object‑level and function‑level authorization, authentication bypass, over‑exposure of data, missing rate limits, mass‑assignment, misconfiguration, injection, asset mismanagement, and business‑logic flaws—providing detection techniques and illustrative code examples.
This article compares JWT and session authentication, explains their differences, security and performance trade‑offs, and provides a complete Java implementation with Redis integration, guiding developers on selecting and implementing the most suitable authentication method for distributed backend systems.
This article explains the principles and workflow of Single Sign‑On (SSO) and OAuth 2.0, compares their concepts, details implementation steps and grant types, and concludes with a promotional invitation to join a community offering related resources and discounts.
This article critically examines the common misconceptions about JWT advantages, explains the security and practical drawbacks of using JWT for session management, and outlines the scenarios where JWT is appropriate, such as short‑lived, one‑time authorization tokens.
This article explains the fundamental concepts, roles, and step‑by‑step flow of OAuth 2.0, compares it with single sign‑on, describes the architecture of authorization, resource, and client servers, and clarifies related terminology such as authentication, federation, and delegated access.
This article provides a comprehensive guide to configuring Spring Security in a Java backend, covering Maven dependencies, global security settings, JWT token parsing, custom authentication providers, user details services, dynamic URL permission metadata, access decision management, and custom handlers for login, logout, and error responses, along with sample application.yml and database schema.
This article demonstrates how to integrate account username and WeChat web‑authorization login into a Spring Security application by configuring custom authentication providers, filters, tokens, and handlers, allowing users to log in without a password while leveraging WeChat OpenID verification.
This article explains the fundamentals of OAuth2.0, distinguishes it from SSO, describes the roles of resource owner, client, authorization server and resource server, outlines the step‑by‑step authorization flow, and clarifies related terminology such as authentication, federated identity, and delegated authorization.
The article investigates why MySQL 8.0.27 repeatedly logs a deprecation warning for the sha256_password plugin, tracing the issue to authentication attempts with non‑existent users, analyzing source code, and proposing configuration and code‑level fixes.
This article explains the underlying mechanism of front‑end QR‑code login, detailing the roles of the PC page, mobile device, and server, and walks through the step‑by‑step process from generating the QR code to confirming login and issuing a token.
This article provides a comprehensive analysis of Spring Security's authentication mechanism, detailing the filter chain, core components such as SecurityContextHolder, AuthenticationManager, ProviderManager, and AuthenticationProvider, and illustrating the step‑by‑step flow of username‑password verification with extensive code examples.
This article provides a comprehensive walkthrough of Spring Security’s authentication mechanism, detailing the filter chain, core security components, and the underlying source‑code flow—from UsernamePasswordAuthenticationFilter through AuthenticationManager, ProviderManager, and DaoAuthenticationProvider—illustrated with code examples and diagrams.
This article explains the concept, background, and definition of Single Sign‑On (SSO), outlines three SSO deployment types, introduces the Central Authentication Service (CAS) with detailed ticket mechanisms, and provides step‑by‑step SSO and Single Logout (SLO) processes for multiple applications.
MaxKey is an open-source, Apache-licensed SSO platform that supports major authentication protocols, offers extensive login methods, provides multi-tenant IAM features, and includes detailed Linux deployment steps with code snippets and interface screenshots, making it a comprehensive solution for enterprise identity management.
The article outlines Berserker’s comprehensive data‑security framework—built on the CIA triad and 5A methodology—that unifies authentication, authorization, access control, asset protection, and auditing across Hive, Kafka, ClickHouse and ETL tasks, describes the migration from version 1.0 to 2.0 with a redesigned permission system, workspaces, Casbin performance tweaks, and previews future fine‑grained, lifecycle‑wide security enhancements.
This article explains traditional session‑based authentication, introduces JWT and JJWT, and presents two microservice authentication patterns—service‑side verification and gateway‑side verification—detailing their workflows, code examples, advantages, drawbacks, and practical challenges.
This article explains the fundamentals of authentication and authorization, the role of credentials, the differences between cookies and sessions, various token types including access and refresh tokens, and the principles, usage, and security considerations of JSON Web Tokens (JWT).
CNStack 2.0 introduces a cloud‑native multi‑cluster service built on Open Cluster Management, offering unified registration, lifecycle management, resource distribution, multi‑tenant authentication, and high‑availability cross‑cluster communication for Kubernetes clusters across clouds.
This article explains what JSON Web Tokens are, their structure and security considerations, introduces the JJWT Java library, and provides a complete Spring Boot and Angular example—including Maven setup, Java filters, controllers, and front‑end code—to demonstrate secure token‑based authentication.
This article explains the complete user login process, including mobile verification, token generation, token expiration policies, request‑rate limiting with Redis, anonymous request handling, blacklist management, and provides full Java Spring code examples for implementing these backend authentication mechanisms.
This article explains a comprehensive backend user login flow, covering token generation, expiration policies, request validation, logout handling, anonymous access strategies, rate‑limiting with authorized tokens, path‑regex filtering, blacklist management, and includes a Spring‑Redis implementation example.
This article explains how to replace Shiro with Spring Security, integrate JWT for stateless authentication, configure the filter chain, set up the necessary Maven dependencies, write the security configuration, custom authentication and verification filters, and manage user details in a Spring Boot backend.
This comprehensive guide walks you through Spring Security fundamentals, setting up a Spring Boot project, configuring authentication with JWT and Redis, implementing RBAC permission management, customizing error handling, enabling CORS, and addressing CSRF, providing complete code examples and detailed explanations for secure backend development.
This article walks through the evolution of a user system—from a basic email/phone login to third‑party OAuth, multi‑type user accounts, diversified password schemes, and real‑person (entity) verification—showcasing a flexible, extensible backend design that can handle rapid business growth.
This article analyzes the limitations of traditional HTTP session mechanisms in single‑server and clustered environments, explains why session sharing is essential for multi‑system products, and presents practical solutions such as session replication and centralized Redis storage, followed by a detailed walkthrough of CAS‑based single sign‑on implementation with Java Spring code examples and a comparison to OAuth2.
This article explains how to quickly add a secure login page to a simple SpringBoot application using the Sa-Token-Quick-Login plugin, covering Maven dependencies, configuration parameters, controller implementation, and testing steps with code examples.
This article demonstrates how to build a Spring Cloud Gateway microservice that serves as a centralized authentication and authorization gateway, covering Maven dependencies, YAML configuration, whitelist handling, exception processing, RestTemplate setup, and a custom global filter with code examples.
This article provides a step‑by‑step guide for building a CAS server and client with Spring Boot, covering WAR deployment, configuration file adjustments, custom authentication redirect strategies, CORS setup, and troubleshooting ticket validation and cross‑origin issues.
This article explains the concepts and differences between Single Sign-On (SSO) and OAuth2.0, describing their token-based authentication flows, typical implementations such as CAS, the four OAuth2.0 grant types, and how they can be used to achieve seamless login across applications.
This tutorial walks through setting up Spring Security with JWT in a Spring Boot project, covering environment configuration, Maven dependencies, custom authentication handlers, permission evaluation, JWT filtering, and testing, providing complete code examples and explanations for building a robust backend authentication system.
This article provides an in‑depth overview of authentication, authorization, and permission control concepts and compares ten common front‑end authentication techniques—including HTTP Basic Auth, Session‑Cookie, Token, JWT, SSO, OAuth 2.0, QR‑code login and one‑click login—detailing their workflows, advantages, drawbacks, and typical usage scenarios.
This article explains the principles of Single Sign‑On (SSO) and OAuth2.0, compares their workflows, describes common implementation patterns such as CAS and token‑based authentication, and clarifies the distinctions between SSO, OAuth2.0, and related security frameworks.
This article explains the principles of Single Sign-On (SSO) and OAuth2.0, compares their concepts, outlines typical SSO workflows using CAS, details OAuth2.0 authorization code flow, clarifies terminology differences, and discusses related security frameworks such as Spring Security and Shiro.
This article outlines the challenges of API security, proposes a hybrid symmetric‑asymmetric encryption scheme with signed requests, describes client and server processing flows, defines service attributes, and provides implementation references for a robust RPC encryption solution.
This article explains the principles and workflow of Single Sign‑On using OAuth2.0, illustrates the process with a real‑life analogy, and provides a complete Spring Boot example—including authorization server, client configuration, and role‑based access control—suitable for microservice architectures.
This article compares JWT and session authentication, outlines their differences, advantages, security considerations, performance impacts, and provides a complete Java implementation with Redis integration, helping developers decide the best approach for their projects.
This article reviews four widely used authentication mechanisms—HTTP Basic authentication, session‑cookie based authentication, token (JWT) authentication, and OAuth 2.0—explaining their workflows, security characteristics, and providing Node.js/Express code examples for each.
This article explains RBAC concepts and model classifications, demonstrates basic Spring Security setup, shows how to configure in‑memory and database authentication, integrates JWT for stateless token‑based access, implements JSON‑based login, and covers password encryption with BCrypt in a Spring Boot backend.
Google announced that Android and Chrome will now support Passkey key‑login, a biometric‑based, public‑key authentication method that replaces traditional passwords, allowing users to create a secure credential on their device, sync it across platforms, and developers to integrate it via WebAuthn and related APIs.
This article explains the concept of Single Sign‑On (SSO), compares its major protocols—SAML, OAuth2, and OpenID Connect—covers their workflows, benefits, terminology, and provides guidance on when to choose each protocol for different application scenarios.
This article provides a detailed tutorial on Spring Security, covering its core concepts, project setup, authentication flow, custom user details service, password encoding, login handling, role-based access control, CSRF protection, and integration with Thymeleaf, complete with code examples.
Google announced that Android and Chrome will adopt Passkey, a biometric‑based, public‑key login system that replaces traditional passwords, offering cross‑platform support, phishing resistance, and cloud‑backed recovery, with developers able to integrate it via WebAuthn and Google Play Services.
This article compares JWT and session authentication, discusses their differences, security, performance, and lifecycle considerations, and provides a complete Java implementation—including dependency configuration, token utilities, Redis integration, login/logout flows, password updates, and request interception—guiding developers to select the most suitable approach for their projects.
This article introduces Harbor, a CNCF‑hosted cloud‑native Docker registry, explains its token‑based authentication flow, details the required Kubernetes and Helm prerequisites, provides step‑by‑step installation and configuration instructions, and demonstrates how to push and pull images using containerd and Kubernetes.
This guide explains the JWT format, standard and custom claims, signature algorithms, and presents practical single‑token and double‑token renewal schemes—including a WeChat OAuth example—along with a complete PHP implementation using the tinywan/jwt library.
KubeGateway, a custom seven‑layer gateway built by ByteDance, eliminates kube‑apiserver load‑imbalance and adds comprehensive request governance—including routing, rate‑limiting, and degradation—by parsing HTTP2 traffic, supporting flexible policies, and transparently proxying requests without client changes.
The article argues that traditional password complexity rules and periodic resets are outdated, advocating for longer passwords, the use of password managers and multi‑factor authentication, and limiting login attempts to improve security in modern, always‑connected systems.
This article explains the fundamentals of Single Sign‑On (SSO), compares the two most common protocols—SAML and OAuth2 (with OpenID Connect)—covers their terminology, workflows, benefits, and provides guidance on which to use in different scenarios.
This comprehensive tutorial explains RBAC concepts, model classifications, and permission handling, then walks through implementing Spring Security with in‑memory authentication, JWT integration, custom JSON login filters, password encryption, and database‑backed authentication, providing complete code examples and configuration details.
This article provides a comprehensive tutorial on role‑based access control (RBAC) concepts, model classifications, permission definitions, user‑group usage, and step‑by‑step implementations of Spring Security, JWT integration, JSON login, password encryption, and database authentication with extensive code examples.
This article explains single sign‑on concepts, compares SAML, OAuth2 and OpenID Connect, outlines their benefits and typical workflows, and provides guidance on choosing the right protocol for different security and user‑experience scenarios.
This comprehensive guide walks you through Spring Security fundamentals, authentication flow, project setup, custom user details, password encoding, login handling, 403 error pages, remember‑me functionality, method security annotations, and CSRF protection, providing clear code examples for each topic.
This article provides a step‑by‑step tutorial on building a unified authentication center with Spring Security OAuth2, covering project module planning, authorization and resource server configuration, client module setup, gateway integration, and custom security components, complete with Maven dependencies and Java code examples.
This article provides a step‑by‑step guide to building an online blog platform using Flask and MySQL, covering environment setup, database schema design, user registration and login, password encryption, CRUD operations for posts, Markdown editing, image upload, comment management, and error handling with full code examples.
This guide walks through Spring Security fundamentals, including its core authentication and authorization mechanisms, project setup with Maven, customizing usernames, implementing UserDetailsService, creating custom PasswordEncoders, configuring login handling, role and authority checks, CSRF protection, remember‑me functionality, and using security annotations.
This article explains the limitations of traditional HTTP session handling, explores session sharing strategies for clustered environments, and walks through a complete Java CAS‑based single sign‑on solution with code examples, highlighting the differences between CAS and OAuth2.
This tutorial demonstrates how to set up a Spring Security FormLogin authentication flow, including creating a demo project, customizing the login page, configuring security rules, defining users and roles, and testing the login process with custom success and failure handlers.
This tutorial demonstrates how to set up a Spring Cloud Gateway service with static route configuration, then extend it to support dynamic routing through Nacos, and finally implement custom authentication and global filters using Java and Spring Boot.
This tutorial walks through implementing login authentication using Spring Cloud Gateway and JWT, covering core concepts of authentication, authorization, credential handling, token generation, gateway validation, service integration, and token refresh strategies within a microservice architecture.
This article examines security challenges encountered in JD Logistics' sorting platform, details the investigative process for abnormal API requests, proposes a SHA‑256 based authentication scheme with digital signatures, compares industry‑wide API protection methods, and shares practical insights from the author's experience in financial API gateway design.
This article provides a comprehensive guide to Role‑Based Access Control (RBAC) concepts, model classifications, and permission management, then walks through practical Spring Security setups—including basic usage, in‑memory authentication, JWT integration, JSON‑based login, password encryption, and database‑backed authentication, complete with code snippets and diagrams.
This guide explains how Spring Security processes authentication and authorization failures, walks through the default exception flow, and demonstrates multiple ways to customize error handling—including custom failure handlers, access‑denied pages, and JSON responses—using Spring Boot 2.4.12.
This article provides an in‑depth guide to authentication, authorization, and access control, covering basic HTTP authentication, session‑cookie mechanisms, token‑based approaches, JWT structure, single sign‑on (SSO), OAuth 2.0 flows, unique login enforcement, QR‑code login, and one‑click mobile login, with practical code examples and diagrams.
This article provides a comprehensive guide on implementing role‑based access control (RBAC) with Spring Security, covering RBAC models, password encryption, in‑memory authentication, JWT integration, custom authentication filters for JSON login, and detailed configuration examples with full source code snippets.
This article explains RBAC concepts and model classifications, demonstrates role‑based permission management, and provides step‑by‑step guides for using Spring Security with simple authentication, JWT token generation, JSON‑based login, password encryption, and database‑backed user authentication in Java applications.
This article explains how to integrate JWT-based login authentication into a Spring Cloud micro‑service architecture using Spring Cloud Gateway, detailing the authentication flow, token generation, gateway validation, service‑side user handling, and token refresh strategies with practical code examples.
The article explains the concepts of Single Sign-On and OAuth2.0, compares their trust, resource, and flow differences, and details how to implement SSO using OAuth2.0 or the CAS framework, while also promoting related Spring Cloud Alibaba video tutorials.
This article uses the Journey to the West story as a metaphor to explain credentials, the Cookie‑Session authentication model, and the JWT token scheme, comparing their mechanisms, advantages, disadvantages, and practical implications for modern microservice security.
This article provides a comprehensive guide to building a JWT authentication service in Java, covering JWT fundamentals, Spring Boot configuration, entity and DAO definitions, service interfaces, token generation and parsing, RSA key handling, controller endpoints, testing procedures, and a comparison with traditional session-based authentication.
This article explains traditional session and authentication mechanisms, the problems of session sharing in clustered and multi‑service environments, and presents practical SSO solutions—including CAS‑based single sign‑on and its differences from OAuth2—accompanied by complete Java Spring code examples.
This article explains the limitations of traditional HTTP session mechanisms, explores session sharing strategies in clustered environments, and provides a detailed walkthrough of implementing Single Sign-On using CAS, including code samples and a comparison with OAuth2 authentication.
This article explains why unified authentication is essential for product suites, reviews traditional session mechanisms and their limitations in clustered environments, explores session‑sharing strategies, introduces CAS‑based SSO workflows, compares CAS with OAuth2, and provides a complete Spring Boot demo with code snippets and configuration details.
This article provides a comprehensive step‑by‑step guide on building a permission management system with Spring Security, covering database design, entity classes, Maven configuration, security configuration, dynamic menu loading, front‑end rendering using Thymeleaf, and complete testing with sample code and screenshots.
