This article explains what a Keycloak Realm is, when to use it, the role of the built‑in Master Realm, how to create and manage additional Realms, and practical methods for setting up Realm‑specific admin accounts using both Master users and realm client users.
This article explains four approaches to adding a generic appkey whitelist check in a Spring Boot web framework—traditional AOP, HandlerInterceptor, custom HandlerMethodArgumentResolver, and Servlet Filter—providing implementation steps, code examples, and a discussion of their execution order and extensibility.
This article explains the stateless nature of HTTP, the session and cookie mechanisms for single‑system login, the challenges of multi‑system environments, and provides a detailed overview of Single Sign‑On (SSO) concepts, token flow, and step‑by‑step Java code examples for client and server implementations.
This tutorial walks through building a microservice authentication and authorization solution using Sa-Token, Spring Cloud Gateway, Nacos, and Redis, detailing the setup of gateway, authentication, and protected API services, configuration files, custom permission handling, and a complete demo with Postman.
This article examines how Keycloak integrates with Spring Security in a Spring Boot application, detailing the custom security filters added to the standard chain, the handling of authentication and authorization for the /admin/foo endpoint, and practical steps to enable detailed logging for deeper insight.
This article reviews three leading SaaS user‑management platforms—Okta, Auth0, and Frontegg—detailing their features, advantages, pricing, and differences in multi‑tenant support, social login, and plug‑in capabilities to help developers choose the best solution for their applications.
This guide walks you through integrating the lightweight Sa-Token framework into a SpringBoot project, covering dependency setup, configuration, login, role and permission checks, as well as global exception handling, with complete code examples and practical screenshots.
This article explains the fundamentals of HTTP's stateless nature, session mechanisms, the challenges of multi‑system login, and provides a detailed guide with Java code examples on implementing Single Sign‑On (SSO) including token generation, validation, and global‑local session handling.
This article examines common security vulnerabilities in web login processes, demonstrates how plain‑text passwords can be intercepted over HTTP/HTTPS, evaluates symmetric and asymmetric encryption, discusses the limitations of MD5, and proposes token‑based and digital‑signature solutions to protect credentials and data integrity.
This article explains an eight‑step JWT‑based user authentication flow, covering secure credential transmission, database verification, token creation, HttpOnly cookie handling, request validation, payload decoding, session versus JWT comparison, and cross‑domain single sign‑on configuration.
Replit introduces replit.web, a Python framework that streamlines server launch, persistent storage with Repl DB, and user authentication via Repl Auth, allowing developers to create full‑stack applications with minimal code and effort.
This article outlines the most commonly used Keycloak adapter configuration properties for Spring Security integration, explaining each setting such as realm, resource, auth-server-url, SSL requirements, CORS, bearer-only mode, and client credentials, and provides guidance on when and how to apply them.
This tutorial explains step‑by‑step how to add Keycloak authentication to a Spring Boot application using the Spring Security adapter, covering Maven dependencies, configuration files, custom resolvers, role mapping, session strategies, and the typical authorization code flow.
Learn how to configure Spring Boot Security's remember‑me feature with a persistent token repository, set up the necessary SQL, customize the login page, and understand the underlying authentication flow to prevent duplicate logins and maintain user sessions across browser restarts.
This article walks through the Spring Security authentication flow in a Spring Boot 2.2.11 application, detailing filter execution, token creation, provider selection, custom DaoAuthenticationProvider configuration, and session management, complemented by code snippets and diagrams for each step.
This article compares four Spring Boot techniques—traditional AOP, HandlerInterceptor, custom HandlerMethodArgumentResolver, and Servlet Filter—for implementing a generic appkey whitelist validation, explains their implementation steps with code examples, and clarifies their execution order within the request processing pipeline.
This tutorial walks through installing Keycloak via Docker, exploring its admin console, configuring realms, users, and clients, and demonstrates both authorization code and password grant flows before integrating Keycloak with a SpringBoot application to protect APIs using OAuth2.
This guide explains the fundamentals of JSON Web Tokens, their structure and claim types, typical use cases such as authorization and secure data exchange, and provides a step‑by‑step Spring Boot implementation including dependency setup, token generation, interceptor validation, and protected endpoint testing.
This article explains the principles of Single Sign‑On using OAuth2.0, illustrates the flow with a real‑world analogy, and provides a complete SpringBoot implementation for both the authorization server and client, including role‑based permission control and microservice integration.
This article explains a complete CAS-based single sign‑on solution, covering traditional session mechanisms, the CAS architecture, implementation of single sign‑on, session renewal, single logout, and practical extensions for multi‑system integration to ensure secure and seamless user experiences across enterprise applications.
This article explains how OpenID Connect (OIDC) builds on OAuth 2.0 to provide authentication, demonstrates a practical Keycloak integration with a Spring Boot app, and walks through a complete authorization flow for a photo‑storage service using client credentials and secure token exchange.
This article explains the lightweight JWT specification, its three-part structure (header, payload, signature), how to create and encode tokens with example code, the purpose of signatures, security considerations, suitable use cases, and a step‑by‑step authentication flow comparing JWT with traditional session storage.
This guide walks you through creating a Keycloak realm, registering a client, defining roles and mappings, obtaining and refreshing JWT tokens, and configuring a Spring Boot application with the Keycloak Spring Boot starter to protect endpoints via OIDC authentication.
This guide walks you through installing Django, creating an app, defining a custom user model with a manager, configuring AUTH_USER_MODEL, and migrating the database, enabling email‑based authentication and flexible user fields.
This tutorial explains how to download, configure, and use the PHP GoogleAuthenticator class for two‑factor authentication in a ThinkPHP 6 environment, including code examples for generating secrets, QR‑code URLs, storing them, and verifying user tokens.
This article explains the stateless nature of HTTP, how session and cookie mechanisms enable login state in a single web system, the challenges of multi‑system environments, and provides a step‑by‑step guide with code examples for building a Java‑based Single Sign‑On solution, including token generation, validation, and logout handling.
This article walks you through installing Keycloak 14.0.0 via Docker, configuring the admin console, creating custom realms and users, and explains core concepts such as realms, authentication, authorization, roles, groups, clients, and identity providers for practical security integration.
Keycloak, Red Hat’s open‑source identity and access management platform, offers a comprehensive SSO solution with extensive protocols, admin UI, Spring Security integration, and customizable features, but its complexity and steep learning curve may pose challenges for smaller projects.
This article demonstrates how to implement a unified authentication system in Spring Security that supports traditional username/password login, SMS-based captcha login, and WeChat Mini‑Program login, detailing the required components, custom filters, provider configurations, and code examples for a production‑ready solution.
This article explains the principle of single sign‑on and compares three implementation techniques—parent‑domain cookies, a dedicated authentication centre, and cross‑domain LocalStorage—detailing their mechanisms, advantages, limitations, and providing sample code for the LocalStorage approach.
This guide introduces APISIX, a cloud‑native API gateway with visual management and dozens of plugins, walks through its core concepts, shows how to install it via Docker‑Compose, and demonstrates basic and advanced usage such as routing, authentication, rate limiting, and CORS support.
This article analyses various client‑side authentication scenarios, classifies token types such as password, session, and API tokens, compares their cost, risk, and controllable attributes, and proposes a layered token architecture to improve security, privacy, and usability across multiple platforms.
This article explains how to add a generic app‑key whitelist authentication feature to a Spring Boot web framework using four different mechanisms—traditional AOP, HandlerInterceptor, custom HandlerMethodArgumentResolver, and Servlet Filter—providing implementation steps, code examples, and a discussion of their execution order.
This tutorial explains how to protect a Spring Boot web application by integrating Spring Security and JSON Web Tokens (JWT), covering project setup, dependency configuration, custom authentication components, security filters, token generation, role‑based access control, and testing with curl commands.
This guide provides a comprehensive overview of the FTP protocol and its lightweight counterpart TFTP, then walks through installing, configuring, and securing the vsftpd service on Linux, covering active and passive modes, authentication options—including anonymous, local, and virtual users via text files or MySQL—and essential SELinux and firewall adjustments.
This article presents a comprehensive design guide for a microservice gateway, covering functional aspects such as routing, load‑balancing, aggregation, authentication, rate limiting, circuit breaking, and retries, as well as non‑functional concerns like high performance, high availability, scalability, extensibility, and observability.
This article outlines a comprehensive design for a microservice API gateway, covering functional aspects such as routing, load‑balancing algorithms, service aggregation, authentication, traffic control, circuit breaking, and caching, as well as non‑functional concerns like high performance, high availability, scalability, statelessness, and monitoring.
This article explains how to install and configure Harbor, an open‑source CNCF‑hosted cloud‑native Docker registry, covering its authentication mechanism, Helm‑based deployment on Kubernetes, required prerequisites, TLS handling, and practical steps for pushing and pulling container images.
This article outlines practical approaches for implementing multi‑account login, covering early‑stage username/password and phone‑based registration, detailed authentication flows, OAuth2 integration with third‑party providers, and comprehensive database schema designs to unify local and external user identities.
Spring Security 5.5 introduces the JWT Bearer grant, an OAuth2.0 authorization mode defined in RFC7523, allowing clients to obtain access tokens using trusted JWTs and also to authenticate themselves, offering a streamlined alternative to traditional user‑approval flows.
This article outlines a comprehensive design for a microservice API gateway, covering functional aspects such as routing, load balancing, aggregation, authentication, rate limiting, circuit breaking, caching, retries, and logging, as well as non‑functional concerns like high performance, high availability, scalability, and monitoring, with practical implementation options and recommendations.
This article explains the evolution from cookies to server‑side sessions and finally to JWT tokens, compares their mechanisms, discusses scalability and security challenges such as CSRF, and provides guidance on when to choose each authentication method.
This article analyzes various client scenarios in multi‑client systems, classifies authentication tokens into password, session, and interface categories, compares their natural and controllable attributes, and proposes a layered token hierarchy to improve security, privacy, and usability across web, mobile, and API platforms.
This article explains the underlying principles of QR code login, detailing how the system identifies users, proves their identity through token‑based authentication, and manages the state transitions from scanning to confirmation, while also covering the role of QR code generation and temporary tokens.
This article analyzes various authentication token types, their usage scenarios across web, mobile, and API clients, compares their natural and controllable attributes, proposes a hierarchical token model, and offers security guidelines for designing a robust multi‑client identity verification system.
This guide demonstrates how to use Python's requests library for sending GET, POST, and HTTPS requests, handling file uploads and downloads, managing timeouts, performing authentication, session and token handling, generating signatures, and organizing a complete API test automation framework.
This article explains the fundamentals of JSON Web Tokens (JWT), their structure, main use cases, and provides a step‑by‑step guide for integrating JWT authentication into a Spring Boot application, including dependency setup, custom annotations, token generation, interceptor implementation, and configuration details.
This article explains the underlying principles of QR code login, detailing how token‑based authentication, QR code generation, and state transitions enable secure, password‑less login across PC, web, and mobile platforms.
This article explains why Spring Security redirects to the login page after 30 minutes of inactivity in a NW.js application, examines the underlying session handling code, and shows how to implement a custom success handler to preserve the user's original page.
This article analyzes various client scenarios, classifies authentication tokens, compares their natural and controllable attributes, and proposes a hierarchical token architecture that balances security, privacy, and usability across web, mobile, and API platforms.
This tutorial walks through Spring Security's authentication flow in a Spring Boot 2.2.11 application, detailing filter execution, token creation, provider verification, custom DaoAuthenticationProvider configuration, and session management with code examples and diagrams.
This article compares Apache Shiro and Spring Security, outlining each framework's features, execution flow, and strengths, and provides guidance on when to choose Shiro for lightweight, framework-agnostic projects versus Spring Security for deeper Spring integration and broader community support.
This article explains the principles behind QR codes, how they are used for secure login by transmitting identity and proof through token‑based authentication, and walks through each step of the QR‑code login flow from generation to confirmation.
This article explains what API gateways are, why they are essential in microservice architectures, and how they address cross‑cutting concerns such as authentication, transport security, load balancing, request routing, dependency resolution, and data transformation, illustrated with a Node.js example.
Facing the complexities of microservice adoption, Zhaozhuan’s service governance platform integrates service registration, discovery, configuration, monitoring, authentication, and rate limiting via an SDK‑driven architecture, illustrating AP‑style registration, node grouping, gray‑release discovery, real‑time metrics aggregation, and method‑level access control.
This article analyzes the intermittent “Public Key Retrieval is not allowed” error in MySQL 8.0 when using JDBC, C3P0, or Druid connections, explains the authentication plugins involved, and provides step‑by‑step configuration fixes and best‑practice recommendations.
This tutorial walks through building a single sign‑on (SSO) system using OAuth2, Spring Security, and JWT, covering preparation, core concepts, Maven dependencies, configuration files, custom login pages, client setup, logout handling, project structure, and a full demonstration.
OpenSSH 8.5 introduces numerous security fixes, compatibility improvements, and new features such as default ED25519 signatures, updated post‑quantum key‑exchange methods, and enhanced logging and host‑key handling, while also addressing memory bugs and mitigating Solaris PAM vulnerabilities.
This article introduces seven open‑source OAuth/SSO solutions—including oauth2‑shiro, tkey, MaxKey, spring‑lhbauth, oauth2, oauthserver, and JustAuth—detailing their features, supported protocols, and repository links to help developers implement secure authentication and token management in web and mobile applications.
This article explains the fundamental differences between JSON Web Token (JWT) and OAuth2, describes their structures, security considerations, implementation details, and outlines appropriate scenarios for using each method to protect APIs.
This article explains the role of OAuth2AuthorizationCodeAuthenticationProvider in Spring Security, details how OAuth2AccessTokenResponseClient obtains access tokens, shows how to customize the token endpoint, and walks through the complete token‑retrieval flow with code examples and step‑by‑step analysis.
This step‑by‑step tutorial shows how to create a Django website with user authentication features—including login, registration, logout, password change, password‑less login and reset—by configuring the project, defining models, forms, views, URLs, performing migrations, and running the server.
This guide explains how to set up an Auth class in ThinkPHP, create the necessary database tables for groups and rules, design admin and permission tables, configure user‑group relationships, handle login sessions, and integrate the Auth class into a common controller to enforce RBAC checks.
This article explains the fundamental differences between JSON Web Tokens (JWT) and OAuth 2.0, outlines their structures, roles, and grant types, compares implementation effort and risk, and provides guidance on choosing the right approach for various API security scenarios.
This tutorial explains the concept of Single Sign‑On, demonstrates a simple ticket‑based analogy, introduces JWT structure and RSA signing, and walks through a complete Spring Boot implementation—including project layout, Maven dependencies, configuration files, utility classes, custom authentication and verification filters, security configuration, and Postman testing—so readers can build a secure SSO service from scratch.
This article explains the fundamentals of Single Sign-On (SSO) and the CAS framework, outlines suitable use cases, compares three implementation approaches, details key CAS components and ticket types, and walks through a step‑by‑step cross‑domain SSO deployment process.
This article explains three practical Single Sign‑On implementations—parent‑domain cookies, a dedicated authentication center, and cross‑domain LocalStorage—detailing their mechanisms, advantages, limitations, and code examples for secure token sharing across multiple web applications.
This guide explains Kafka's authentication and authorization mechanisms, covering SASL/PLAIN and SASL/SCRAM setups, JAAS file creation, server property configuration, ACL management, and provides complete Java producer and consumer examples for secure communication.
This article explains the concept, purpose, design principles, functional modules, authentication methods, deployment options, and open‑source implementations of bastion hosts, highlighting how they centralize control, audit, and protect privileged access to servers and network devices.
Learn how to install Cntlm on Debian‑based Linux or Windows, configure its authentication and proxy settings, obtain NTLM hashes, and apply changes by reloading or restarting the systemd service, enabling secure multi‑user HTTP proxy access within restricted networks.
This article explains how Single Sign‑On works in browser‑server applications, compares three implementation methods—parent‑domain cookies, a dedicated authentication center, and cross‑domain LocalStorage with iframe/postMessage—and provides sample code for the latter technique.
This article explains what a bastion host (jump server) is, why it is needed, its 4A design philosophy, core objectives, functional modules, authentication methods, common operation modes, additional features, various deployment architectures, and examples of commercial and open‑source solutions.
This article analyzes token-based identity authentication in multi‑client information systems, classifies various token types, compares their natural and controllable attributes, proposes a four‑layer hierarchy, and discusses practical usage scenarios and design principles to improve security and privacy.
This article provides a hands‑on guide to using IdentityServer4 in the Fuluteng project, covering signing credentials, client and resource stores, persisted grant storage with Redis, various OAuth2 grant types including client credentials, authorization code, password, and custom extensions such as SMS and third‑party logins, and demonstrates role‑based authorization and JWT configuration.
This article explores how Spring Security processes OAuth2 login callbacks, detailing the role of AuthenticationManager, the creation of OAuth2LoginAuthenticationToken, the selection of appropriate AuthenticationProvider such as OAuth2LoginAuthenticationProvider and OidcAuthorizationCodeAuthenticationProvider, and the subsequent generation of OAuth2User and token objects.
This article provides a comprehensive overview of JSON Web Tokens, explaining their purpose, structure (header, payload, signature), key concepts such as JWS and JWE, the various claim types, encryption and signing algorithms, and practical usage considerations for secure web authentication.
The article explains how to secure API interfaces by using AccessKey/SecretKey or Token/AppKey for identity verification, generating request signatures to prevent parameter tampering, and applying timestamp‑nonce mechanisms to defend against replay attacks, while providing concrete implementation examples in code.
This guide walks through the prerequisites, installation via Composer, key generation, and detailed configuration of Laravel's authentication system, including environment setup, file settings, controller examples, route definitions, middleware validation, and testing procedures for a functional backend.
This article explains how to diagnose MySQL client connection failures by checking whether the mysqld process is running, verifying network communication settings such as skip‑networking and bind‑address, and examining authentication or password issues via the error log.
This guide shows how to import Swagger-generated API definitions into Postman, configure environment variables, handle authentication tokens, and use Postman for efficient API debugging, while noting the limitations of documentation display compared to Swagger.
This article walks through Spring Security's OAuth2 authorization flow, revealing the entry URL, key resolver and filter classes, core request‑handling logic, and how the framework redirects users to third‑party providers.
This tutorial explains the fundamentals of HTTP API authentication versus authorization, introduces Casbin's model and policy syntax for role‑based access control, and provides step‑by‑step PHP code examples to add permissions, assign roles, and enforce RBAC checks.
This article explains the principles and workflows of typical authentication mechanisms—including HTTP Basic authentication, cookie‑based sessions, JSON Web Tokens, and OAuth—detailing their encryption processes, storage strategies, token refresh techniques, and security considerations for modern web applications.
This article provides a comprehensive guide to customizing Laravel's built‑in authentication system, covering route parameters, controller generation, password confirmation, device logout, redirect logic, user creation via Tinker and factories, login throttling, and additional credential checks, all with practical code examples.
This article explains how to create an iOS 14 home‑screen Widget for the Hema Town mini‑game, covering design goals, platform restrictions, authentication handling, data timeline updates, SwiftUI UI implementation, bundle splitting, Swift bridging, analytics, review pitfalls, and post‑release considerations.
This guide walks you through using the Python httpx library to perform various HTTP methods—including GET, POST, PUT, DELETE, HEAD, and OPTIONS—handle query parameters, decode responses, work with JSON, custom headers, form data, file uploads, streaming, cookies, redirects, and authentication, all with clear code examples.
This article explains the concepts, structures, and cryptographic processes of JWT, JWS, and JWE, covering their components, claim types, signature algorithms, encryption steps, and practical code examples for secure token handling in web applications.
This article provides an in-depth overview of Nginx, covering its introduction, architecture, and various modules, including real IP and rewrite modules, with practical examples and configuration details.
This comprehensive Spring Security guide explains core concepts of authentication and access control, details the AuthenticationManager and ProviderManager interfaces, shows how to customize authentication managers, configure authorization with AccessDecisionManager, secure web requests with filter chains, and apply method-level security, including asynchronous contexts.
This article traces the evolution from early stateless web browsing to modern token‑based authentication, explaining how session management challenges led to centralized stores, their drawbacks, and how signed tokens using HMAC‑SHA256 provide a scalable, secure, and truly stateless alternative.
This article explains how to automatically renew JWT tokens in a front‑end/back‑end separated system by storing tokens in a cache, checking them in a filter, and refreshing them when expired, thereby preventing frequent logins and preserving form data.
This article explains what GraphQL is, how its type system and Relay standard work, the N+1 problem, and presents three architectural approaches—prefixing, schema stitching, and RPC composition—for integrating GraphQL into microservices, along with authentication, authorization, and routing considerations.
This article explains three practical methods for achieving Single Sign‑On in web systems—using a parent‑domain cookie, deploying a dedicated authentication center, and leveraging front‑end LocalStorage with iframe postMessage—to share session or token information across multiple domains.
This article explains why session management is needed, compares cookies, sessions and JWT, describes JWT's structure and workflow, and provides a complete Node.js/Koa implementation with code examples and a discussion of its advantages and drawbacks.
This article provides a comprehensive overview of the PASSPORT account system, detailing its registration process, login mechanisms, authentication methods, security challenges, system evolution, and stability considerations to guide developers in building robust and secure user identity services.
This article explains the technical solutions for unified multi‑account login in web applications, covering early‑stage username/password and mobile verification flows, detailed process steps, OAuth2.0 third‑party integration, and comprehensive database schema design for local and third‑party user authentication.
This tutorial walks you through registering a QQ Connect application, adding the required Maven dependency, creating the login page, implementing the Spring Boot controller and AuthComment utility class, configuring Freemarker, and handling the OAuth flow to achieve seamless QQ authentication in a Java backend.
The article shows how a Vue login page can request a SpringBoot endpoint that creates a four‑character captcha image, encodes it as a Base64 data URL, returns it together with a UUID, stores the code in Redis with a two‑minute expiration, and validates the UUID during login.
This article explains the concept of multi‑account unified login in internet applications, detailing early‑stage username/password and mobile‑based authentication flows, the evolution to third‑party OAuth2 integration, and provides comprehensive database schema designs for local and third‑party user accounts.
This article explains the stateless nature of HTTP, session and cookie mechanisms, the challenges of multi‑system authentication, and then details the concept, workflow, token handling, and step‑by‑step Java code for building a basic Single Sign‑On solution with login and logout support.
