This article explains the fundamentals and extensions of role‑based access control (RBAC), covering user, role, permission, organization, and group models, authorization workflows, database schema, and common frameworks such as Apache Shiro and Spring Security for building robust permission systems.
This article explains the core RBAC0 model and its extensions (RBAC1, RBAC2, RBAC3), discusses user groups, organizations and positions, and outlines manual and approval-based authorization workflows along with a sample database schema for implementing role‑based access control in complex systems.
This guide demonstrates how to integrate Apache Shiro into a Spring Boot application, covering project setup, Maven dependencies, configuration of Redis-backed session and cache management, creation of utility and realm classes, and implementation of role‑based permission controls with example controllers and Postman testing.
This article explains Apache Shiro's core architecture, demonstrates how to create authentication tokens, configure realms with caching and hashing, and shows step‑by‑step integration with Spring MVC including filter setup and login controller code.
This article explains the fundamentals of authentication and authorization, the roles of credentials, cookies, sessions, various token types including access and refresh tokens, and details the structure, generation, and usage of JWTs, while comparing security considerations and distributed session sharing strategies.
This guide explains Kubernetes' security pipeline—authentication, authorization, and admission control—detailing token and SSL authentication, service accounts, RBAC, ABAC, Node and Webhook authorizers, and the essential admission plugins, with practical kubectl commands and configuration examples.
This article explains Apache Shiro's security architecture, demonstrates how to create authentication tokens, configure realms, use caching and hashing for password protection, and integrate Shiro with Spring MVC through XML and Java code examples.
This cheat sheet provides a concise reference of Laravel's Auth facade methods for user authentication and session handling, as well as Gate-based authorization techniques, including ability definitions, permission checks, policy generation, and controller or middleware integration.
This guide explains the concepts of apiserver clients, authentication methods, service accounts, RBAC authorization, admission control, and provides step‑by‑step instructions for installing and accessing the Kubernetes Dashboard 2.0.
This guide explains Laravel's built‑in authorization features, covering how to define and register Gates and Policies, how to check permissions via the Gate facade, middleware, controller helpers, Blade directives, and includes practical code examples for common CRUD actions.
This article explains the OAuth 2.0 authorization framework, describes its four core roles and various grant types, and demonstrates how to configure a Spring Security OAuth2 client for GitHub login, including endpoint details, request parameters, and code examples.
This guide introduces Spring Security fundamentals, explaining authentication and authorization concepts, the core interfaces such as AuthenticationManager and AccessDecisionManager, how to configure them with Spring Boot, customize filter chains, apply method‑level security, and handle thread‑bound security contexts for asynchronous processing.
This article explains REST architecture, why security is essential, and compares Basic authentication, OAuth 2.0, OAuth 2.0 + JWT, and Amazon's HTTP signature method, evaluating their scalability and load impact in a micro‑service environment.
This article explains how to implement role‑based access control in Spring Security by embedding roles into UserDetails, configuring HttpSecurity with hasRole/hasAnyRole/hasAuthority, handling anonymous users, and using permitAll, providing code examples and detailed explanations for each approach.
This article explains the different exception types in Spring Security, how HTTP status codes map to authentication and authorization failures, and provides concrete implementations of AuthenticationEntryPoint and AccessDeniedHandler that return JSON responses, along with configuration tips for integrating them into a Spring Boot application.
This tutorial demonstrates how to integrate the lightweight Apache Shiro security framework into a Spring Boot 2.1.5 project, covering environment setup, Maven dependencies, Redis session storage, custom utilities, Shiro configuration, permission annotations, test controllers, and Postman verification.
This article explains Kubernetes RBAC fundamentals, demonstrates how to create roles, bindings, and service accounts, and introduces practical auditing commands and tools such as kubectl can‑i, who‑can, rakkess, rback, and RBAC‑View, helping you secure clusters with least‑privilege policies.
This article explains the OAuth authorization process, illustrating how a third‑party app like a WeChat‑based login requests user permission, obtains a code, exchanges it for an access token, and uses that token to access user data, while highlighting token expiration and business‑scenario applications.
This article walks through integrating Apache Shiro into a Spring Boot project to handle authentication, authorization, session management, and caching, including custom realms, Redis-backed sessions, and cache managers, while providing detailed code examples and configuration guidance.
This tutorial walks through building a Spring Boot backend with user registration, login, JWT token generation, Swagger UI configuration, and method-level permission annotations, providing complete code examples and step‑by‑step instructions for secure authentication and authorization.
This tutorial shows how to integrate Spring Security and JWT into a Spring Boot backend to implement user login and authorization, configure Swagger‑UI to automatically include the token, and provides all necessary code snippets, configuration files, and utility classes for a complete authentication solution.
Discover essential solutions for common WeChat Mini Program challenges—including plugin relative paths, generating QR codes, swiper current reset, template message limits, subpackage size rules, retrieving unionId, H5‑MiniProgram navigation, canvas overlay handling, image sharing ratios, authorization flows, and data binding constraints.
Designing a relatively secure account system requires integrating strong multi-factor authentication, fine-grained authorization models like RBAC or ABAC, and continuous real-time and offline auditing to mitigate breaches, while recognizing that absolute security is impossible and ongoing vigilance is essential.
This article explores the evolution of authentication and authorization from monolithic to microservice architectures, comparing traditional session-based methods with modern token solutions like JWT and OAuth2, and provides practical guidance on implementing secure, scalable access control across dozens of services.
This article explains the OAuth protocol, its role in providing secure third‑party access to user resources, describes the overall authorization architecture, outlines the involved parties and step‑by‑step flow, and details the four main grant types along with token refresh mechanisms.
This article introduces Apache Shiro as a powerful Java security framework, explains its core components such as Subject, SecurityManager, Authenticator, Authorizer, Realm, SessionManager, CacheManager and Cryptography, and provides step‑by‑step integration instructions with Maven, XML configuration, custom realm code, controller logic and JSP tag usage.
This article introduces Apache Shiro, a lightweight Java security framework, and explains its three core concepts—Subject, SecurityManager, and Realms—while detailing the full system architecture including authenticators, authorizers, session management, caching, and cryptography components.
This guide explains the three core pillars of RESTful API security—client authentication, data encryption, and post‑authentication authorization—detailing practical methods such as signature keys, HTTP Basic/Digest, OAuth, SSL, selective encryption with salts, and role‑based access control.
This article provides a step‑by‑step tutorial on using Apache Shiro for authentication, authorization, session management and encryption in a Java web project, covering Maven dependencies, custom Realm implementation, Spring XML configuration, servlet filter setup, controller logic, JSP login page, demo screenshots and common pitfalls.
This article explains the fundamental nature of permissions as limited authorized access to protected resources, defines what constitutes a resource in software, outlines permission classifications by method and layer, describes the control model using receptor‑ligand analogy, and summarizes the three core components of a permission system.
This guide provides a deep dive into Spring Security's architecture, explaining how authentication and authorization are separated, how the AuthenticationManager and AccessDecisionManager work, how web filter chains are organized, and how to apply method‑level security and thread‑local context handling in Java applications.
This article explains the fundamental nature of permissions as limited licensed access to protected resources, defines what constitutes a resource in software, outlines resource identification and limitation, and describes permission classifications, control models, and authorization mechanisms such as role‑based access.
The article examines the widespread exposure of MongoDB instances on default ports, outlines how attackers hijack them, and provides concrete steps—including enabling authentication, configuring role‑based access, encrypting traffic, and limiting network exposure—to secure MongoDB deployments.
This article examines the challenges of securing microservice architectures and compares various authentication and authorization approaches—including SSO, distributed sessions, client‑token schemes, JWT, and OAuth 2.0—to help developers choose suitable solutions for efficient and fine‑grained access control.
Guardian 5.0 introduces a comprehensive security solution for the TDH big‑data platform, featuring LDAP/Kerberos authentication, unified ARBAC authorization, quota management, and multi‑layer architecture, while enhancing data protection and simplifying operations across cloud‑based deployments.
This article chronicles the development milestones, architectural design, and practical lessons learned while building Jumpserver—from its humble 1.0 prototype to the feature‑rich 3.0 release—offering deep insights for developers and security engineers interested in open‑source bastion solutions.
The article explains how the newly released WeChat web development tool lets developers debug web authorization flows directly on a computer, eliminating the need to switch between mobile devices and simplifying the testing process.
OAuth2 provides a secure, open standard that lets third‑party applications obtain limited user access without exposing passwords, using a token‑based flow involving resource owners, clients, resource servers, and authorization servers, illustrated through a step‑by‑step authorization process.
This article explains the fundamentals of REST APIs, outlines HTTP methods, recommends JSON payloads, and details authentication, authorization, URL filtering, encryption, rate limiting, error handling, and other security measures for building robust backend services.
