BestHub
Sign in
Tagged articles

JWT

326 articles · Page 1 of 4
Xiaolin Talks Programming
Xiaolin Talks Programming
Sep 28, 2026 · Backend Development

Spring Boot 3.x AD/LDAP Integration: Unified Auth, Group Mapping & Production Pitfalls

This article details integrating Spring Boot 3.x with Active Directory/LDAP for unified authentication, covering directory model concepts, connection pooling, custom authentication providers, group-to-role mapping, JWT/OIDC/MFA integration, testing strategies, and critical production pitfalls like connection leaks, timeout misconfiguration, nested group performance, and certificate issues.

Active DirectoryAuthenticationAuthorization
0 likes · 48 min read
Spring Boot 3.x AD/LDAP Integration: Unified Auth, Group Mapping & Production Pitfalls
Java Tech Workshop
Java Tech Workshop
Sep 26, 2026 · Backend Development

Spring Boot 3 + Spring Security 6 + JWT: Production-Ready Auth & Authorization Guide

This article walks through building a complete JWT-based authentication and authorization system with Spring Boot 3 and Spring Security 6, covering RBAC database design, token issuance and validation, filter chain configuration, permission annotations, refresh tokens, logout blacklisting, and Vue 3 frontend integration.

AuthenticationAuthorizationJWT
0 likes · 33 min read
Spring Boot 3 + Spring Security 6 + JWT: Production-Ready Auth & Authorization Guide
Xiaolin Talks Programming
Xiaolin Talks Programming
Sep 15, 2026 · Backend Development

Building an Enterprise OAuth2 Authorization Server with Spring Boot and Spring Authorization Server: Complete Guide

This guide walks through building a production-ready OAuth2/OIDC authorization server using Spring Boot 3.x and Spring Authorization Server 1.3, covering client registration, authorization code flow with PKCE, custom JWT claims, RSA key rotation, MFA integration, and deployment best practices.

JWTKey RotationMFA
0 likes · 37 min read
Building an Enterprise OAuth2 Authorization Server with Spring Boot and Spring Authorization Server: Complete Guide
Java Tech Enthusiast
Java Tech Enthusiast
Sep 6, 2026 · Backend Development

Why Sa-Token Is Winning Over Spring Security: A Deep Dive into Java's Rising Auth Framework

This article analyzes why Sa-Token has surpassed 46K GitHub stars by comparing its Core-Plugin-Adapter architecture, zero-config startup, and one-line authentication API against Spring Security's steep learning curve, demonstrating how it reduces permission system implementation from weeks to days.

Core-Plugin-AdapterDistributed SessionJWT
0 likes · 18 min read
Why Sa-Token Is Winning Over Spring Security: A Deep Dive into Java's Rising Auth Framework
LuTiao Programming
LuTiao Programming
Sep 2, 2026 · Backend Development

Spring Boot Multi-Tenancy: Why Data Source Routing Is the Easy Part

This article walks through a production-ready Spring Boot multi-tenancy implementation using database-per-tenant isolation, JWT-based tenant identification via Spring Security, AbstractRoutingDataSource for dynamic routing, and ThreadLocal context management, while exposing critical pitfalls in transaction timing, async task propagation, and dynamic tenant registration.

AbstractRoutingDataSourceDatabase Per TenantJWT
0 likes · 16 min read
Spring Boot Multi-Tenancy: Why Data Source Routing Is the Easy Part
Architect's Guide
Architect's Guide
Aug 22, 2026 · Information Security

Comprehensive Guide: Implementing RBAC with Spring Security and JWT

This article walks through the fundamentals of Role‑Based Access Control (RBAC), explains the RBAC0‑RBAC3 model hierarchy, demonstrates how to configure Spring Security for in‑memory and database authentication, integrates JWT for stateless token handling, and shows how to enable JSON‑based login and BCrypt password encryption with concrete code examples.

AuthenticationJWTJava
0 likes · 16 min read
Comprehensive Guide: Implementing RBAC with Spring Security and JWT
LuTiao Programming
LuTiao Programming
Aug 21, 2026 · Backend Development

Spring’s New Multitenancy: Serving 1,000 Tenants with One Spring Boot App Without Hand‑Writing tenant_id

The article explains how Spring’s latest multitenancy support, combined with Spring Security, JWT and Hibernate’s @TenantId, lets a single Spring Boot application safely serve thousands of SaaS tenants by automatically isolating data, avoiding manual tenant_id filters, and handling indexes, native SQL, and async tasks.

HibernateJWTSaaS
0 likes · 11 min read
Spring’s New Multitenancy: Serving 1,000 Tenants with One Spring Boot App Without Hand‑Writing tenant_id
Golang Shines
Golang Shines
Aug 12, 2026 · Backend Development

How to Build an Enterprise‑Grade API with Gin and GORM

This tutorial walks through creating a complete Go backend service using Gin and GORM, covering project setup, layered architecture, database initialization, user model definition, JWT‑based registration and login, pagination, middleware, routing, and deployment options, while also suggesting extensible features such as RBAC, Swagger, Redis caching, Docker, and micro‑service frameworks.

APIBackend DevelopmentGORM
0 likes · 8 min read
How to Build an Enterprise‑Grade API with Gin and GORM
samdeepthink
samdeepthink
Aug 12, 2026 · Backend Development

Designing an Enterprise‑Level CAS SSO Architecture: A Practical Blueprint

This article presents a detailed technical blueprint for building an enterprise‑grade single sign‑on system that combines Apereo CAS, OAuth2, and JWT across four microservices, covering service responsibilities, data models, API contracts, deployment trade‑offs, and operational safeguards.

CASJWTMicroservices
0 likes · 26 min read
Designing an Enterprise‑Level CAS SSO Architecture: A Practical Blueprint
Java Architect Handbook
Java Architect Handbook
Aug 11, 2026 · Backend Development

Why Interviewers Mock Storing Tokens in Redis—and How to Answer

The article explains what JWT is, why its stateless design can cause problems, compares pure JWT, JWT with a blacklist, and storing tokens in Redis (whitelist), and provides a step‑by‑step guide on how to discuss these options convincingly in a Java interview.

AuthenticationBackendBlacklisting
0 likes · 11 min read
Why Interviewers Mock Storing Tokens in Redis—and How to Answer
Java Tech Enthusiast
Java Tech Enthusiast
Aug 10, 2026 · Information Security

A Complete Guide to Cookie, Session, Token, OAuth2.0, SSO, and JWT

This article systematically explains the concepts, workflows, advantages, drawbacks, and practical code examples of Cookie, Session, Token, OAuth2.0, Single Sign‑On (SSO) and JWT, compares them, offers best‑practice recommendations, and provides interview‑style Q&A for developers.

AuthenticationCookieJWT
0 likes · 16 min read
A Complete Guide to Cookie, Session, Token, OAuth2.0, SSO, and JWT
Coder Trainee
Coder Trainee
Jul 27, 2026 · Backend Development

From Zero to One: Build a Smart Table Reservation System with Triple‑Endpoint Architecture and Apple‑Style Design

This article walks through the end‑to‑end creation of a production‑grade table‑reservation platform, covering the three‑tier client architecture (WeChat Mini‑Program, H5/App via UniApp, and a Vue3 + Element Plus PC admin), a dual Spring Boot backend, Redis distributed locking combined with MySQL unique indexes for high‑concurrency seat booking, JWT‑based authentication, RBAC permission control, and an Apple‑inspired design system, all illustrated with concrete code snippets and deployment tips.

JWTRBACRedis Lock
0 likes · 21 min read
From Zero to One: Build a Smart Table Reservation System with Triple‑Endpoint Architecture and Apple‑Style Design
Code Farming
Code Farming
Jul 23, 2026 · Backend Development

Cut Authentication Traffic 50‑Fold with JWT: A Simple Token Strategy

The article explains how replacing centralized session lookups with JWT-based local verification can cut authentication latency from 15 ms to 0.3 ms—a roughly 50‑fold improvement—while describing a double‑token strategy, its refresh flow, security best practices, and trade‑offs such as delayed revocation.

Access TokenJWTPerformance
0 likes · 6 min read
Cut Authentication Traffic 50‑Fold with JWT: A Simple Token Strategy
Java Tech Workshop
Java Tech Workshop
Jul 22, 2026 · Backend Development

Spring Boot JWT Login Authentication with Seamless Refresh Explained

This article explains how to implement a double‑token JWT authentication scheme in Spring Boot 3.x, using short‑lived AccessTokens for API security and long‑lived RefreshTokens for seamless background renewal, while addressing token revocation, refresh thresholds, blacklist handling, and multi‑device considerations.

AuthenticationBackendJWT
0 likes · 23 min read
Spring Boot JWT Login Authentication with Seamless Refresh Explained
Black & White Path
Black & White Path
Jul 8, 2026 · Information Security

How I Earned $23,000 by Exploiting JWT Realm and File Overwrite Vulnerabilities

The article details a step‑by‑step exploitation chain against a site using JWT authentication and an upload endpoint, showing how modifying the JWT realm, removing the Bearer keyword, and abusing Amazon S3/CloudFront default settings enabled arbitrary file overwrite and yielded a total $23,000 bounty.

Authorization HeaderCloudFrontFile Overwrite
0 likes · 7 min read
How I Earned $23,000 by Exploiting JWT Realm and File Overwrite Vulnerabilities
java1234
java1234
Jul 4, 2026 · Mobile Development

Building a WeChat Mini‑Program Health Management System with AI in 20 Minutes (Spring AI 2.0 + Spring Boot 4 + Vue 3)

In just 20 minutes, the author uses Cursor AI to generate a full‑stack WeChat mini‑program for personal health management, featuring an AI‑driven health consultant, a Spring Boot 4 backend with JWT security, MySQL storage, and a Vue 3 admin console, and explains the architecture, routing, and deployment details.

AI chatbotJWTMySQL
0 likes · 10 min read
Building a WeChat Mini‑Program Health Management System with AI in 20 Minutes (Spring AI 2.0 + Spring Boot 4 + Vue 3)
Tech Musings
Tech Musings
Jul 3, 2026 · Backend Development

Optimizing HeFeng Weather Integration: Icon Fonts, JWT Auth, Layered Caching, and Gzip

The article details a complete HeFeng weather integration for a mini‑program, covering front‑end icon‑font rendering, Rust‑based backend JWT authentication with Ed25519, three upstream API calls, a two‑tier cache for real‑time and historical data, gzip auto‑decompression, request‑timeout layering, and environment‑variable driven deployment configuration.

CachingGZIPHeFeng Weather
0 likes · 10 min read
Optimizing HeFeng Weather Integration: Icon Fonts, JWT Auth, Layered Caching, and Gzip
Architect's Guide
Architect's Guide
Jun 27, 2026 · Information Security

A Comprehensive Guide to Front‑End and Back‑End Authentication Strategies

This article systematically explains ten common authentication approaches—from basic HTTP authentication and session‑cookie mechanisms to token, JWT, SSO, OAuth 2.0, QR‑code login, and one‑click login—detailing their principles, workflows, advantages, drawbacks, and typical usage scenarios with concrete examples and code snippets.

AuthenticationCookieJWT
0 likes · 42 min read
A Comprehensive Guide to Front‑End and Back‑End Authentication Strategies
Black & White Path
Black & White Path
Jun 26, 2026 · Information Security

Step‑by‑Step Guide to Exploiting JWT Vulnerabilities

This article dissects common JWT weaknesses—including the None algorithm, missing signature verification, algorithm/key confusion, CVE‑2018‑0114 parsing bugs, kid‑parameter injection, and weak‑key brute‑forcing—showing how attackers manipulate tokens and offering concrete code‑level demonstrations.

AuthenticationCVE-2018-0114JWT
0 likes · 10 min read
Step‑by‑Step Guide to Exploiting JWT Vulnerabilities
Programmer XiaoFu
Programmer XiaoFu
Jun 17, 2026 · Information Security

Why JWT Requires Both Access and Refresh Tokens Instead of a Single Token

The article explains the inherent trade‑off of a single JWT’s expiration time, shows how using short‑lived Access Tokens together with long‑lived Refresh Tokens resolves both security and user‑experience issues, and provides detailed backend and frontend implementation guidance.

Access TokenAuthenticationJWT
0 likes · 11 min read
Why JWT Requires Both Access and Refresh Tokens Instead of a Single Token
Java Tech Workshop
Java Tech Workshop
Jun 11, 2026 · Backend Development

Building a Production-Ready SpringBoot + Vue3 Front‑End/Back‑End Separation Architecture

This article presents a step‑by‑step guide to constructing a full‑stack SpringBoot + Vue3 project with production‑grade features such as global exception handling, unified error codes, JWT authentication, multi‑environment configuration, CORS solutions, pagination, Pinia state management, on‑demand UI imports, and Nginx reverse‑proxy deployment.

CORSJWTMyBatis-Plus
0 likes · 17 min read
Building a Production-Ready SpringBoot + Vue3 Front‑End/Back‑End Separation Architecture
Coder Trainee
Coder Trainee
May 30, 2026 · Information Security

Implementing Fine-Grained Permission Control with Spring Security and OAuth2 (Part 4)

This article walks through building a Spring Security resource server with OAuth2, enabling method‑level, object‑level and URL‑level permission checks using annotations like @PreAuthorize, @PostAuthorize, @PostFilter, and demonstrates configuration, utility helpers, controller examples, testing steps, best practices, and common pitfalls.

JWTJavaOAuth2
0 likes · 17 min read
Implementing Fine-Grained Permission Control with Spring Security and OAuth2 (Part 4)
Coder Trainee
Coder Trainee
May 28, 2026 · Information Security

Deep Dive into JWT with Spring Security OAuth2: Token Enhancement Techniques

This tutorial explains the JWT structure, shows how to add custom claims such as user ID, department and roles, implements token blacklisting for logout, handles refresh token logic, and provides step‑by‑step code and testing instructions for a Spring Security OAuth2 authentication system.

JWTOAuth2Redis
0 likes · 16 min read
Deep Dive into JWT with Spring Security OAuth2: Token Enhancement Techniques
Cloud Architecture
Cloud Architecture
May 27, 2026 · Information Security

Mastering Dual Token Authentication: From Architecture Design to Production Deployment

This comprehensive guide explains why many teams struggle with dual‑token implementations, outlines the three core goals of the mechanism, details threat modeling, design principles, data modeling, JWT claim choices, atomic refresh rotation with Redis Lua, and provides production‑ready Spring Boot code, observability, scaling and security hardening recommendations.

Access TokenAuthenticationJWT
0 likes · 35 min read
Mastering Dual Token Authentication: From Architecture Design to Production Deployment
Tinker Programmer
Tinker Programmer
May 25, 2026 · Information Security

Why Big Tech Shuns MD5 for Passwords: Inside Bcrypt and JWT Security

The article explains why modern systems avoid MD5 for password storage, details how Bcrypt’s deliberately slow, salted hashing thwarts brute‑force attacks, and shows that JWT provides stateless authentication whose security relies on signatures rather than encryption, while also discussing token revocation and DoS mitigation.

JWTMD5Stateless Authentication
0 likes · 7 min read
Why Big Tech Shuns MD5 for Passwords: Inside Bcrypt and JWT Security
Java Architect Essentials
Java Architect Essentials
May 19, 2026 · Backend Development

Why Storing Tokens in Redis Is the Right Answer in Interviews

The article explains why many interviewers mock the Redis‑based token design, then systematically presents technical and security reasons—controllable logout, multi‑device SSO, high performance, dynamic permissions—and provides concrete implementation details, comparison with pure JWT, and best‑practice responses.

AuthenticationBackend SecurityJWT
0 likes · 6 min read
Why Storing Tokens in Redis Is the Right Answer in Interviews
Java Tech Enthusiast
Java Tech Enthusiast
May 14, 2026 · Information Security

Why JWT Still Needs Redis Despite Its Stateless Promise

Although JWT is marketed as a stateless, database‑free authentication method, real‑world applications often store token identifiers in Redis to handle logout, password changes, and token renewal, which reintroduces state and a database lookup.

AuthenticationJWTRedis
0 likes · 6 min read
Why JWT Still Needs Redis Despite Its Stateless Promise
java1234
java1234
May 10, 2026 · Backend Development

Building a Spring Boot 4 + Vue 3 Student Archive System in 20 Minutes with Cursor AI

The article walks through creating a full‑stack university student archive management system—using Java 17, Spring Boot 4, MySQL 8 on the back end and Vue 3, Vite, Element Plus on the front end—generated in about 20 minutes with Cursor AI, and explains the architecture, role‑based access, JWT security, and data flow in detail.

AI codingCursor AIJWT
0 likes · 10 min read
Building a Spring Boot 4 + Vue 3 Student Archive System in 20 Minutes with Cursor AI
Black & White Path
Black & White Path
Apr 27, 2026 · Information Security

How I Exploited Multiple Vulnerabilities in a University System

This article details a step‑by‑step penetration test on a university’s web platform, covering XSS file uploads, JWT tampering for arbitrary login, massive personal data leakage, SQL injection payloads, and the exposure of several AK/SK secrets, all with concrete screenshots and commands.

JWTPenetration TestingSQL injection
0 likes · 5 min read
How I Exploited Multiple Vulnerabilities in a University System
Java Tech Workshop
Java Tech Workshop
Apr 25, 2026 · Information Security

Step‑by‑Step Guide to Integrating Spring Boot with OAuth2.0 Authorization and Resource Servers

This article walks through building a complete OAuth2.0 solution in Spring Boot, covering core concepts, a comparison of the four grant types, project initialization, detailed configuration of the authorization and resource servers, custom login pages, end‑to‑end testing, advanced optimizations, and security best‑practice recommendations.

JWTJavaOAuth2
0 likes · 24 min read
Step‑by‑Step Guide to Integrating Spring Boot with OAuth2.0 Authorization and Resource Servers
Java Tech Workshop
Java Tech Workshop
Apr 22, 2026 · Information Security

Stateless Authentication in SpringBoot with JWT: Complete Implementation Guide

This article explains why traditional session authentication is unsuitable for distributed micro‑service systems, introduces JWT as a stateless alternative, and provides a step‑by‑step SpringBoot implementation—including double‑token handling, Redis blacklist logout, interceptor configuration, and end‑to‑end testing—complete with code snippets and best‑practice recommendations.

AuthenticationJWTRedis
0 likes · 30 min read
Stateless Authentication in SpringBoot with JWT: Complete Implementation Guide
Java Captain
Java Captain
Apr 21, 2026 · Backend Development

Why Storing Tokens in Redis Beats Stateless JWT in Real‑World Interviews

The article explains why many interviewers dismiss Redis‑backed token storage as a bad design, then systematically demonstrates how Redis + token offers controllable logout, multi‑device support, high performance, dynamic permission refresh, and scenario‑driven architecture choices, providing concrete response scripts and advanced enhancements for interview success.

AuthenticationBackendInterview Tips
0 likes · 6 min read
Why Storing Tokens in Redis Beats Stateless JWT in Real‑World Interviews
Tech Ocean
Tech Ocean
Apr 16, 2026 · Backend Development

FastAPI Day 7: Implementing Clear JWT Authentication with Dependency Injection

This tutorial walks through building a full registration and login system in FastAPI, covering bcrypt password hashing, JWT token creation with expiration, dependency-injected authentication helpers, protected endpoints, and a suite of passing tests, demonstrating a clear and practical approach to backend authentication.

AuthenticationBackendDependency Injection
0 likes · 5 min read
FastAPI Day 7: Implementing Clear JWT Authentication with Dependency Injection
Coder Trainee
Coder Trainee
Apr 16, 2026 · Backend Development

Building a Tech Blog from Scratch (Part 2): Implementing Login Authentication with Spring Security and JWT

This article walks through creating a complete login authentication system—including registration, login, token refresh, and permission control—by replacing Spring Security's default session handling with JWT, configuring backend filters and utilities, and integrating a Vue 3 + Pinia front‑end with automatic token renewal.

AuthenticationJWTPinia
0 likes · 19 min read
Building a Tech Blog from Scratch (Part 2): Implementing Login Authentication with Spring Security and JWT
Cloud Architecture
Cloud Architecture
Apr 15, 2026 · Information Security

Authentication Foundations for Trillion-Request Scale: Cookie, Session, JWT, OAuth2.1, and SSO – Complete Guide and Practical Implementation

This comprehensive guide explains why authentication is the traffic, permission, and trust entry point in modern high‑concurrency systems, compares Cookie, Session, JWT, OAuth2.1 and SSO, and provides detailed architectural patterns, trade‑offs, implementation steps, and production‑grade best practices for building secure, scalable identity solutions.

AuthenticationJWTMicroservices
0 likes · 47 min read
Authentication Foundations for Trillion-Request Scale: Cookie, Session, JWT, OAuth2.1, and SSO – Complete Guide and Practical Implementation
dbaplus Community
dbaplus Community
Apr 8, 2026 · Information Security

Why Storing JWT Tokens in Redis Isn’t a Flaw – When and How to Do It

The article analyzes the debate over placing JWT tokens in Redis, compares traditional session and JWT approaches, discusses security and performance trade‑offs, shows practical blacklist code, and explains when a centralized store is justified versus when true stateless JWTs are preferable.

AuthenticationJWTRedis
0 likes · 13 min read
Why Storing JWT Tokens in Redis Isn’t a Flaw – When and How to Do It
Wu Shixiong's Large Model Academy
Wu Shixiong's Large Model Academy
Mar 27, 2026 · Artificial Intelligence

Securing RAG Systems: A Three‑Layer Permission Framework for Banking AI

This article explains why vector databases lack row‑level security, presents a three‑layer permission architecture—including JWT authentication, Milvus metadata or partition filtering, and post‑retrieval validation—covers document security levels, PostgreSQL RLS, audit logging, caching strategies, and offers interview‑ready talking points.

JWTMilvusPermission Management
0 likes · 18 min read
Securing RAG Systems: A Three‑Layer Permission Framework for Banking AI
Java Architect Handbook
Java Architect Handbook
Mar 16, 2026 · Backend Development

Cookie vs Session vs Token: Master Java Authentication for Interviews

This guide outlines interview focus points, core definitions, and deep analysis of Cookie, Session, and Token (JWT), compares their storage, security, scalability, and cross‑origin support, and provides high‑frequency follow‑up questions, common variants, memory mnemonics, and selection principles for Java authentication.

AuthenticationCookieJWT
0 likes · 15 min read
Cookie vs Session vs Token: Master Java Authentication for Interviews
Senior Tony
Senior Tony
Feb 26, 2026 · Information Security

Why Most Projects Choose Token + Redis Over Stateless JWT

Although JWT is marketed as a decentralized, stateless solution, the majority of real‑world applications still rely on a Token + Redis approach because it simplifies logout handling, avoids Redis outages, and aligns better with practical security requirements.

AuthenticationBackendJWT
0 likes · 7 min read
Why Most Projects Choose Token + Redis Over Stateless JWT
Open Source Tech Hub
Open Source Tech Hub
Jan 21, 2026 · Information Security

JWT Explained: When to Use Stateless Tokens and What to Watch Out For

JSON Web Tokens (JWT) provide a compact, signed, self-contained way to authenticate API requests without server-side session storage, offering scalability and speed, while introducing trade-offs such as revocation challenges, token size, and exposure of unencrypted payloads, making them ideal for distributed systems but unsuitable for scenarios requiring immediate logout or sensitive data.

API SecurityAuthenticationJWT
0 likes · 10 min read
JWT Explained: When to Use Stateless Tokens and What to Watch Out For
Data STUDIO
Data STUDIO
Jan 14, 2026 · Backend Development

Why FastAPI Is the Ideal Choice for High‑Performance Python Microservices – A Hands‑On Guide

This article explains how FastAPI’s async support, type‑hint integration, automatic OpenAPI docs, and rich ecosystem enable Python developers to build scalable, secure microservices with layered architecture, JWT authentication, performance optimizations, comprehensive testing, Docker/Kubernetes deployment, and structured logging.

DockerFastAPIJWT
0 likes · 22 min read
Why FastAPI Is the Ideal Choice for High‑Performance Python Microservices – A Hands‑On Guide
Architect's Guide
Architect's Guide
Jan 11, 2026 · Information Security

10 Common Authentication Techniques Explained: From Basic Auth to OAuth and QR‑Login

This article systematically introduces ten widely used authentication methods—including HTTP Basic Auth, Session‑Cookie, Token, JWT, Single Sign‑On, OAuth 2.0, federated login, unique‑device login, QR‑code login, and one‑click mobile login—explaining their principles, workflows, advantages, drawbacks, and typical implementation libraries.

AuthenticationJWTOAuth
0 likes · 45 min read
10 Common Authentication Techniques Explained: From Basic Auth to OAuth and QR‑Login
JavaScript
JavaScript
Jan 1, 2026 · Information Security

Why Storing JWT in localStorage Is No Longer Safe and What to Use Instead

Storing JWT tokens in localStorage has become a serious security risk because XSS attacks can steal them, so developers should adopt safer alternatives such as HttpOnly cookies, BFF‑backed sessions, or Service Worker‑based in‑memory storage, each with its own trade‑offs.

AuthenticationBFFCSRF
0 likes · 10 min read
Why Storing JWT in localStorage Is No Longer Safe and What to Use Instead
Tech Freedom Circle
Tech Freedom Circle
Dec 31, 2025 · Information Security

Unified SSO via Gateway: Multi‑App Auth & Authz and JWT vs Auth vs Authz

This article walks through a complete design and implementation of a unified single sign‑on system using OAuth2.0 authorization‑code flow, Spring Cloud Gateway, JWT, Redis, and Nacos, comparing JWT, authentication, and authorization while presenting performance metrics, security considerations, and interview‑ready answers.

AuthenticationAuthorizationJWT
0 likes · 59 min read
Unified SSO via Gateway: Multi‑App Auth & Authz and JWT vs Auth vs Authz
Code Wrench
Code Wrench
Dec 20, 2025 · Backend Development

How to Build a High‑Performance Stateless OAuth2 Auth Server in Go

This article walks through a production‑grade OAuth2 authentication center built with Go and Gin, covering a three‑layer architecture, stateless JWT handling, key‑rotation, short‑hash token revocation, high‑availability design, and practical open‑source references.

AuthenticationGoJWT
0 likes · 11 min read
How to Build a High‑Performance Stateless OAuth2 Auth Server in Go
Top Architect
Top Architect
Dec 13, 2025 · Information Security

Why Many Developers Avoid Using JWT: Risks and Drawbacks Explained

This article introduces JSON Web Tokens (JWT), explains how they work in authentication flows, and examines their major drawbacks such as token size overhead, redundant signatures, revocation challenges, stale data risks, and lack of encryption, concluding that JWTs are suited for short‑lived claims but not for long‑term session management.

Access ControlJWTToken
0 likes · 11 min read
Why Many Developers Avoid Using JWT: Risks and Drawbacks Explained
JavaScript
JavaScript
Nov 30, 2025 · Information Security

Why Storing JWT in localStorage Is a Security Nightmare and Safer Alternatives

Storing JWT tokens in localStorage, once a common practice for front‑end authentication, now poses severe XSS risks; this article explains the vulnerabilities, compares HttpOnly cookies, BFF with cookies, and Service Worker‑based solutions, and recommends safer strategies for modern web applications.

BFFCSRFHttpOnly cookie
0 likes · 11 min read
Why Storing JWT in localStorage Is a Security Nightmare and Safer Alternatives
JavaGuide
JavaGuide
Nov 27, 2025 · Backend Development

Xiaomi Java Interview Insights: Reflection, Dynamic Proxies, Redis & JWT

The article starts by highlighting Xiaomi's competitive software developer salaries, then provides a detailed Java interview guide covering reflection fundamentals, static vs dynamic proxies, SPI vs API, synchronization behavior, Redis caching strategies, and JWT authentication, complete with code examples and practical comparisons.

JWTJavaRedis
0 likes · 25 min read
Xiaomi Java Interview Insights: Reflection, Dynamic Proxies, Redis & JWT
Ray's Galactic Tech
Ray's Galactic Tech
Nov 19, 2025 · Information Security

Mastering Modern Login Mechanisms: Cookies, Sessions, JWT, OAuth2 & SSO

This comprehensive guide explains why authentication is needed for stateless HTTP, walks through the workflows, advantages, and drawbacks of Cookies, Sessions, Tokens, JWTs, Refresh Tokens, blacklist strategies, and OAuth2/OAuth2.1, and provides practical security best‑practice recommendations for web, mobile, and micro‑service architectures.

AuthenticationJWTOAuth2
0 likes · 12 min read
Mastering Modern Login Mechanisms: Cookies, Sessions, JWT, OAuth2 & SSO
JavaGuide
JavaGuide
Nov 12, 2025 · Backend Development

Shopee Backend 2023 Salary Offers and In-Depth Interview Guide

Shopee’s 2023 backend positions offer competitive salaries ranging from 23.5k to 32k in Shenzhen, and the article provides a comprehensive interview guide covering network models, TCP handshake, HTTP/HTTPS differences, MySQL isolation levels, foreign keys, slow query optimization, JWT authentication, RBAC, and Redis sorted sets.

BackendJWTMySQL
0 likes · 31 min read
Shopee Backend 2023 Salary Offers and In-Depth Interview Guide
Top Architect
Top Architect
Nov 11, 2025 · Information Security

Mastering Authentication & Authorization: Cookies, Sessions, Tokens, and JWT Explained

This comprehensive guide explores the fundamentals of authentication and authorization, detailing how credentials, cookies, and sessions work together, and compares traditional session-based approaches with modern token-based solutions such as JWT, covering their mechanisms, advantages, drawbacks, and best practices for secure, scalable web applications.

AuthenticationAuthorizationJWT
0 likes · 38 min read
Mastering Authentication & Authorization: Cookies, Sessions, Tokens, and JWT Explained
Open Source Tech Hub
Open Source Tech Hub
Nov 11, 2025 · Information Security

Understanding Authentication vs Authorization: From Basics to JWT & Casbin

This article explains the fundamental differences between authentication and authorization, outlines various authentication factors, details the JWT signing process, and introduces Casbin as a powerful open‑source authorization framework, helping developers secure API access effectively.

APIAuthenticationAuthorization
0 likes · 8 min read
Understanding Authentication vs Authorization: From Basics to JWT & Casbin
Architect's Guide
Architect's Guide
Nov 9, 2025 · Information Security

Understanding Authentication, Authorization, and Tokens: From Cookies to JWT

This article explains the fundamentals of authentication, authorization, and credentials, compares cookies, sessions, and tokens, introduces JWT structure and usage, discusses common security concerns, and outlines practical solutions for distributed systems and modern web applications.

AuthenticationAuthorizationCookie
0 likes · 36 min read
Understanding Authentication, Authorization, and Tokens: From Cookies to JWT
JavaGuide
JavaGuide
Nov 4, 2025 · Backend Development

JD Backend Salary Ranges 2024 & How to Ace the Interview

The article shares recent JD backend salary data ranging from 24k to 32k RMB per month, explains the compensation structure, and provides a step‑by‑step interview preparation guide covering project presentation, JWT, Redis, thread pools, MySQL‑Elasticsearch sync, isolation levels and performance analysis.

Backend DevelopmentJDJWT
0 likes · 21 min read
JD Backend Salary Ranges 2024 & How to Ace the Interview
Selected Java Interview Questions
Selected Java Interview Questions
Oct 24, 2025 · Backend Development

How to Secure a Spring Boot Application with Spring Security and JWT

This step‑by‑step guide shows how to integrate Spring Security into a Spring Boot project, configure Maven dependencies, define User, Role and Permission entities, set up MyBatis mappers, implement JWT generation and validation, and build the service, controller, and configuration layers for a complete authentication system.

AuthenticationAuthorizationBackend Development
0 likes · 28 min read
How to Secure a Spring Boot Application with Spring Security and JWT
IT Services Circle
IT Services Circle
Sep 22, 2025 · Information Security

JWT vs Token+Redis: Which Authentication Strategy Wins for Your Apps?

This article provides a comprehensive comparison of JWT and Token‑Redis authentication schemes, covering their underlying principles, Java implementations, advantages and disadvantages, performance and security trade‑offs, suitable use‑cases, and practical guidance for choosing the optimal solution in modern web and mobile applications.

AuthenticationJWTJava
0 likes · 15 min read
JWT vs Token+Redis: Which Authentication Strategy Wins for Your Apps?
Su San Talks Tech
Su San Talks Tech
Sep 19, 2025 · Information Security

JWT vs Token+Redis: Which Authentication Strategy Wins for Your Backend?

This article thoroughly compares JWT and Token‑plus‑Redis authentication approaches, detailing their underlying principles, Java implementations, performance, security trade‑offs, and ideal use‑cases, and even proposes a hybrid solution that combines the strengths of both methods for modern applications.

AuthenticationJWTToken
0 likes · 16 min read
JWT vs Token+Redis: Which Authentication Strategy Wins for Your Backend?
Programmer XiaoFu
Programmer XiaoFu
Sep 15, 2025 · Information Security

SSO vs OAuth2.0: Key Differences Explained for Interviews

This article compares Single Sign‑On (SSO) and OAuth2.0, detailing their conceptual distinctions, token‑based workflows, implementation frameworks like CAS, the four OAuth2.0 grant types, and how each can be used to achieve seamless authentication across applications.

AuthenticationAuthorizationCAS
0 likes · 8 min read
SSO vs OAuth2.0: Key Differences Explained for Interviews
Architecture Digest
Architecture Digest
Aug 27, 2025 · Backend Development

How to Implement Seamless Token Refresh in Spring Boot & Axios

This article explains how to implement seamless, invisible token refresh in a Spring Boot authentication server and a Vue/axios frontend, covering gateway interceptors, JWT expiration handling, Axios response interceptors, timer‑based proactive refresh, and complete code examples for both backend and client sides.

BackendJWTToken Refresh
0 likes · 23 min read
How to Implement Seamless Token Refresh in Spring Boot & Axios
Lobster Programming
Lobster Programming
Aug 25, 2025 · Information Security

Storing User Sessions in SSO: Cookie+Session, Redis, and JWT Solutions

This article explains common approaches for storing user login state in distributed single sign‑on systems, covering the simple cookie‑plus‑session method, session storage in Redis for high‑availability, and token‑based JWT solutions, while discussing their architectures, advantages, and potential drawbacks.

JWTSession Managementsingle sign-on
0 likes · 6 min read
Storing User Sessions in SSO: Cookie+Session, Redis, and JWT Solutions
Su San Talks Tech
Su San Talks Tech
Aug 23, 2025 · Information Security

Cookie, Session, Token, JWT, OAuth2: Which One Fits Your Project?

This article demystifies the differences between Cookie, Session, Token, JWT, and OAuth2, explains their underlying mechanisms, shows practical Spring code examples, compares their security properties and suitable scenarios, and provides clear guidance on choosing the right authentication strategy for modern web applications.

CookieJWTOAuth2
0 likes · 13 min read
Cookie, Session, Token, JWT, OAuth2: Which One Fits Your Project?
Code Mala Tang
Code Mala Tang
Jul 24, 2025 · Information Security

Boost FastAPI Security: OAuth2, JWT, RBAC, Refresh Tokens & MFA

This guide explains how to secure FastAPI applications using OAuth2 with JWT, role‑based access control, refresh‑token workflows, multi‑factor authentication, and integration with external providers such as Auth0, Keycloak, and Firebase.

AuthenticationFastAPIJWT
0 likes · 9 min read
Boost FastAPI Security: OAuth2, JWT, RBAC, Refresh Tokens & MFA
macrozheng
macrozheng
Jul 7, 2025 · Backend Development

Mastering RBAC with Spring Security and JWT: A Hands‑On Guide

This article walks through the fundamentals of role‑based access control (RBAC), explains RBAC model variants, demonstrates how to configure Spring Security with in‑memory, database, and JWT authentication, and shows JSON‑based login and password encryption techniques for secure backend development.

AuthenticationJWTRBAC
0 likes · 15 min read
Mastering RBAC with Spring Security and JWT: A Hands‑On Guide
Code Mala Tang
Code Mala Tang
Jul 7, 2025 · Backend Development

Secure FastAPI APIs with JWT: Step‑by‑Step Guide & Best Practices

This tutorial explains the fundamentals of JSON Web Tokens, their structure, how to encode them with base64Url, and provides a complete FastAPI implementation—including installation, token generation, verification, protected routes, and practical security recommendations—for building robust authentication in distributed systems.

AuthenticationBackend DevelopmentFastAPI
0 likes · 10 min read
Secure FastAPI APIs with JWT: Step‑by‑Step Guide & Best Practices
Top Architect
Top Architect
Jul 4, 2025 · Information Security

How to Secure JWT Tokens: Preventing Theft, Replay, and Forgery

With the rise of digital economies, token security—especially JWT—has become critical; this article compares token and traditional session authentication, outlines token-based authentication flow, identifies theft, replay, and forgery threats, and presents comprehensive safeguards such as HTTPS, encryption, secure storage, expiration policies, 2FA, and safe refresh mechanisms.

JWTinformation securitytoken security
0 likes · 14 min read
How to Secure JWT Tokens: Preventing Theft, Replay, and Forgery
Java Architect Essentials
Java Architect Essentials
Jul 2, 2025 · Information Security

How to Bulletproof JWTs: Prevent Token Theft, None Attacks, and Brute‑Force

This article examines common JWT vulnerabilities—including token exposure via localStorage, algorithm‑tampering “none” attacks, weak signing keys, and lack of revocation—and presents a robust solution using HTTPS transmission, HttpOnly Secure cookies, SM9 cryptographic signatures, and a Redis‑based blacklist to achieve dramatically improved security.

FlaskJWTPython
0 likes · 12 min read
How to Bulletproof JWTs: Prevent Token Theft, None Attacks, and Brute‑Force
php Courses
php Courses
Jun 26, 2025 · Backend Development

Build a Full JWT Authentication System in Native PHP Without Frameworks

Learn how to implement a complete JWT authentication workflow in pure PHP—from generating and verifying tokens, creating a simple login system, protecting routes with middleware, to adding token refresh logic—while covering essential security best practices without relying on any framework.

BackendJWT
0 likes · 8 min read
Build a Full JWT Authentication System in Native PHP Without Frameworks
Java Backend Technology
Java Backend Technology
Jun 25, 2025 · Information Security

How to Seamlessly Refresh JWT Tokens: Backend and Frontend Strategies

This article explains why sudden logouts occur due to expired JWT tokens stored in Redis, and presents both backend automatic token renewal and frontend double‑token (access‑token and refresh‑token) approaches, complete with code examples, testing tips, and handling edge cases such as long‑idle form submissions.

AuthenticationBackendJWT
0 likes · 10 min read
How to Seamlessly Refresh JWT Tokens: Backend and Frontend Strategies
Architecture Digest
Architecture Digest
Jun 20, 2025 · Backend Development

How to Implement Seamless Token Refresh in Java Backend with JWT

This article explains why silent token refresh is needed, outlines backend and front‑end strategies for automatically renewing JWTs, provides a complete Java implementation with Maven dependencies, utility methods, unit tests, and discusses handling edge cases such as long‑idle forms.

AuthenticationBackendJWT
0 likes · 10 min read
How to Implement Seamless Token Refresh in Java Backend with JWT
JavaScript
JavaScript
Jun 19, 2025 · Information Security

Why Storing JWT in localStorage Is Dangerous and Safer Alternatives for 2025

Storing JWT tokens in localStorage, once a common practice for front‑end authentication, now poses severe XSS risks, prompting developers to adopt more secure methods such as HttpOnly cookies with SameSite protection, BFF‑backed session cookies, or Service Worker‑based token handling, each with trade‑offs.

BFFCSRFJWT
0 likes · 8 min read
Why Storing JWT in localStorage Is Dangerous and Safer Alternatives for 2025
Java Captain
Java Captain
Jun 3, 2025 · Information Security

Integrating Spring Security with Spring Boot for JWT Authentication and Authorization

This article demonstrates how to integrate Spring Security into a Spring Boot application, configure JWT‑based authentication, implement custom AES encryption, define user and role entities, set up service and controller layers, and configure security, filter, and CORS settings to achieve secure login and permission management.

AuthenticationAuthorizationJWT
0 likes · 19 min read
Integrating Spring Security with Spring Boot for JWT Authentication and Authorization
Top Architect
Top Architect
May 7, 2025 · Information Security

Understanding JWT Token Security and Mitigation Strategies

This article explains the fundamentals of JSON Web Tokens (JWT), compares token‑based authentication with traditional session authentication, outlines common security threats such as theft, replay and forgery, and provides practical mitigation measures including HTTPS, token encryption, secure storage, expiration policies, two‑factor authentication and safe token refresh mechanisms.

AuthenticationJWTinformation security
0 likes · 14 min read
Understanding JWT Token Security and Mitigation Strategies
Top Architect
Top Architect
Apr 21, 2025 · Information Security

Understanding JWT Token Security and Mitigation Strategies

This article explains the fundamentals of JSON Web Tokens (JWT), compares token‑based authentication with traditional session authentication, outlines common token security threats such as theft, replay, and forgery, and presents practical mitigation measures including HTTPS, encryption, secure storage, short expiration, MFA, and safe token refresh mechanisms.

AuthenticationHTTPSJWT
0 likes · 14 min read
Understanding JWT Token Security and Mitigation Strategies
Subtle Storm
Subtle Storm
Apr 11, 2025 · Information Security

Practical JWT Authentication with PyJWT and Django SimpleJWT

This article explains the JWT standard, its three-part structure, and demonstrates how to generate, decode, refresh, and handle exceptions for tokens using PyJWT, then shows integration of SimpleJWT in a Django REST framework project, along with security best‑practice tips.

AuthenticationDjangoJWT
0 likes · 7 min read
Practical JWT Authentication with PyJWT and Django SimpleJWT