This article explains the fundamental differences between JSON Web Token (JWT) and OAuth2, describes how each works, provides code examples of JWT structure, outlines OAuth2 roles and flows, and discusses practical scenarios, advantages, and drawbacks for securing APIs.
The article outlines the need for a unified account management system in enterprise platforms and details a token‑based authentication solution using OAuth2 password grant and JWT, describing its advantages, workflow, technical selection, and interface design for secure cross‑service integration.
This article explains why asynchronous openFeign calls trigger Sentinel fallback due to missing request context, and provides a practical solution that copies the main thread's RequestAttributes into async threads to preserve JWT tokens and other headers.
This article outlines the design rationale, objectives, and technical choices for a unified, token‑based authentication system based on OAuth2 password grant and JWT, detailing terminology, workflow steps, security benefits, and interface specifications to enable cross‑system single sign‑on and secure access control.
This article explains why enterprises need a unified, token‑based OAuth2 authentication system, outlines its advantages over session‑based methods, describes the standard OAuth2 password flow, JWT usage, and details the authorization, authentication, and credential‑renewal processes with architectural diagrams.
This article explains the necessity of a unified account management system for enterprise applications and details a token‑based authentication solution using OAuth2 password grant and JWT, covering definitions, advantages, workflow steps, technical choices, and interface design for secure microservice integration.
This article explains the principles and workflow of Single Sign-On (SSO) using OAuth2.0, illustrates the process with a real‑life scenario, compares multi‑point and single‑point login, and provides a complete Spring Boot example for building an authorization server, client, and role‑based access control in micro‑service architectures.
This article explains the principles of Single Sign‑On using OAuth2.0, illustrates the workflow with a real‑world analogy, and provides a complete SpringBoot example—including authorization server, client configuration, role‑based access control, and micro‑service integration—so readers can master SSO implementation and security design.
This article demystifies Single Sign-On using OAuth2.0 by illustrating the authentication and authorization flow through a real‑world analogy, explaining HTTP redirects, detailing the four grant types, and providing a complete Spring Boot implementation with role‑based access control for both client and server sides in microservice architectures.
This article explains practical methods to protect externally exposed APIs, covering token‑based access, OAuth2.0 authorization, signature verification, encryption techniques (hashing, symmetric and asymmetric), key management, and provides Java code samples for DES and RSA implementations.
This article explains the OAuth2 authorization framework, illustrates its principles with a delivery‑person analogy, details the four main grant types, and provides a step‑by‑step Spring Boot implementation including server configuration, resource protection, and Postman testing.
After adopting OAuth2.0, the added concept of scope often confuses developers; this article clarifies the differences between scope and role, explains how each controls access, shows Spring Security code examples, and highlights their complementary relationship in securing APIs.
This tutorial walks through setting up a Spring Authorization Server in a Spring Boot servlet project, adding required dependencies, configuring filter chains, persisting OAuth2 clients, authorizations, and consents with JDBC, and defining JWK sources and provider settings for a complete OAuth2 authorization server.
This article explains the modular configuration of Spring Security's OAuth2 components, showcases the core config classes for client, resource, and authorization servers, and details the default filter chain and customizable filter configurers used by Spring Authorization Server.
This guide walks you through replacing Spring Security OAuth2.0 with the production-ready Spring Authorization Server, showing how to add OAuth2 client, resource server, and authorization server dependencies, and demonstrating a complete authorization‑code flow demo with detailed request/response examples and configuration snippets.
This tutorial walks through converting a monolithic Spring application into a Spring Cloud microservice by implementing a JWT‑based OAuth2 resource server, covering required dependencies, custom JWT decoding, key separation, security filter configuration, and token parsing customization.
This article explains what an OAuth2 Resource Server is, why traditional monolithic security models become cumbersome in microservice architectures, and how decoupling authentication from authorization using JWTs simplifies token validation across distributed services.
This article explains the fundamentals of authentication, covering session‑cookie and token methods, their workflows, security considerations, and advanced techniques such as single sign‑on, OAuth2, LDAP, and two‑factor authentication, with practical examples and code snippets.
This article explains the concept of multi‑account login using third‑party identities, describes early‑stage username/password and mobile‑number authentication flows, presents a detailed database schema, and outlines the integration process for services like QQ‑SDK following OAuth2.0 principles.
This article outlines a practical approach to designing open platform APIs, covering usability, security, stability, service provider application setup, OAuth2 authorization flow, system and business request parameters, and concrete signing and verification code examples.
This article outlines a practical approach to designing open‑platform APIs, covering service‑provider application registration, usability, security, OAuth2‑based authorization, systematic and business request parameters, signature generation, verification, and best‑practice code examples.
GrowingIO’s server-side solution integrates three distinct authentication protocols—OAuth2, LDAP, and CAS—into a unified SSO flow, detailing each protocol’s process, the overall architecture, role of the IAM and Gateway components, and providing configuration and code examples for implementation.
This guide walks through creating a Spring Boot 2.2.11 OAuth2 authorization server that stores tokens in Redis, defines custom client and user entities, configures grant types, and demonstrates testing each flow, complete with code snippets and configuration files.
This guide explains how to integrate OAuth2 with Spring Boot 2.3.10, troubleshoot missing OAuth2AuthorizationRequest in the session, and resolve the issue by adjusting host configuration and domain settings, providing full code snippets and configuration details.
This guide walks through setting up WeChat web authorization, customizing Spring Security's OAuth2 flow, handling token exchange, and retrieving user info, providing a complete backend solution for secure WeChat-enabled applications.
This tutorial explains step‑by‑step how to add Keycloak authentication to a Spring Boot application using the Spring Security adapter, covering Maven dependencies, configuration files, custom resolvers, role mapping, session strategies, and the typical authorization code flow.
This tutorial walks through installing Keycloak via Docker, exploring its admin console, configuring realms, users, and clients, and demonstrates both authorization code and password grant flows before integrating Keycloak with a SpringBoot application to protect APIs using OAuth2.
This article explains the principles of Single Sign‑On using OAuth2.0, illustrates the flow with a real‑world analogy, and provides a complete SpringBoot implementation for both the authorization server and client, including role‑based permission control and microservice integration.
This article explains how OpenID Connect (OIDC) builds on OAuth 2.0 to provide authentication, demonstrates a practical Keycloak integration with a Spring Boot app, and walks through a complete authorization flow for a photo‑storage service using client credentials and secure token exchange.
This article examines why enterprises need a unified account management system, explains token‑based authentication advantages, defines key OAuth2 and JWT concepts, outlines the typical token flow, and details the technical choices and process logic for secure, stateless access control across microservices.
This article provides a step‑by‑step guide to integrating GitHub and QQ third‑party OAuth2 login in a Spring Boot backend, covering app registration, required URLs, state handling to prevent CSRF, and complete Java code for authorization, token exchange, and user info retrieval.
This guide explains how to implement QQ login using the official OAuth2.0 flow, covering developer registration, creating a website application, obtaining the authorization code, access token, and OpenID, and finally calling the get_user_info API to retrieve user details.
This article outlines practical approaches for implementing multi‑account login, covering early‑stage username/password and phone‑based registration, detailed authentication flows, OAuth2 integration with third‑party providers, and comprehensive database schema designs to unify local and external user identities.
Spring Security 5.5 introduces the JWT Bearer grant, an OAuth2.0 authorization mode defined in RFC7523, allowing clients to obtain access tokens using trusted JWTs and also to authenticate themselves, offering a streamlined alternative to traditional user‑approval flows.
This guide walks through configuring Spring Boot 2.3.10 with OAuth2 client support, detailing required dependencies, application and security settings, common session‑related errors, step‑by‑step debugging of OAuth2LoginAuthenticationFilter and OAuth2AuthorizationRequestRedirectFilter, and the final solution of aligning hostnames to preserve cookies.
This guide explains why Spring Boot 2’s OAuth2 authorization code flow skips the user‑approval page, walks through the relevant source code, and shows how to customize the confirmation and login pages, configure controllers and security settings, and verify the changes with tests.
This article explains the concept, technical solutions, workflow diagrams, and database schema for implementing unified multi‑account login using username/password, mobile verification, and third‑party OAuth2 integrations, providing practical design guidance without detailed source code.
This guide demonstrates how to integrate Spring Boot 2 with OAuth2 to build a protected resource server, configure Redis for token storage, define domain and security classes, and test the secured endpoints, complete with code snippets and visual verification steps.
This tutorial walks through setting up a Spring Boot 2.2.11 OAuth2 authorization server that stores tokens in Redis, covering Maven dependencies, YAML configuration, JPA entities, DAO interfaces, core server configuration, custom client details, authentication provider, password encoder, and detailed testing of all OAuth2 grant types.
This tutorial walks through building a single sign‑on (SSO) system using OAuth2, Spring Security, and JWT, covering preparation, core concepts, Maven dependencies, configuration files, custom login pages, client setup, logout handling, project structure, and a full demonstration.
This article explains the fundamental differences between JSON Web Token (JWT) and OAuth2, describes their structures, security considerations, implementation details, and outlines appropriate scenarios for using each method to protect APIs.
This article explains the role of OAuth2AuthorizationCodeAuthenticationProvider in Spring Security, details how OAuth2AccessTokenResponseClient obtains access tokens, shows how to customize the token endpoint, and walks through the complete token‑retrieval flow with code examples and step‑by‑step analysis.
The article explains the design and implementation of a token‑based authentication system for micro‑services, covering terminology, business background, OAuth2 password‑grant flow, JWT usage, security advantages, functional modules, technical choices, detailed authentication workflow, and API design.
This article explains the fundamental differences between JSON Web Tokens (JWT) and OAuth2, outlines their structures, security considerations, implementation details, and compares their advantages, drawbacks, and suitable use cases to help developers choose the appropriate method for securing APIs.
This article explains the fundamental differences between JSON Web Tokens (JWT) and OAuth 2.0, outlines their structures, roles, and grant types, compares implementation effort and risk, and provides guidance on choosing the right approach for various API security scenarios.
This article provides a hands‑on guide to using IdentityServer4 in the Fuluteng project, covering signing credentials, client and resource stores, persisted grant storage with Redis, various OAuth2 grant types including client credentials, authorization code, password, and custom extensions such as SMS and third‑party logins, and demonstrates role‑based authorization and JWT configuration.
This article explores how Spring Security processes OAuth2 login callbacks, detailing the role of AuthenticationManager, the creation of OAuth2LoginAuthenticationToken, the selection of appropriate AuthenticationProvider such as OAuth2LoginAuthenticationProvider and OidcAuthorizationCodeAuthenticationProvider, and the subsequent generation of OAuth2User and token objects.
This article walks through Spring Security's OAuth2 authorization flow, revealing the entry URL, key resolver and filter classes, core request‑handling logic, and how the framework redirects users to third‑party providers.
This article answers common questions about permission management in the Mall and Mall‑Swarm projects, covering deprecated tables, required SQL scripts, front‑end menu visibility, differences between Spring Security and OAuth2‑Gateway implementations, configuration fixes, token usage, and a tiny demo project for learning.
This article explains how to implement seamless JWT token refresh in a Spring Boot OAuth2 application by embedding refresh information into the access token, customizing token services, defining a token refresh executor, and handling the refreshed token on the front‑end with an Axios interceptor.
This article explains the technical solutions for unified multi‑account login in web applications, covering early‑stage username/password and mobile verification flows, detailed process steps, OAuth2.0 third‑party integration, and comprehensive database schema design for local and third‑party user authentication.
This article explains the concept of multi‑account unified login in internet applications, detailing early‑stage username/password and mobile‑based authentication flows, the evolution to third‑party OAuth2 integration, and provides comprehensive database schema designs for local and third‑party user accounts.
This tutorial explains how to extend Spring Security's OAuth2 authorization server by implementing a custom SMS‑code grant type, covering the necessary configuration classes, bean definitions, token store setup, and client usage examples.
This guide walks through building a unified microservice authentication and authorization solution using Spring Boot 2.2+, Spring Cloud Hoxton, Nacos, Spring Cloud Gateway, and JWT, detailing the architecture, service division, and step‑by‑step implementation of auth, gateway, and API services with code examples.
This article explains the fundamentals of OAuth2, its four grant types and roles, and provides step‑by‑step Spring Boot and Spring Cloud configurations—including authorization and resource server setup, custom token filters, and Zuul gateway integration—to secure microservice APIs.
This article explains the technical design of a unified multi‑account login system, covering early‑stage username/password and phone‑based authentication, detailed flow steps, database schema, and integration of third‑party OAuth (e.g., QQ) while highlighting practical considerations and limitations.
This guide walks developers through the OAuth2 workflow, illustrating how users, client applications, resource servers, and authorization servers interact via access tokens to securely protect and grant access to user data, and highlights the critical steps of token issuance and validation.
This article walks through the OAuth2 workflow, explaining why access tokens are needed, the roles of the resource server, client application, and authorization server, and how tokens are requested, issued, validated, and used to protect user data.
Learn how to retrieve OAuth 2.0 tokens using the password grant, customize the default token endpoint with Spring Security OAuth2, and understand the underlying source code that maps the new endpoint, complete with practical curl commands and Java configuration examples.
This article explains how to modify Spring Security OAuth2's token service to enforce a single-device login by customizing token creation and key generation logic, removing existing tokens for the same user and ignoring client identifiers, with code examples and deployment steps.
Spring has announced a community‑driven Spring Authorization Server project to fill the gap left by the outdated Spring Security OAuth, aiming to provide modern OAuth support within the Spring ecosystem and inviting contributors to help it succeed.
This article explains how to extend the default OAuth2 token response by embedding business-related fields such as tenant_id, user_id, and username, and walks through the underlying Spring Security code—including the password grant flow, token creation, and enhancement process—illustrated with code snippets and diagrams.
This guide explains how to use Laravel Passport to implement OAuth2 authentication for API endpoints, covering installation, database migrations, token generation, client management, scope definition, route protection, JavaScript integration, event handling, and testing with detailed code examples.
The article examines why the demo environment of pig4cloud returns an OAuth2 access token without the expires_in field, contrasts it with a local deployment, analyzes the Spring Security OAuth2 token generation code, and explains that according to the OAuth2 specification the expires_in parameter should be returned even for permanently valid tokens.
This article walks through the complete SSO login flow—from the browser request to the SSO server, code exchange, token generation, and front‑end redirection—while detailing front‑end and back‑end code modifications needed for password‑less authentication.
This article explains the complete OAuth2 token lifecycle—including how resource servers validate incoming tokens, how the authorization server creates and reuses access tokens, and the mechanisms for passive and active token refresh—complete with Java code examples and practical client‑side strategies.
This article examines the evolution from monolithic to microservice architectures and presents various authentication and authorization solutions—including SSO, distributed sessions, client tokens, JWT, and OAuth 2.0—highlighting their principles, advantages, and practical considerations for securing inter‑service and external access.
This article explains the OAuth 2.0 authorization framework, describes its four core roles and various grant types, and demonstrates how to configure a Spring Security OAuth2 client for GitHub login, including endpoint details, request parameters, and code examples.
An overview of three RESTful web service security approaches—Basic authentication, OAuth 2.0, and OAuth 2.0 combined with JWT—examining their mechanisms, scalability drawbacks, and why JWT‑based solutions offer superior extensibility for micro‑service architectures, illustrated with Amazon’s token‑signing method.
This article introduces Spring Cloud Security and demonstrates how to integrate OAuth2 for single sign‑on, token relay, and token exchange in a Spring Boot application, covering OAuth2 concepts, authorization flows, module setup, configuration, and practical usage of authorization‑code and password grant types with code examples.
This article explains why private Docker image pulls often fail due to credential handling, walks through the OAuth 2.0 protocol, details Docker login and manifest retrieval steps, and shows how Kubernetes automates secure image pulling using secrets, admission controllers, and the Acr credential helper.
This article explains how to achieve consistent OAuth2 token handling across multiple clients and tenants by customizing the token key generation, overriding DefaultTokenServices logic, and configuring a RedisTokenStore with a custom AuthenticationKeyGenerator in a Spring Boot application.
This tutorial walks you through building a lightweight OAuth2 authentication server using Spring Cloud Hoxton, covering required dependencies, web security configuration, client details, grant types, testing with the password flow, and key insights on Spring Security password handling.
Learn how to quickly set up an OAuth2 authentication server using Spring Cloud Hoxton, including Maven dependencies, web security configuration, client details, and password‑grant testing, while also covering Spring Security’s {noop} password handling and providing useful code snippets for developers.
This article explains the technical solutions, workflow diagrams, and database schema for building a multi‑account login system that supports username/password, phone‑number, and third‑party (e.g., QQ, WeChat) authentication, while outlining security measures such as password hashing, login throttling, and token management.
This article walks through Spring Security OAuth's core classes, explaining how the TokenEndpoint processes /oauth/token requests, validates client details, builds TokenRequests, delegates to TokenGranters, and ultimately generates and returns an OAuth2 access token.
This article explains how to extend the default OAuth2 token response by adding business-related fields such as tenant, user, and department IDs, and walks through the relevant Spring Cloud source code that generates and enhances tokens for improved performance and security.
This article explains how to customize the default OAuth2 check‑token flow in Spring Cloud by extending the token converter to assemble complete user information—including IDs, department and tenant data—directly into the security context, eliminating extra database queries and improving performance.
This article explains how the default OAuth2 check‑token flow creates a performance bottleneck, then shows how to extend JWT tokens with user details via a custom TokenEnhancer and replace RemoteTokenServices with a custom ResourceServerTokenServices, including configuration, code examples, and the security trade‑offs of using JWT.
This open‑source project offers a Spring Cloud Finchley‑based RBAC permission system using Spring Security OAuth2, a data‑driven Element‑ui front‑end that works without Vue experience, and full container support (Docker, Kubernetes, Rancher2) plus production‑ready lambda, Stream API and WebFlux examples, with detailed dependency listings and contribution guidelines.
This article explains how to protect Spring Cloud microservices using OAuth2 by configuring an API gateway, an authorization server, and a simple account service, providing a complete token‑based security solution with code examples and testing instructions.
This article explores the evolution of authentication and authorization from monolithic to microservice architectures, comparing traditional session-based methods with modern token solutions like JWT and OAuth2, and provides practical guidance on implementing secure, scalable access control across dozens of services.
This tutorial explains how to build a WeChat QR‑code login system using Spring‑Boot, Thymeleaf, HttpClient and JSON, covering preparation steps, project configuration, OAuth2 flow, code examples for generating QR pages, handling callbacks, and customizing the login experience.
This article explains the OAuth2.0 authorization code grant flow, using a Douban‑QQ login example to illustrate the three-step process from client request to token exchange and user information retrieval, and provides a simple reference implementation on GitHub.
This article explains JWT fundamentals—encoding, signature, and encryption—examines suitable use‑cases such as one‑time verification and stateless API authentication, discusses token leakage, secret design, logout handling, renewal strategies, and compares JWT with traditional session and OAuth2 approaches.
This article examines the challenges of securing microservice architectures and compares various authentication and authorization approaches—including SSO, distributed sessions, client‑token schemes, JWT, and OAuth 2.0—to help developers choose suitable solutions for efficient and fine‑grained access control.
This article breaks down the internal workflow of Spring Security’s @EnableResourceServer, explaining how OAuth2 tokens are extracted, validated, and turned into authentication objects through ResourceServerSecurityConfigurer, OAuth2AuthenticationProcessingFilter, OAuth2AuthenticationManager, and related components.
This article walks through building a Spring Boot application that protects HTTP endpoints using OAuth2, covering password and client‑credentials flows, Maven setup, resource and authorization server configuration, in‑memory users, token retrieval, and accessing secured resources with detailed code examples.
This article explains how JD’s 京麦 open platform evolved from a simple Nginx‑Tomcat deployment to a decentralized, high‑performance API gateway and robust TCP‑based messaging system, detailing architectural choices such as OAuth2, ZooKeeper‑driven metadata, multi‑level rate limiting, Protobuf, and Netty‑powered push services.
This article examines the evolution from traditional monolithic access security to modern microservice architectures, outlines key design principles, compares four common authentication schemes, and demonstrates a Spring Cloud Security implementation using OAuth2 and UAA for fine‑grained, token‑based protection.
This article examines common security pitfalls when integrating Sina Weibo OAuth for user login and account binding, illustrating CSRF vulnerabilities and code‑theft attacks through real‑world examples on Bilibili, NetEase Cloud Music, and Zhihu, and offers mitigation recommendations.
OAuth2 provides a secure, open standard that lets third‑party applications obtain limited user access without exposing passwords, using a token‑based flow involving resource owners, clients, resource servers, and authorization servers, illustrated through a step‑by‑step authorization process.
