token rotation — 2 Technical Articles

Nov 11, 2026 · Backend Development

Spring Boot Trusted Device Login: Why Device ID Isn't Enough for 30-Day Remember Me

This article details a secure implementation of 'remember this device for 30 days' in Spring Boot, explaining why device IDs and fingerprints are insufficient, and demonstrating server-signed trusted device tokens with hashed storage, rotation, absolute expiration, MFA versioning, and revocation mechanisms to properly bypass 2FA without compromising security.

2FAJavaMFA

0 likes · 22 min read

Spring Boot Trusted Device Login: Why Device ID Isn't Enough for 30-Day Remember Me

LuTiao Programming

Nov 3, 2026 · Information Security

Java Trusted Device Login: Secure 30-Day 2FA Skip via Rotating Tokens

This article details a complete Java implementation for trusted device login, covering secure token generation, server-side validation, hash storage, token rotation, revocation via MFA versioning, risk-based signals, and user-facing device management, ensuring 30-day 2FA bypass without compromising security.

2FAJavaRevocation

0 likes · 21 min read

Java Trusted Device Login: Secure 30-Day 2FA Skip via Rotating Tokens