This article explains the fundamental concepts of authentication and authorization, the role of credentials, how cookies and sessions manage state, the differences between tokens and JWTs, common security mechanisms, and practical considerations for implementing them in web applications.
This article explains the concept of API idempotency, presents common solutions such as unique indexes, token mechanisms, and distributed locks, and provides a complete Spring Boot implementation using Redis to generate, store, and validate tokens via custom annotations, interceptors, and service classes, including testing and performance verification.
This article traces the evolution from early stateless web browsing to modern token‑based authentication, explaining how session management challenges led to centralized stores, their drawbacks, and how signed tokens using HMAC‑SHA256 provide a scalable, secure, and truly stateless alternative.
This article explains the concept of API idempotency, reviews common solutions, and provides a complete Spring Boot implementation using a Redis‑based token mechanism, custom @ApiIdempotent annotation, interceptor, and supporting services, along with testing and important concurrency considerations.
This article explains three practical methods for achieving Single Sign‑On in web systems—using a parent‑domain cookie, deploying a dedicated authentication center, and leveraging front‑end LocalStorage with iframe postMessage—to share session or token information across multiple domains.
This article explains why session management is needed, compares cookies, sessions and JWT, describes JWT's structure and workflow, and provides a complete Node.js/Koa implementation with code examples and a discussion of its advantages and drawbacks.
This article explains the concept of API idempotency, outlines common solutions, and provides a complete Spring Boot implementation using Redis and a token mechanism, including custom annotation, interceptor, utility classes, and testing procedures to ensure safe, single‑execution requests.
This article details Red Pulse's journey of integrating the NEO blockchain, the security vulnerabilities it faced—from token theft and credential‑stuffing attacks to sophisticated social‑engineering exploits—and the comprehensive technical measures, monitoring tools, and mitigation strategies it implemented to protect its platform and users.
This article compares traditional cookie‑session authentication with JWT, explains JWT’s three‑part structure, shows how to generate and verify tokens in Java, and discusses security benefits, pitfalls, and practical considerations for modern web and mobile applications.
This article explains how to achieve API idempotency in a Spring Boot application by generating unique tokens, storing them in Redis, and using a custom @ApiIdempotent annotation with an interceptor to prevent duplicate requests, including code examples, configuration, and testing procedures.
This article explains the stateless nature of HTTP, session and cookie mechanisms, the challenges of multi‑system authentication, and then details the concept, workflow, token handling, and step‑by‑step Java code for building a basic Single Sign‑On solution with login and logout support.
This article walks through practical methods for securing internal API calls—starting with simple token checks, then enhancing security with IP whitelisting, salted signatures, and timestamped requests—while weighing trade‑offs like HTTPS overhead and time synchronization.
This guide shows how to wrap a service‑account token into a kubeconfig file, configure a cluster entry, credentials, and context on the master node, then use the generated kubeconfig to log into the Kubernetes dashboard, with an optional full‑access version.
This article explains practical methods for protecting API data exchange—including token usage, timestamp validation, signature generation, duplicate‑submission prevention, and ThreadLocal context—provides implementation details with Spring Boot, Redis, and Java code examples, and discusses related security considerations such as DoS attacks.
The article traces the history of web session handling, explains the scalability and security challenges of server‑side sessions, and introduces stateless token‑based authentication using signed HMAC‑SHA256 tokens as a modern solution for scalable, secure web applications.
This article explains practical API security techniques for protecting data exchange with third‑party systems, covering token generation and storage, timestamp validation to mitigate DoS attacks, MD5‑based request signing with nonce, preventing duplicate submissions using Redis, and illustrates the concepts with comprehensive Java code examples.
This article explains common API security mechanisms such as token, timestamp, signature, and anti‑replay techniques, demonstrates how to prevent duplicate submissions, and provides complete Java Spring Boot code examples including interceptors, Redis configuration, and utility classes for secure API design.
This article explains the end‑to‑end implementation of QR‑code login, covering how a web page requests a QR image, how the server stores a UUID in Redis, how a mobile app scans the code and validates the user, and how the browser finally receives a token to complete authentication.
This article explains the QR code login process, detailing how a web page requests a QR code, how the mobile app scans it, exchanges tokens via Redis, and ultimately authenticates the user across web and mobile platforms.
The article traces the history of web session handling from simple document browsing to the challenges of storing session IDs in clustered servers, and explains how token‑based authentication using signed tokens like HMAC‑SHA256 provides a stateless, scalable, and more secure alternative for modern web and mobile applications.
This guide explains how to use Laravel Passport to implement OAuth2 authentication for API endpoints, covering installation, database migrations, token generation, client management, scope definition, route protection, JavaScript integration, event handling, and testing with detailed code examples.
This article walks through the complete SSO login flow—from the browser request to the SSO server, code exchange, token generation, and front‑end redirection—while detailing front‑end and back‑end code modifications needed for password‑less authentication.
This article explains the complete OAuth2 token lifecycle—including how resource servers validate incoming tokens, how the authorization server creates and reuses access tokens, and the mechanisms for passive and active token refresh—complete with Java code examples and practical client‑side strategies.
Idempotency ensures that repeated execution of an operation yields the same result as a single execution, and this article explains its importance in backend systems, outlines concepts, and presents practical techniques such as unique indexes, token mechanisms, pessimistic and optimistic locks, distributed locks, and API design for reliable, duplicate‑free processing.
This article analyses various client scenarios in multi‑client systems, classifies authentication tokens into password, session, API, and other categories, compares them across usage cost, change cost, and security risks, and presents a hierarchical token model with detailed usage steps and practical considerations.
This article explains the differences between authentication and authorization, compares session‑based and token‑based (JWT) authentication flows, details JWT structure and signing, and outlines the advantages, disadvantages, and suitable scenarios for each method.
This article explains how to achieve interface idempotency in a Spring Boot application by generating a unique token for each request, storing it in Redis, validating the token via a custom annotation and interceptor, and provides complete code examples and testing guidance.
This article explains the importance of idempotent operations in backend systems, defines the concept, and presents practical techniques such as unique indexes, token mechanisms, pessimistic and optimistic locking, distributed locks, state‑machine design, and API patterns, complete with code snippets and diagrams.
This article explains the fundamental differences between cookies, sessions, and tokens, outlines how each works in web authentication, compares their security and performance trade‑offs, and offers practical guidance on storage, encryption, and best practices for implementing token‑based authentication.
This article explains the stateless nature of HTTP and how cookies, server‑side sessions, and token‑based authentication work together to maintain user state across requests, including their storage limits, lifecycle, and practical implementation steps.
JWT (JSON Web Token) is a compact, URL‑safe means of representing claims between parties, widely adopted for stateless authentication, but it has limitations; this article explains JWT fundamentals, creation and verification in Java, compares its advantages over sessions, and outlines security risks and mitigation strategies.
This article explains the concept of idempotency, lists common solutions, and demonstrates a practical implementation using Spring Boot, Redis, and a token‑based mechanism with custom annotations and interceptors, including full code examples, testing steps, and important pitfalls to avoid.
This article explains how traditional session‑cookie authentication creates scalability, security, and deployment challenges in front‑end/back‑end separated web applications, and how JSON Web Tokens (JWT) provide a compact, self‑contained, stateless solution while also outlining their advantages and limitations.
This article explains what JWT (JSON Web Token) is, its compact self‑contained structure, how it replaces traditional session‑cookie authentication, and discusses its benefits, limitations, and practical usage in stateless web security.
This article explains the QR‑code login process, detailing how the web front‑end, server, Redis store, and mobile application cooperate to generate a QR code, verify the scan, and complete user authentication using tokens and UUIDs.
This article analyses various client‑side authentication scenarios, classifies tokens into password, session, and API categories, compares their natural and controllable attributes, and proposes a four‑layer hierarchical token architecture to improve security, usability, and decoupling across multiple platforms.
The article surveys authentication from ancient token methods to modern password and session techniques, explains OAuth 2.0 flows and their adaptation for WeChat Mini‑Programs—including access‑token retrieval, simplified client‑credentials grants, and cloud‑call automation—while also previewing future trends such as biometrics, blockchain‑based decentralization, and AI‑driven trust models.
This article explains how to extend the default OAuth2 token response by adding business-related fields such as tenant, user, and department IDs, and walks through the relevant Spring Cloud source code that generates and enhances tokens for improved performance and security.
This article explains how to customize the default OAuth2 check‑token flow in Spring Cloud by extending the token converter to assemble complete user information—including IDs, department and tenant data—directly into the security context, eliminating extra database queries and improving performance.
To protect mobile web activity pages such as coupons and lotteries, the article proposes a layered security approach that combines professional risk‑control services, custom human‑verification logs, token‑based HTTPS signing, data encryption, and aggressive front‑end JavaScript obfuscation to block automated abuse while preserving user experience.
This article explains the concept of idempotence, provides real‑world examples such as duplicate form submissions and payment requests, and details practical backend techniques—including query handling, unique indexes, token mechanisms, pessimistic and optimistic locks, distributed locks, and API design—to guarantee that repeated operations produce consistent results without side effects.
CSRF attacks trick a logged‑in user’s browser into sending authenticated requests to a target site, enabling unauthorized actions, so front‑end developers must mitigate them by enforcing same‑origin checks, using anti‑CSRF tokens or double‑cookie verification, and configuring SameSite cookie attributes to block cross‑site requests.
This article explains the architecture and step‑by‑step workflow of QR code login, covering how the web front‑end, mobile client, and server (including Redis storage and token verification) cooperate to generate a QR code, poll for authentication, and complete a secure user login.
The article explains the mathematical definition of idempotency, its importance in preventing duplicate operations such as repeated payments or order creation, and presents practical strategies—including unique business IDs, optimistic locking, deduplication tables, distributed locks, token mechanisms, and payment buffering—to achieve reliable idempotent behavior in backend services.
This article explains OpenStack's Keystone service, describing how token‑based authentication enables unified identity, authorization, and accounting across Nova, Glance, and Neutron components, and compares the approach with public‑cloud AK/SK mechanisms.
This article explains JWT fundamentals—encoding, signature, and encryption—examines suitable use‑cases such as one‑time verification and stateless API authentication, discusses token leakage, secret design, logout handling, renewal strategies, and compares JWT with traditional session and OAuth2 approaches.
This article explains the JSON Web Token (JWT) format, its three-part structure, how to encode a payload and header with Base64, sign the token using HS256, and apply the resulting JWT to a friend‑request scenario that works without requiring the recipient to log in.
The article surveys practical blockchain use cases—from real‑time trusted information sharing and copyright protection to supply‑chain traceability, financing, cross‑border payments, asset tokenisation and decentralized currencies—highlighting their cost, speed and transparency benefits while noting that technical, regulatory and ecosystem challenges still limit widespread adoption.
The article explains that blockchain can serve as an anti‑counterfeiting technology, describes how ICOs issue tokens that grant voting and dividend rights, illustrates token‑driven projects like IPFS, and clarifies that digital currencies such as Bitcoin are not fully anonymous and still require KYC for fiat exchanges.
This article breaks down the internal workflow of Spring Security’s @EnableResourceServer, explaining how OAuth2 tokens are extracted, validated, and turned into authentication objects through ResourceServerSecurityConfigurer, OAuth2AuthenticationProcessingFilter, OAuth2AuthenticationManager, and related components.
This article explains the fundamentals of JSON Web Tokens, detailing their three-part structure, standard header and payload fields, signature creation, typical authentication workflow, and practical Node.js code examples for generating and validating JWTs securely.
