Blog

Writing on Identity & Security

Practical guides on OAuth 2.0, OpenID Connect, SAML, Keycloak, and the platform engineering behind identity systems.

595 posts · page 26 of 30

Feb 9, 20266 min readBackendFeatured

Spring Session: Distributed Session Management

Learn how to implement distributed session management with Spring Session and Redis for high-performance applications.

Part 11 · Spring Security Deep Dive Series

Feb 8, 20266 min readDevelopmentFeatured

Spring Security 6 and Spring Boot 3: Migration Guide

Learn how to migrate your application to Spring Security 6 and Spring Boot 3 with a focus on Jakarta EE compatibility and essential security changes.

Part 10 · Spring Security Deep Dive Series

Feb 7, 20268 min readBackendFeatured

Spring Security Testing: Unit & Integration Tests

A walkthrough of testing strategies for Spring Security, covering MockMvc assertions, user mocking with @WithMockUser, and OAuth2 integration testing patterns.

Part 9 · Spring Security Deep Dive Series

Feb 6, 20266 min readtechnicalFeatured

Spring Security CORS and CSRF: Proper Configuration for SPAs

Learn how to properly configure Spring Security CORS and CSRF for SPAs, ensuring secure communication between frontend frameworks like Angular and backend services.

Part 8 · Spring Security Deep Dive Series

Feb 5, 20266 min readBackendFeatured

Spring Security with Reactive WebFlux: Security for Reactive Applications

Learn how to implement security patterns in reactive Spring applications using WebFlux, including reactive JWT and authentication flows.

Part 7 · Spring Security Deep Dive Series

Feb 4, 20266 min readBackendFeatured

Custom Spring Security Filters: Advanced Authentication Patterns

Explore advanced Spring Security extension techniques by building custom filters for API key authentication and complex security chains.

Part 6 · Spring Security Deep Dive Series

Feb 3, 20268 min readDevelopmentFeatured

Spring Security with JWT: Complete Authentication Implementation

Learn how to build an authentication system using Spring Security and JWT, including filter chains, refresh token handling, and blacklisting mechanisms for advanced applications.

Part 2 · Spring Security Deep Dive Series

Feb 2, 20266 min readBackendFeatured

Spring Security: Filters, Chains & Auth

Explore the internals of Spring Security, focusing on how filters compose the SecurityFilterChain and drive the authentication process.

Part 1 · Spring Security Deep Dive Series

Feb 1, 20266 min readtechnicalFeatured

AWS Compliance Automation: Config, Audit Manager, and Security Hub

Learn how to automate AWS compliance workflows with Config, Audit Manager, and Security Hub to meet SOC2 and CIS standards.

Part 15 · AWS IAM & Cloud Security Series

Jan 31, 20268 min readBackendFeatured

SSH Key Management: Moving Beyond Password Authentication

This guide covers SSH key management, certificates, and CA strategies to replace password authentication with effective security practices.

Part 7 · Machine Identity & DevSecOps Series

Jan 30, 20266 min readtechnicalFeatured

API Key Management Best Practices: Design, Distribution, and Rotation

Learn essential strategies for managing API keys, including secure design principles, distribution workflows, and automated rotation techniques.

Part 6 · Machine Identity & DevSecOps Series

Jan 29, 20266 min readDevelopmentFeatured

Certificate Lifecycle Automation with cert-manager and Vault PKI

A technical walkthrough of automating certificate lifecycles with cert-manager and Vault PKI, covering TLS management, rotation strategies, and Let's Encrypt integration.

Part 5 · Machine Identity & DevSecOps Series

Jan 28, 20266 min readDevelopmentFeatured

Zero Trust for CI/CD: Securing the Software Delivery Pipeline

Implement zero trust strategies in your CI/CD pipeline to enhance supply chain security using ephemeral credentials and SLSA frameworks.

Part 4 · Machine Identity & DevSecOps Series

Jan 27, 20266 min readDevelopmentFeatured

SPIFFE and SPIRE: Universal Identity for Services

Learn how SPIFFE and SPIRE provide universal identity for services, enhancing security across Kubernetes and multi-cluster deployments.

Part 3 · Machine Identity & DevSecOps Series

Jan 26, 20266 min readBackendFeatured

GitOps Security: Protecting Kubernetes Secrets and Configuration

Learn how to secure your GitOps pipelines and protect sensitive Kubernetes configuration data with tools like Sealed Secrets, SOPS, ArgoCD, and Flux.

Part 2 · Machine Identity & DevSecOps Series

Jan 25, 20266 min readBackendFeatured

Spring Security and GraphQL: Securing GraphQL APIs

Explore essential strategies for securing GraphQL endpoints with Spring Security, including effective authorization patterns and rate limiting techniques.

Part 17 · Spring Security Deep Dive Series

Jan 24, 20266 min readDevelopmentFeatured

Building a Custom UserDetailsService with Spring Security

This guide covers implementing a custom UserDetailsService in Spring Security, focusing on user loading mechanisms and caching strategies for enhanced security.

Part 16 · Spring Security Deep Dive Series

Jan 23, 20266 min readDevelopmentFeatured

AWS WAF and Shield: Protecting Applications from Layer 7 Attacks

A technical look at leveraging AWS WAF and Shield to secure web applications from Layer 7 threats and DDoS attacks.

Part 14 · AWS IAM & Cloud Security Series

Jan 22, 20268 min readTechnicalFeatured

Multi-Account AWS Security Strategy with IAM and Organizations

Learn how to implement a secure multi-account AWS environment leveraging IAM policies, AWS Organizations, Control Tower, and Landing Zones for effective enterprise governance.

Part 13 · AWS IAM & Cloud Security Series

Jan 21, 20266 min readBackendFeatured

AWS KMS and Encryption: Data Protection Strategy

Learn how to implement envelope encryption and manage key policies in AWS KMS to secure your data infrastructure effectively.

Part 12 · AWS IAM & Cloud Security Series