Tag
Application and identity security — JWT validation, token revocation, XML signature, encryption, threat models, and OWASP guidance.
76 posts · page 3 of 4
Learn how to build dynamic authorization logic with ABAC, Spring Security, OPA, and Rego policies for fine-grained access control in Java applications.
Explore real-world insights on designing a centralized identity platform, including IAM evaluation techniques and strategic architecture decisions.
Learn how Pushed Authorization Requests (PAR) defined in RFC 9126 improve OAuth 2.0 security and mitigate the risk of authorization code interception.
Part 3 · OAuth 2.0 SecurityExplore how RFC 8693 standardizes token exchange for delegation and impersonation scenarios in Keycloak environments.
Compare Role-Based Access Control and Attribute-Based Access Control models to determine the best authorization strategy for your infrastructure using OPA and XACML.
Explore essential gRPC security strategies covering TLS configuration, mTLS implementation, token propagation techniques, and effective interceptor patterns.
Learn essential patterns for securing GraphQL APIs, covering authentication flows, authorization strategies, and managing query complexity to prevent abuse.
This guide covers implementing a custom UserDetailsService in Spring Security, focusing on user loading mechanisms and caching strategies for enhanced security.
Part 1 · Machine Identity & DevSecOps SeriesLearn to implement distributed tracing and capture security metrics in Spring applications using OpenTelemetry for enhanced observability.
Part 14 · Spring Security SeriesA walkthrough of testing strategies for Spring Security, covering MockMvc assertions, user mocking with @WithMockUser, and OAuth2 integration testing patterns.
Part 10 · Spring Security Deep Dive SeriesLearn how to implement envelope encryption and manage key policies in AWS KMS to secure your data infrastructure effectively.
Discover how passkeys and AI are reshaping authentication trends in 2025, paving the way for a secure passwordless future.
Part 1 · AWS IAM & Cloud Security SeriesLearn how certificate-based authentication leverages X.509 standards to establish device trust and verify posture for secure access in modern networks.
Part 10 · Passwordless & Next-Gen Authentication SeriesExplore how to implement magic link authentication securely. We cover the mechanics of passwordless login, security best practices, and user experience benefits.
Part 6 · Passwordless & Next-Gen Authentication SeriesExplore the technical implementation of passkeys within major tech ecosystems. This guide covers WebAuthn standards, cross-device sync strategies, and integration with Google, Apple, and Windows Hello.
Part 4 · Passwordless & Next-Gen Authentication SeriesExplore how FIDO2 and WebAuthn enable phishing-resistant authentication, replacing vulnerable passwords with secure passkeys and authenticators.
Part 3 · Passwordless & Next-Gen Authentication SeriesLearn how to secure your Keycloak deployment with production-grade hardening techniques, including brute force protection and CSP configuration.
Part 1 · Zero Trust & Modern Security Architecture SeriesLearn how to programmatically manage Keycloak realms and users using the Keycloak REST API for efficient automation.
Part 12 · Keycloak Masterclass SeriesExplore essential lessons learned when migrating from ForgeRock to Keycloak. This walkthrough covers identity migration strategies and platform adoption tips.
Part 11 · Keycloak Masterclass SeriesLearn to build tailored login experiences using Keycloak custom authentication flows, SPIs, and forms for specific security requirements.
Part 3 · Keycloak Advanced Series
