8 min readBackendFeatured
Building a Self-Service Password Reset with Spring Boot and Keycloak
Learn how to build a secure self-service password reset mechanism with Spring Boot and Keycloak, covering required actions and identity management.
All tags
Tag
Security
Application and identity security — JWT validation, token revocation, XML signature, encryption, threat models, and OWASP guidance.
133 posts · page 5 of 7
6 min readtechnicalFeatured
Building Multi-Factor Authentication with TOTP in Spring Boot
Learn how to secure your Spring Boot applications by integrating TOTP-based Multi-Factor Authentication with Google Authenticator for enhanced security.
6 min readBackendFeatured
Building a Custom Authentication Provider in Spring Security
Learn how to construct a custom authentication provider in Spring Security to handle specific user validation logic and security requirements.
Part 5 · Spring Security Filter Chain Mastery
7 min readTechnicalFeatured
OAuth2 Security Best Practices Checklist: 2025 Edition
Review essential OAuth2 security best practices, audit criteria, and security review steps for 2025 to ensure strong authentication integrity.
Part 10 · OAuth 2.0 Security
6 min readtechnicalFeatured
Implementing Mutual TLS in Spring Boot Applications
Learn how to secure Spring Boot services using mutual TLS (mTLS) and X.509 certificate authentication without complex infrastructure overhead.
Part 4 · mTLS With Spring Boot
6 min readtechnicalFeatured
Understanding X.509 Certificates: From Basics to mTLS Implementation
Learn how X.509 certificates function from the ground up, explore certificate management strategies, and implement secure mutual TLS authentication in your systems.
Part 2 · mTLS With Spring Boot
6 min readBackendFeatured
Building an Identity Gateway with Spring Cloud Gateway
Learn how to secure microservices by building a secure identity gateway using Spring Cloud Gateway, JWT filters, and OAuth2 protocols.
Part 3 · Identity Gateways & Legacy Integration
6 min readDevelopmentFeatured
Understanding OAuth2 Authorization Server Metadata (RFC 8414)
Learn how RFC 8414 standardizes the discovery of OAuth2 authorization server metadata, enabling secure and efficient client configuration through standardized endpoints.
Part 5 · Authorization Server Metadata (RFC 8414)
6 min readSecurityFeatured
Implementing Account Lockout and Brute Force Protection in Spring Security
Learn how to secure your Spring applications against brute force attacks by implementing account lockout strategies, rate limiting, and CAPTCHA integration.
6 min readtechnicalFeatured
Implementing Delegated Administration in IAM Systems
Learn how to implement delegated administration in IAM systems to manage scoped admin roles and secure organizational access effectively.
6 min readtechnicalFeatured
Implementing Risk-Based Authentication with Keycloak and Spring Boot
Learn how to build adaptive authentication flows with Keycloak and Spring Boot. This guide covers risk scoring, step-up auth, and custom authentication implementation.
6 min readtechnicalFeatured
Understanding DPoP for OAuth2: Securing Token Binding with RFC 9449
Learn how DPoP enhances OAuth2 security by binding access tokens to specific clients, preventing token theft and replay attacks.
Part 3 · OAuth 2.0 Security
6 min readBackendFeatured
OAuth2 Client Authentication Methods: client_secret_basic, private_key_jwt, and More
Explore essential OAuth2 client authentication strategies like client_secret_basic and private_key_jwt for securing API access.
Part 1 · OAuth 2.0 Security
6 min readDevelopmentFeatured
The Complete Guide to JSON Web Token (JWT) Claims
Explore registered and custom JWT claims, learn token validation techniques, and apply best practices for secure authentication.
Part 9 · OAuth 2.0 RFCs Every Engineer Should Read
6 min readBackendFeatured
Understanding OAuth 2.0 Rich Authorization Requests (RAR)
Explore how OAuth 2.0 Rich Authorization Requests (RAR) enable fine-grained authorization through RFC 9396.
Part 4 · OAuth 2.0 & OIDC Mastery
6 min readtechnicalFeatured
Workforce vs Customer Identity (CIAM): Implementation Guide
Explore the critical differences between workforce identity and customer identity management, focusing on implementation strategies for B2B and B2C scenarios.
Part 6 · Identity Platform Architecture
8 min readBackendFeatured
Identity Architecture Patterns for Micro-Frontends and Multi-Platform
Explore essential identity architecture patterns for micro-frontends and multi-platform setups, including BFF, cross-platform SSO, and unified identity solutions.
Part 4 · Frontend Identity Integration
8 min readBackendFeatured
Automating Access Reviews with Keycloak and Spring Boot
Learn how to automate access certification processes with Keycloak and Spring Boot for better compliance and identity governance.
6 min readtechnicalFeatured
Implementing Attribute-Based Access Control (ABAC) with Spring Security
Learn how to build dynamic authorization logic with ABAC, Spring Security, OPA, and Rego policies for fine-grained access control in Java applications.
6 min readtechnicalFeatured
Understanding OAuth 2.0 Pushed Authorization Requests (PAR)
Learn how Pushed Authorization Requests (PAR) defined in RFC 9126 improve OAuth 2.0 security and mitigate the risk of authorization code interception.
Part 2 · OAuth 2.0 Security