9 min readBackendFeatured
JWT Expiration, Rotation, and Revocation: A Lifecycle Guide
Learn how to manage JWT expiration, rotation, and revocation effectively to secure your application's token lifecycle.
All tags
Tag
Web Security
Read 15 articles on Web Security by Ashish Srivastava — practical guides covering implementation patterns, security, and production lessons.
15 posts
9 min readBackendFeatured
Understanding HTTP Strict Transport Security (HSTS) for Identity Applications
Learn how to secure identity applications with HTTP Strict Transport Security (HSTS) and Spring Boot configurations to enforce HTTPS.
8 min readtechnicalFeatured
Security Considerations for Identity Tokens in URL Parameters
Placing identity tokens in URL parameters creates significant security vulnerabilities. This guide examines token leakage risks via referrer headers and outlines necessary remediation strategies.
10 min readTechnicalFeatured
OpenID Connect Frontend and Backend Integration Guide
Learn how to implement OpenID Connect across full-stack applications using Angular for the frontend and Spring Boot for the backend.
8 min readBackendFeatured
Understanding and Implementing CWE-306: Missing Authentication
Learn how to identify and remediate missing authentication flaws in web applications using security scanners and proper Spring Security configurations.
9 min readtechnicalFeatured
Understanding and Implementing CWE-287: Improper Authentication
Learn how to identify and fix CWE-287 improper authentication flaws using OWASP standards and practical security implementation strategies.
10 min readTechnicalFeatured
How Browser Cookies Work in SSO: A Technical Deep Dive
Explore the mechanics of browser cookies in SSO environments, including SameSite policies, third-party restrictions, and security implications for cross-domain authentication.
Part 3 · Web Security & Authentication Architecture
8 min readBackendFeatured
Building Secure Micro-Frontends with OIDC and Token Mediation
Explore how to implement effective security in micro-frontend architectures using OIDC and token isolation mechanisms.
Part 3 · Frontend Security Architecture
10 min readBackendFeatured
Content Security Policy for Identity Applications
Learn how to secure identity applications using CSP headers to mitigate XSS vulnerabilities and enhance web security posture.
8 min readBackendFeatured
Cross-Origin Resource Sharing (CORS) Security: Configuration Guide
Learn how to secure your web applications with proper CORS configuration, handle preflight requests effectively, and resolve common cross-origin errors in Spring.
10 min readtechnicalFeatured
Session Management Security: Cookies, Tokens, and Best Practices
Explore essential web session security strategies, including the implementation of HttpOnly, SameSite, and JWT tokens to prevent session fixation and unauthorized access.
9 min readDevelopmentFeatured
Spring Security 6 and Spring Boot 3: Migration Guide
Learn how to migrate your application to Spring Security 6 and Spring Boot 3 with a focus on Jakarta EE compatibility and essential security changes.
Part 11 · Spring Security Deep Dive Series
7 min readtechnicalFeatured
Spring Security CORS and CSRF: Proper Configuration for SPAs
Learn how to properly configure Spring Security CORS and CSRF for SPAs, ensuring secure communication between frontend frameworks like Angular and backend services.
Part 9 · Spring Security Deep Dive Series
9 min readSecurityFeatured
Biometric Auth in Web Apps: WebAuthn & Beyond
Explore how WebAuthn enables browser biometrics like Face ID and Touch ID to secure web applications beyond traditional passwords.
Part 5 · Passwordless & Next-Gen Authentication Series
8 min readSecurityFeatured
FIDO2 and WebAuthn: Building Phishing-Resistant Authentication
Explore how FIDO2 and WebAuthn enable phishing-resistant authentication, replacing vulnerable passwords with secure passkeys and authenticators.
Part 3 · Passwordless & Next-Gen Authentication Series