Category: Code

For all that is related to development

From stateful to stateless RESTful security using Spring and JWTs – Part 4 (JWT-based authentication)

Previously we have managed to finally get rid of that Session object and transform our RESTful API security to leverage a stateless authentication solution. We replaced our beloved JSESSIONID with a simple string of text, a token, that allowed us to identify a user. But the solution we used is not secure at all. We still need to find a token with the right characteristics to be safe enough in this world of leaks and breaches. Enter JWTs…

From stateful to stateless RESTful security using Spring and JWTs – Part 3 (token-based authentication)

Last time we reviewed how to quickly set up stateful authentication on our Spring-based project. That’s very nice ‘n’ all, and in many cases you won’t need anything more. However shouldn’t we try to get rid of that session-based dependency and attempt to move to a REST-friendly stateless authentication solution? Let’s begin…

From stateful to stateless RESTful security using Spring and JWTs – Part 2 (session-based authentication)

After a quick introduction we are now ready to begin our journey towards stateless authentication for RESTful APIs… by setting up a stateful example. Yes I know, but we have to start somewhere, right? In this part we’ll set up our project and code a couple of simple endpoints. One of those will be secured using Spring Security’s session-based authentication.

From stateful to stateless RESTful security using Spring and JWTs – Part 1 (intro)

By now “stateful” or session-based authentication is pretty much well-accepted. Frameworks such as Spring Security or Apache Shiro make it really easy to implement a decent solution in just a few easy steps. I previously discussed how to secure a Spring-based REST API using Spring Security for authentication, CSRF protection and CORS. But in some cases, session-based security might not be good enough…

Designing software that protects people’s privacy

Software companies used to have one goal: to develop efficient applications that users liked. When people switched from desktop to SaaS / web applications, companies were forced to focus on security to avoid being hacked. Now they will have a new mission: to ensure the privacy of their users. At any costs.

Just say NO!

It’s 8 PM on a Saturday and you get a call from your project manager asking if you could quickly modify a project’s code and deploy it in production. You don’t feel okay about it? You’re absolutely right!