Auth, Identity & Sessions

1+ hour, 43+ min ago   (1057+ words) Remote inference is a spillway, not a default pipe. The local disk already holds the working loop. You open the wire after three gates pass. Latency looks like the loudest cost on paper. Secrets and offline gaps still cost far…...

3+ hour, 12+ min ago   (543+ words) Spring WebFlux is Spring's reactive alternative to Spring MVC: it uses non-blocking I/O and Reactor's Mono and Flux to handle concurrent requests with a small pool of threads. Both frameworks share the same controller annotations. For authentication, spring-webflux-pac4j runs pac4j's…...

3+ hour, 12+ min ago   (686+ words) Since the shiro-cas module was retired, Shiro no longer provides its own CAS client. So we can use pac4j for the authentication and pass the result to Shiro. This is the role of buji-pac4j. But there is a distinction to make:…...

3+ hour, 46+ min ago   (216+ words) First of all, I’d like to come back to definitions just to be sure UI and web services authentications mean the same to everybody: These are core concepts in pac4j as web authentication methods (called clients) are indirect (UI authentications) or…...

3+ hour, 46+ min ago   (676+ words) If you already have Spring Security in your application, with hasRole rules, @PreAuthorize on services and code reading SecurityContextHolder and you want to add an OpenID Connect login, while keeping that authorization code, you can use pac4j for that. Whatever the…...

5+ hour, 8+ min ago   (205+ words) localStorage is accessible via any JavaScript running on the page. If an application suffers from a single XSS vulnerability (e.g., via a compromised npm dependency or unsanitized user input), an attacker can execute a script to read the JWT and exfiltrate…...

6+ hour, 38+ min ago   (402+ words) You have an API that works. Then the asks start: a customer wants an API key, someone wants to use it from Claude or Cursor, users should only change their own records, and you need rate limits and quotas. Each…...

7+ hour, 56+ min ago   (397+ words) If your team already runs an identity provider, the last thing you want is a second login system. You want your apps to trust the identity system you already have — whether that's Keycloak, Auth0, Okta, or Azure AD. OpenID Connect (OIDC)…...

7+ hour, 56+ min ago   (290+ words) Credential stuffing is one of the most common — and most quietly damaging — attacks against web apps. It's not a clever exploit of a zero-day; it's brute force at scale, using passwords stolen from other breaches to log into accounts elsewhere....

7+ hour, 56+ min ago   (369+ words) If your users already live in an enterprise directory — Active Directory, OpenLDAP, Apache Directory, or FreeIPA — then the cleanest login for a self-hosted app is the account they already have. Nobody wants to remember a second password for an internal…...