Search for a command to run...
Series
Hands-on guide to authentication vulnerabilities in Java and Spring applications. Covers password security, rate limiting, credential transmission, session management, and cryptographic storage with Spring Security 6 and Java 21. Includes a security architect's perspective on threat modeling, compliance, and building authentication security programs.
Authentication is the most critical security boundary within a web application. A user claims to be Alice: the application has to validate that claim before granting access. Despite the long history o
In Part 1, we have already discussed the password policies based on the guidelines provided by the NIST, rate limiting for preventing brute-force attacks, and preventing username enumeration through c
In Part 1, we discussed the requirements of passwords according to NIST recommendations, various methods of rate limiting using sliding window and exponential backoff, and ways to avoid enumeration of
In the previous parts of this series, we discussed the authentication vulnerability from the developer’s point of view. We discussed password requirements based on NIST guidelines, rate limiting using
