End users often have to prove their identity in your application. We usually create an account for them to link their data. Some of it may have a higher risk level if they were to be exposed and sometimes users also authorize important operations on them. How does authentication works? We have an…

One thing I like about the Spring ecosystem is that you can find a spring boot starter for almost anything you want. Usually you need to add it to your dependencies list and with a minimum configuration you are good to go. In this series we will write a new…

Imagine you create a new mobile application, your users signup for a new account using just their phone PIN or fingerprint. What if your application becomes invulnerable to phishing attacks too in the process? Would you consider a simple alternative to passwords or do you still want to deal with all the passwords related issues? — In this article we are going to write a Flutter mobile application consuming a Spring Boot Rest API. We are going to explore some challenges a developer might encounter when building an end to end solution running on a local machine. Our users have to signup for a new account…

When you search about async methods in Spring you learn about @EnableAsync annotation and you add @Async to your methods. Everything works fine, your methods gets executed on another thread, but what happens when exceptions occur? How do you handle unhappy flows without losing context from the initial request? — We start with a simple example: a service with an async method is returning something that completes after some operation is executed.

Spring cloud supports several registries for Service Discovery (Apache Zookeeper, Netflix’s Eureka, Hashicorp Consul ) and we are going to see how it works with a custom implementation. Usually we don’t call the same (hardcoded) instance to get a response, unless it’s hidden with a Load Balancer. If another API is hosted on multiple machines, how can we spread the load across all of them? — Lets enhance WebClient with client side load balancing from Spring Cloud. If you are just starting to use WebClient you can check out my previous article on how to connect to a RestAPI.

In a Zero trust network nothing is trusted by default. When something calls our API, how can we be sure the caller is the right one? With mutual TLS or simply mTLS, we validate parties on the other end of the connection are who they claim to be. — To understand what mTLS is and how it works we need to clarify a few things. In asymmetric cryptography we have two type of keys (public — anybody can access it /private — restricted access) we can use to encrypt a payload. We call the output of the encryption a…

In our simple client-server architecture we need to create the client now. We let our end users access our API using a frontend application. This application lives in the browser. We load html content using HTTP from our server and invoke javascript functions to make our application more interactive. — One can build everything from scratch but nowadays we don’t reinvent the wheel. We use different frameworks and there are plenty of choices for frontend code.

We are creating our first users to check how Spring Security protects our application with some default configurations while adding our own passwordless authentication method. — We don’t have yet the UI to test an end to end flow. We can however use the browser to write some javascript code to send and receive messages via a WebSocket connection, but before we get there let’s see where we are: We have an H2 database storing our…

Since version 5.0 of the Spring framework, Spring Web MVC coexists with Spring WebFlux. Both flavours support creating web applications, one dealing with blocking applications based on Servlet API (Spring Web MVC) and the other one built on top of the non-blocking web stack Project Reactor (Spring WebFlux). Regardless of their programming model, having a passwordless authentication method addresses many problems and now it’s time to enable this for WebFlux applications too.