Spring Security Tutorial Details Refresh Token Implementation to Complement JWT Authentication
A comprehensive tutorial on Spring Security demonstrates how to extend JWT authentication with refresh tokens to balance security and usability. The guide begins by explaining the limitations of short-lived access tokens, which typically expire within 15 minutes to one hour, and introduces refresh tokens that can last from one week to one month.
The article details the creation of a RefreshToken entity annotated with JPA mappings, including fields for the token string, associated user, expiration instant, and revocation flag. It also provides the corresponding RefreshTokenRepository interface with methods to find tokens and delete all tokens for a given user.
In the service layer, RefreshTokenService implements token creation by removing existing tokens for the user, generating a new UUID-based token, setting an expiration based on a configurable property, and persisting it. The verify method checks for existence, expiration, and revocation status, throwing a custom RefreshTokenException when necessary, while the revoke method marks tokens as revoked.
Security considerations are thoroughly covered, highlighting benefits such as reduced exposure time for access tokens, automatic session renewal, centralized session control, and minimized password transmission. Risks discussed include potential database compromise mitigated by hashing with SHA-256 or HMAC-SHA256, increased database load due to statefulness, implementation complexity involving token rotation, and client-side storage vulnerabilities addressed by using HttpOnly cookies instead of localStorage.
The tutorial updates DTOs to include AuthResponse and RefreshRequest, modifies AuthService to integrate refresh token creation during registration and login, and enhances AuthController with endpoints for refresh and logout. A helper method sets secure, HTTP-only cookies with appropriate path and max-age settings.
Finally, adjustments to SecurityConfig are shown to permit public access to authentication endpoints and profile retrieval while restricting administrative routes, ensuring a complete implementation of refresh token mechanics alongside JWT handling.
Related articles
Building Secure MLOps Platforms in Air-Gapped Environments for DevOps Engineers
The article explains how DevOps engineers can construct a minimal yet complete MLOps platform inside a closed, air-gapped network without relying on any cloud services. It highlights the cultural gap between data scientists and DevOps teams and shows how MLOps practices such as data versioning, experiment tracking, and model registries bridge that gap. The architecture separates GPU training nodes from a Kubernetes serving cluster and uses open-source components including ArgoCD for GitOps, MLflow with PostgreSQL, MinIO, DVC, OpenBao, and External Secrets Operator. Special attention is given to secrets management with SOPS and age keys, image scanning with Trivy and Bandit, and secure Docker access via socket proxy on the training server. The setup avoids Kubeflow and HashiCorp Vault due to complexity and licensing concerns, favoring lighter, license-friendly alternatives suitable for isolated perimeters.
How the Modern Web and HTTPS Emerged from Simple Two-Computer Networks
The article traces the evolution of internet infrastructure from two friends connecting PCs with twisted-pair cable and assigning IP addresses to the global system of DNS, routing, and public-key certificates. It explains how early local networks expanded with switches, always-on servers, and domain names to solve the problem of changing IP addresses. As networks grew and interconnected through routers and ISPs, new risks of eavesdropping and traffic redirection appeared on open paths. The solution introduced centralized certificate authorities such as the fictional Sectigo that issue chained certificates rooted in pre-installed trust stores. The piece details the structure of certificates, key pairs, signing chains, and the browser validation process that enables encrypted HTTPS sessions. Written in accessible language with deliberate simplifications, the text serves as an educational overview rather than a technical manual.
Russian Neighbors Fined Over 200,000 Rubles for Defamatory Remarks in Apartment Building Chat as Supreme Court Upholds Ruling
Two women who participated in a shared apartment building chat have been ordered to pay more than 200,000 rubles in total after a court found their messages about a neighbor to be defamatory. The case began when residents complained about noisy tenants and escalated into mutual insults exchanged in the group chat, via SMS, and during phone calls. The apartment owner filed a lawsuit for protection of honor and dignity after police found no administrative violation in his actions as landlord. A linguistic expert determined that several public messages, while free of direct profanity, contained derogatory characterizations and implications of mental illness that could not be considered acceptable value judgments. The court awarded more than 100,000 rubles against one defendant and a slightly smaller sum against the second, taking into account the plaintiff's own conduct during the conflict. All appeals were rejected, including by the Supreme Court, establishing that even indirect humiliating statements about an identifiable person in a building chat can result in substantial financial liability.
Samara University Study Shows Social Ties Maintain Order in Minecraft Virtual Cities
Researchers from Samara University examined how player-run cities in Minecraft sustain order without heavy reliance on formal rules or enforcement mechanisms. Olga Udalova conducted eight interviews with virtual mayors and surveyed 246 players across multiple communities. The study found that dense social connections, personal reputation, and informal authority of mayors play a far greater role than written regulations. In some cities detailed norms exist while others operate with minimal rules, simply requiring players to act reasonably. A notable example is Boostergrad, a semi-anarchic community of 117 residents where griefing is formally permitted yet rarely occurs because reputational damage outweighs any short-term gain. Residents resolve conflicts through negotiation and voluntarily compensate for damage, as illustrated by one player who paid 2000 units of in-game currency after accidentally destroying another’s loot. Overall the research demonstrates that trust and social networks, rather than fear of punishment, keep these virtual societies stable.