Spring Security Tutorial Details Refresh Token Implementation to Complement JWT Authentication
A comprehensive tutorial on Spring Security demonstrates how to extend JWT authentication with refresh tokens to balance security and usability. The guide begins by explaining the limitations of short-lived access tokens, which typically expire within 15 minutes to one hour, and introduces refresh tokens that can last from one week to one month.
The article details the creation of a RefreshToken entity annotated with JPA mappings, including fields for the token string, associated user, expiration instant, and revocation flag. It also provides the corresponding RefreshTokenRepository interface with methods to find tokens and delete all tokens for a given user.
In the service layer, RefreshTokenService implements token creation by removing existing tokens for the user, generating a new UUID-based token, setting an expiration based on a configurable property, and persisting it. The verify method checks for existence, expiration, and revocation status, throwing a custom RefreshTokenException when necessary, while the revoke method marks tokens as revoked.
Security considerations are thoroughly covered, highlighting benefits such as reduced exposure time for access tokens, automatic session renewal, centralized session control, and minimized password transmission. Risks discussed include potential database compromise mitigated by hashing with SHA-256 or HMAC-SHA256, increased database load due to statefulness, implementation complexity involving token rotation, and client-side storage vulnerabilities addressed by using HttpOnly cookies instead of localStorage.
The tutorial updates DTOs to include AuthResponse and RefreshRequest, modifies AuthService to integrate refresh token creation during registration and login, and enhances AuthController with endpoints for refresh and logout. A helper method sets secure, HTTP-only cookies with appropriate path and max-age settings.
Finally, adjustments to SecurityConfig are shown to permit public access to authentication endpoints and profile retrieval while restricting administrative routes, ensuring a complete implementation of refresh token mechanics alongside JWT handling.
Related articles
Google Tests Third-Party App Store Support in Play Store Following Epic Games Antitrust Ruling
Google is actively testing multiple new features in the Play Store, including a dedicated Play Labs experimental section, direct installation of alternative app stores, and an expanded two-line search interface. The most notable change allows users to install competing app marketplaces directly from Google Play, a capability tied to the reinstated 2024 court decision in the Epic Games antitrust case after the companies' settlement was withdrawn. Although the new menu option for third-party stores has been discovered through app modifications, attempts to access it currently result in errors. Play Labs, an experimental area for previewing upcoming store capabilities similar to features already present in Google Search, was also found but remains non-functional. The updated search bar is already operational, supporting longer natural-language queries and an Ask Store prompt to help users describe needs in detail rather than using short app names. APK analysis indicates these developments are still in progress, meaning Google may modify, delay, or cancel any of them before wider release. The overall direction signals that the primary Android app store is preparing to facilitate competition by distributing rival marketplaces.
OTUS Publishes Extensive Digest Covering Kubernetes, GitLab CI, DevSecOps and Infrastructure Reliability
OTUS has released a large-scale digest that compiles free lessons, practical articles and advanced courses focused on real-world infrastructure challenges. The collection addresses interconnected topics including Kubernetes container orchestration, GitLab CI pipeline automation, observability with OpenTelemetry, network troubleshooting, and DevSecOps practices. Readers can explore specific lessons on secrets management with Vault, load testing, RAID recovery, and kernel-level protections in Linux. The digest also features in-depth articles on Docker Compose configuration, CrowdSec migration, L2 network loops, and self-service deployment models. For experienced professionals, OTUS offers specialized courses on high-load systems, PostgreSQL administration, Linux kernel development, and advanced networking with BGP and OSPF.
Xello and Kode Bezopasnosti Sign Technological Partnership to Integrate Equipment Emulation into Xello Deception Platform
Xello, a Russian developer of data and infrastructure protection platforms, and Kode Bezopasnosti, a Russian developer of software and hardware information security tools, have signed a technological partnership agreement. The collaboration will enable emulation of Kode Bezopasnosti equipment within Xello Deception, the first domestic Distributed Deception Platform designed to protect against targeted attacks. This integration will enhance the creation of a realistic false layer of IT assets and expand use cases for early threat detection in customer environments. Xello product head Rustam Zakirov emphasized that the partnership addresses customer needs by making the deception layer more authentic for organizations using Kode Bezopasnosti solutions while fostering expertise exchange. Kode Bezopasnosti strategic marketing head Pavel Korostelev highlighted the growing demand for deception technologies amid rising targeted attacks and the value of supporting proactive detection capabilities on the Russian market. The agreement combines both companies' strengths to improve practical scenarios for cyber deception deployment.
How Ideco Measures NGFW Performance Using TRex ASTF and RFC 9411 Methodology
Ideco engineers have published a detailed methodology for benchmarking the performance of their Ideco NGFW Novum product on the Ideco EX hardware platform. The team uses TRex in Advanced Stateful mode to generate realistic L4-L7 traffic and follows RFC 9411 guidelines to ensure reproducible results across different test environments. Key metrics include throughput on UDP 1518-byte frames reaching 200 Gbit/s, TCP/HTTP performance varying from 100 Gbit/s down to 62 Gbit/s depending on object size, and EMIX mixed traffic dropping from 92 Gbit/s with firewall only to 15.5 Gbit/s when all inspection engines are enabled. The methodology incorporates binary search for maximum load, a 1% session drop threshold, and 300-second hold times per test point to capture real-world behavior rather than short-term peaks. All tests were performed without TLS decryption, with separate plans for hardware-based Keysight BreakingPoint testing when decryption is required. The full article includes hardware specifications, traffic profiles, loss calculation formulas, and configuration details to allow anyone to reproduce the measurements.