Spring Security is a comprehensive authentication and authorization library for Spring-based applications, supporting both Servlet (MVC) and Reactive (WebFlux) stacks. In production, it intercepts HTTP requests via a configurable filter chain (SecurityFilterChain for servlet, WebFilterChain for reactive) to enforce authentication, session management, CSRF protection, security headers, CORS, and access control. It provides a pluggable architecture with core abstractions (AuthenticationManager, AuthorizationManager, SecurityContextHolderStrategy) and protocol-specific modules for OAuth2/OIDC, SAML2, LDAP, CAS, WebAuthn, Kerberos, and JWT. The library is configured via annotations (@EnableWebSecurity, @EnableMethodSecurity), a Kotlin DSL, or XML namespace, and integrates deeply with Spring's configuration and dependency injection. The architecture is modular: the 'core' module defines foundational interfaces (Authentication, GrantedAuthority, SecurityContext), 'web' implements servlet and reactive security filters, 'config' provides annotation-driven and XML configuration support, and protocol modules (oauth2, saml2, ldap, webauthn, cas) handle specific authentication/authorization flows. Key entry points include the HttpSecurity/ServerHttpSecurity builders, SecurityFilterChain, and method-security annotations (@PreAuthorize, @Secured). External dependencies include Spring Framework, Jackson (for serialization), Project Reactor (for reactive support), OpenSAML, and LDAP libraries. The codebase demonstrates strong engineering practices: extensive use of strategy, composite, and builder patterns; clean separation of servlet and reactive APIs; and a consistent Jackson mixin pattern for serialization of security objects.
Spring Session is a library that provides a robust, pluggable session management solution for Spring-based applications. It abstracts session storage behind a `SessionRepository` interface, supporting multiple backends including Redis, JDBC, and in-memory. The library seamlessly integrates with both Servlet and WebFlux stacks, replacing the standard `HttpSession` with a configurable, cluster-friendly alternative. It also offers deep integration with Spring Security for concurrent session control and remember-me authentication, and with WebSocket for session-aware messaging. The architecture is modular: `spring-session-core` defines the core API (Session, SessionRepository, FindByIndexNameSessionRepository, HttpSessionIdResolver) and provides the servlet filter (`SessionRepositoryFilter`) and reactive store (`SpringSessionWebSessionStore`). `spring-session-data-redis` implements Redis-backed repositories with support for indexing by principal name and expiration via sorted sets and keyspace notifications. `spring-session-jdbc` provides a JDBC-backed repository with dialect-specific SQL schemas and customizable queries. Configuration is annotation-driven (e.g., `@EnableRedisHttpSession`, `@EnableJdbcHttpSession`) and supports customization through beans like `CookieSerializer`, `SessionRepositoryCustomizer`, and `FlushMode`/`SaveMode`. Key data flows involve session creation, attribute modification, expiration, and principal-based lookup. The library uses events (`SessionCreatedEvent`, `SessionDeletedEvent`, `SessionExpiredEvent`) for lifecycle notifications and supports AOT compilation for GraalVM native images. External dependencies include Spring Framework, Spring Data Redis, Spring Data JDBC, Reactor, and optionally Jackson for JSON serialization. The build system uses Gradle with custom convention plugins for publishing, documentation, and release management.
ruoyi-vue-pro (芋道) is a large-scale, multi-module enterprise rapid development platform built on Spring Boot 2.7, MyBatis-Plus, and Vue 3. It provides a comprehensive backend infrastructure for building business applications such as ERP, CRM, HRM, MES, WMS, OA, BPM (Flowable), IoT, AI, IM, Pay, Mall, and more. The codebase is structured around a reusable framework layer (`yudao-framework`) with many Spring Boot starters for security, data permission, multi-tenancy, WebSocket, Excel, monitoring, and protection (rate limiting, idempotency). Business modules follow a consistent layered pattern (DO → Mapper → Service → Controller → VO) with MapStruct converters. The system supports MySQL, PostgreSQL, Oracle, SQL Server, and Dameng databases, and integrates with Redis, RabbitMQ, Kafka, RocketMQ for messaging. It includes a code generator, a workflow designer, and AI chat/image/mind-map capabilities. The architecture is modular and well-organized, though the sheer number of modules (20+) introduces some duplication and complexity. Overall, it is a mature, actively maintained project with strong adherence to common enterprise patterns.
This is a comprehensive e-commerce backend platform built with Spring Boot 3.5+, JDK 17, and a multi-module Maven architecture. In production, it serves two distinct APIs: `mall-admin` (admin management) and `mall-portal` (customer-facing storefront), plus a dedicated `mall-search` module for Elasticsearch-powered product search. The system handles product cataloging, order lifecycle management, user registration/authentication, coupon and promotion calculations, shopping cart operations, payment integration (Alipay), and content management (home page banners, recommendations). It uses MySQL as the primary database via MyBatis (with generated mappers), Redis for caching and session management, MongoDB for user activity data (browsing history, favorites), RabbitMQ for delayed order cancellation, and MinIO/Aliyun OSS for file storage. Security is implemented with Spring Security and JWT, including dynamic path-based authorization. The codebase follows a layered architecture (Controller → Service → Mapper/DAO) with shared modules `mall-common` and `mall-security` providing reusable utilities for API responses, pagination, exception handling, Redis caching, and authentication. While heavily reliant on MyBatis Generator for data access objects and includes some long service methods, the overall structure is well-organized and modular, making it suitable as a reference for similar e-commerce projects. No data research or analytical components are present; this is purely an application codebase.
This repository is a sample Spring Boot application that demonstrates custom JWT token-based authentication for protecting RESTful APIs. It provides a vehicle CRUD API (via both a custom controller and Spring Data REST), a user authentication endpoint (/auth/signin), and a user info endpoint (/me). The architecture follows a standard Spring Boot monolith with Spring Security, Spring Data JPA, and Spring HATEOAS. The custom JWT implementation is encapsulated in a JwtTokenProvider and a JwtTokenAuthenticationFilter, which extract, validate, and set authentication from JWTs. The codebase is modern, using Spring Boot 3.x, Jakarta EE, Java 21, and the latest JJWT library. It includes unit tests, integration tests, and a docker-compose file for PostgreSQL. While the core functionality is straightforward and typical for such samples, the separation of JWT logic into reusable components and the use of Spring Boot 3.x best practices make it a solid reference implementation. It is primarily an application with no data research elements.
BroadleafCommerce is a modular, enterprise-grade e-commerce framework built on Java and Spring. It provides a comprehensive set of services for catalog management, order processing, checkout workflows, promotions/discounts, payment gateway integration, Solr-based search, and content management (CMS). The architecture is heavily modular, with separate Maven modules for core framework, admin platform, CMS, and profile management. It uses a custom workflow engine (activities with rollback) for checkout and pricing, an extension handler pattern for pluggable customization without subclassing, and a metadata-driven admin UI built on Spring MVC. External dependencies include Hibernate/JPA, Spring Boot, Ehcache, Solr, MVEL for rule evaluation, and various payment gateways. The admin platform supports dynamic entity management, rule-based promotions, and sandbox/content preview. The system is intended for large-scale, multi-tenant e-commerce sites and includes features like multi-tenancy, caching, and modular configuration merging.
This is a full-stack web application starter kit combining Angular (frontend) and Spring Boot (backend) with JWT-based authentication. The system provides user registration, login, role-based access control (USER/ADMIN), and protected API endpoints. The frontend communicates with the backend via RESTful APIs, with authentication handled through JWT tokens stored in cookies. The architecture follows a standard client-server pattern with clear separation of concerns: Angular handles UI presentation and user interactions, while Spring Boot manages business logic, data persistence, and security. Key features include route guards for client-side protection, custom JWT filters for server-side authentication, and centralized service layers for API communication.
This repository is a historical demo application showcasing JWT-based authentication and authorization in a Spring WebFlux reactive stack. It implements a custom security filter chain that first authenticates via HTTP Basic (returning a signed JWT) and then validates Bearer tokens on protected endpoints. The code uses Spring Boot 2.1.1, Java 8, and the Nimbus JOSE library for JWT signing and verification. The architecture is a simple monolith with in-memory user details and hardcoded secrets, intended for educational purposes rather than production use. The README explicitly states the project has been superseded by a modernized version (Spring Boot 4, Java 21, Spring Security 7) and is kept for historical reference. The code demonstrates key patterns: custom ServerAuthenticationSuccessHandler, functional bearer token converter, and a dummy ReactiveAuthenticationManager for stateless JWT authentication. However, it suffers from significant technical drift (outdated dependencies, Java 8, deprecated APIs) and lacks proper error handling, tests, and configurability.
This repository is a meta-project for a Spring Cloud microservices demo, now superseded by the Opensabre framework. It contains no actual source code; instead, it aggregates several external submodules (opensabre-framework, base-authorization, base-organization, base-gateway, etc.) via Git submodules. The root pom.xml defines dependencies for Spring Boot 2.1.10, Spring Cloud Greenwich, and Alibaba Cloud 2.1.0, all of which are outdated. The README explicitly states that the project has been replaced by a newer version. As a standalone repository, it provides no reusable code or components; it serves only as a historical reference or a pointer to the submodules. The repository is effectively deprecated and should not be used for new projects.