Topic 14.4
Security
In one line
Authentication, authorization, OAuth2, JWT, mTLS, secrets, encryption — the seven walls of a real system.
Think of it like this
A house with a locked front door (authentication: are you who you say you are), a house rule about which rooms guests can enter (authorization: what are you allowed to do), and curtains on the windows (encryption: others can't see inside even if they're right outside).
Key ideas
- 01
Authentication (who are you?) vs Authorization (what may you do?) — two different systems, never merged.
- 02
OAuth2 flow: client asks auth server → token granted → APIs verify via token introspection/JWT signature.
- 03
JWT: signed (HS256/RS256), stateless, carry claims (sub, tenant, role, exp) — verify signature + exp EVERY call; never trust client claims.
- 04
mTLS: service-to-service mutual certificate auth — the internal-network security wall (TLS + client certs).
- 05
Secrets: Vault, environment-injected, never in git/repos/logs — rotate aggressively.
- 06
Encryption: TLS in transit everywhere; AES at rest (disk/DB/object store); key management is its own system (KMS).
- 07
Attack surface drill for interviews: auth bypass, IDOR (missing tenant_id check!), injection, SSRF, token theft, secrets in logs.
- 08
Interview: 'auth via the gateway (JWT verify), service-to-service via mTLS, secrets in Vault, everything TLS' — that is a wall.
Java / Spring map
- →
Spring Security: OAuth2 resource server, JwtDecoder, mTLS server config, @PreAuthorize on the method level.
Code & diagrams
Two different questions, two different systems — never merge them.
Explain without notes
The IDOR bug (tenant A reads tenant B rows) — which three controls (authz, scoping, testing) stop it?
Practice
Write the security architecture for a SaaS: gateway JWT, service mTLS, secrets vault, at-rest encryption.
Trade-offs
- ↔
Security walls cost latency (TLS), ops (mTLS cert rotation), and convenience — the budget is the product's risk profile.
Run it in production
You've designed it. Now build, operate, and break the same idea hands-on in the DevOps courses:
Completion checklist
I can present authn/authz/OAuth2/JWT/mTLS/secrets/encryption as one cohesive wall.