Secure-by-Default Spring Apps: Zero Trust, OAuth2, and Runtime Policies
summary
Cloud-native Spring architecture that replaces perimeter trust with concrete patterns: use Spring Authorization Server with JWT vs opaque tokens and RFC‑8705 certificate‑bound access tokens, enforce service identity with SPIFFE/SPIRE mTLS SVIDs, and run policy as code via Open Policy Agent (OPA) sidecar or Wasm in‑JVM. Demo is a Docker Compose stack (auth server, protected resource, OPA) showing live policy updates, canary log‑only rules, audit logs and traces, and practical tradeoffs for revocation, latency, and rotation.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 2:14Speaker background
- 6:09Intranet illusion problem
- 10:47Identity and token approaches
- 12:56Workload identities with SPIFFE/SPIRE
- 19:30Runtime policies with OPA
- 25:54Secure-by-default checklist
- 28:33Q&A
related talks
56mSecured REST Microservices with Spring Cloud
01h 30mSecuring Microservices with Spring Cloud Security
01h 31mSecurity for Microservices with Spring and OAuth2
54mHow to secure your Spring apps with Keycloak
54mHow to secure your Spring Apps with Keycloak
51mEnterprise Security with Spring Authorization Server 1.0
43mIdentity crisis: bending Spring Security to your advanced use-cases
01h 02mGetting Started with Spring Authorization Server