secured | SSL Secure Component | TLS library

In a Spring Boot 2.1 environment, I would like to use Togglz that are stored in a JDBCStateRepository.

The problem is: The Togglz are not shown in the console. The Togglz are not stored in the database.

My setup happens via the following files:

Maven:

I've hide my API key inside .env file in my React app. And I used it through process.env. But When I go to network tab in developers tool of google chrome and check requests there I can see my API key present in the request URL. Therefore my API key is not secured. Anyone will able to get my API key. How can I hide my API from that place as well?

When I get some claims from a JWT Token to validate user authentication I get the following error:

I have set up aws cognito and would like to use their federated identities to authenticate users against my own database but on getting a token after calling the get_open_id_token_for_developer_identity() and then calling the get_credentials_for_identity() the response is identityID , AccessKey , clientSecret and session token but this accesskey and client secret do not match the security credentials for my root user or even the IAM users and when used in postman with the AWS SIGNATURE authorization it throws an unauthorized error . I am getting the credentials after calling the get_credentials_for_identity() using identity id and in login{"cognito-identity.amazonaws.com":} but the response which includes accesskey and client secret does not let me hit the api now secured using cognito

I have a docker image, which uses Linux, R and plumber and works fine when pushed to an ACR and deployed to an ACI. The problem is, that the resulting endpoint is accessible via the Internet. It should only be accessible within our DMZ (?) virtual network (?) - apologies about my clumsy/potentially wrong use of terms. So IT created a private endpoint, which makes sense to me, but according to this:

https://docs.microsoft.com/en-us/answers/questions/193123/azure-aci-with-private-acr-and-selected-public-net.html

See also previous related post:

error whilst trying to deploy container image after introduction of private endpoint

This is currently not supported for ACI? How else can the ACI endpoint be secured in my scenario please? Thanks!

A user, who logged in or signed up should not re-login after one hour. The restriction of one hour comes from firebase authentication, if not prevented (what I try to accomplish).

After a user is logged in via firebase authentication (signInWithEmailAndPassword) I always get null for currentUser and onAuthStateChanged.

I'm using React (v17.0.2) using 'Create React App'. On server side I'm using NodeJS (v12). The communication between both is accomplished using axios (v0.21.1)

First I tried to send the token stored in localStorage, which came from firebase (server side), back to the server. But the server tells me, that the token is no longer valid. Server side code as follows:

I have security setup in my Spring Boot application using OpenId and Spring Boot Security.

By accident I forgot to add a role type to my @PreAuthorize("hasAnyRole('...)") tag and tried to make a call as a USER and was denied (403), but I do have the hasAnyRole stated in my securityConfig file. Once I added the role to the preAuth tag it worked, but I'm wondering if that is expected behavior? Or am I doing something wrong in the security config file?

I'm using the following Spring Boot Security Settings

Something I can't wrap my head around. As I understand the authorization code flow is supposed to be more secured than the implicit flow, because the tokens are not directly sent to the client from the authorization server, but rather retrieved by your backend. So the flow is basically:

1. Browser gets the authorization code (as a URL parameter of sort).
2. Sends it to a public backend endpoint.
3. The backend sends the code + client secret to the authorization server, retrieves the tokens and stores them in the client's cookie/local storage for further use.

In this flow all the tutorials describe the authorization code as useless to the hacker, why is that? Can't a hacker use Postman or some other client and access your (public) API directly, make it go through step 3 and thus retrieve the tokens just the same?

What am I missing here?

According to the documentation, one prerequisite for using NiFi CLI against a secured NiFi instance is to configure proxy user request for the node's identity (e.g. CN=localhost, OU=NIFI).

https://nifi.apache.org/docs/nifi-docs/html/toolkit-guide.html#prerequisites-for-running-in-a-secure-environment

I understand how to configure it through the NiFi web user interface. However, is it possible to do the same through scripting?

The reason is that I am working on a NiFi installation script, and I would like to install NiFi and configure users/policies in one go if it is possible.

Thank you!