How to Retrofit Spring Security Into a Legacy Internal App When VPN Access Ends

·66 views

A software developer has published a detailed guide on adding Spring Security to an existing Java Spring Boot application that previously relied solely on VPN-based network access for protection. The article addresses a common real-world scenario where internal business tools — such as accounting systems and admin panels — must handle authentication and authorization as remote and external access needs grow. Using a demonstration financial accounting system built on Java 21 and Spring Boot 3.5, the author walks through retrofitting security onto a live, publicly accessible app with a fabricated but structurally realistic dataset. The guide deliberately recreates actual bugs encountered during a parallel work project, allowing readers to trace each flaw from cause to fix using published code on GitHub. It is aimed at beginner and mid-level developers who have basic Spring Security experience but have not yet tackled row-level or role-based data authorization.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Three Tauri build bugs found after a green CI run on macOS, Windows and Linux

The author maintains StackerPulse, a Rust and Tauri v2 desktop app, and shipped builds across three platforms from one workflow. A macOS universal build failed at bundling because a second binary, a CLI secret scanner, was compiled but never merged into the universal output, even though each individual step behaved correctly. A release workflow then reported success while uploading no installers, since the release-creation step returned an empty ID and the action skipped uploads without any warning. Inspecting the update manifest revealed a third issue: two per-language MSI installers shared one architecture key, so the English build was overwritten and users could receive the wrong language after an update. The author concludes that a passing build only shows the toolchain did not crash, and that these failures emerge from handoffs between components.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SteamVR verbessert Streaming-Bildqualität, doch Sehtraining erfordert andere Ansätze

Valve hat ein SteamVR-Beta-Update veröffentlicht, das die Bildqualität beim Streaming über Steam Link auf Standalone-Headsets wie Meta Quest, HTC Vive Focus und PICO verbessern soll. Der Artikel betont, dass schärfere Bilder nicht zwingend die Verarbeitung im visuellen System verbessern, da bei Amblyopie und Aufmerksamkeitsdefiziten vor allem die Gewichtung der Augensignale im Gehirn entscheidend ist. Deshalb eignen sich VR-Headsets mit zwei unabhängigen Bildfeeds für dichoptisches Training, bei dem beide Augen gleichzeitig unterschiedliche Bilder erhalten. Die App Amblyotube für Meta Quest nutzt dieses Prinzip, indem sie ein Seh- und Aufmerksamkeitstraining in YouTube-Inhalte einbettet. Der Artikel beschreibt außerdem Kalibrierung, einen Sehtest und Filter, die das dominante Auge gezielt beeinflussen.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developers Can Make Coding Agents Wait 7 Days Before Installing New Packages

Supply-chain attacks on npm packages often remain live for only hours, so a freshly published malicious version can be pulled by a coding agent before anyone reviews it. The article recommends a release-age gate, or cooldown, that refuses package versions younger than a set number of days. Package managers npm, pnpm, Yarn, Bun and uv each support such a setting, but they use different keys and units, so a wrong unit can make the gate ineffective or absurdly long. The npm setting requires version 11.10.0 or later, and older versions silently ignore it, so developers should verify their installed version. Developers can also exempt packages from the gate, though only for scopes they control on the public registry.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Axelor Permission Reviews Urged Across Objects, Fields, and Roles

A security write-up argues that Axelor Open Suite, a low-code platform spanning CRM, finance, inventory, HR and other modules, needs its permissions audited as a whole. It notes that effective access comes from combining object permissions, field-level rules, record conditions, and layered roles and groups. The author highlights export rights, integration service accounts, and attachment routes as areas where data can leak despite restricted records. Recommendations include restricting admin and customization menus, alerting on role and permission changes, and testing workflows in a low-sensitivity staging environment. The piece also reports ZoomEye search counts for Axelor-titled instances as a candidate population, while cautioning that those results do not establish how many are actually affected.

0 comments Read more at DEV Community