If you currently federate enterprise customers using OpenID Connect (OIDC) and want to allow applications to access your API on behalf of those users, this Cross App Access (XAA) guide is for you.
Read moreIf you currently federate enterprise customers using OpenID Connect (OIDC) and want to connect with third-party applications, this Cross App Access (XAA) guide is for you.
Read moreIf you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to connect with third-party applications without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you.
Read moreCross App Access (XAA) lets your application request data from another vendor's API on behalf of a signed-in enterprise user, without static API keys and without a separate consent prompt for every connection. If enterprises buy your software, supporting XAA turns your integration into something their IT team can govern…
Read moreIf you currently federate enterprise customers using Security Assertion Markup Language (SAML) and want to allow applications to access your API without migrating to OpenID Connect (OIDC), this Cross App Access (XAA) guide is for you.
Read moreTaylor Swift once said, "Sometimes walking out is one thing that will find you the right thing." That's probably what happened to me. During my engineering days, all I ever wanted was to be a backend engineer, write code all day, use dark mode for IDEs, and sip coffee. And…
Read moreIf you've watched Friends, you'll know that life rarely goes according to plan. One day, you're helping a friend move a couch while yelling "Pivot!", and the next, you're wondering how you ended up there in the first place.
Read moreAI agents are quickly becoming part of everyday enterprise development. They summarize emails, coordinate calendars, query internal systems, and automate workflows across tools.
Read more
Akanksha Bhasin 2 min read
Identity has become one of the most important control points in modern systems. As applications grow more distributed and AI-driven automation becomes part of everyday workflows, identity increasingly defines how secure, predictable, and trustworthy those systems are. Decisions about access, scope, and lifecycle now shape not only the user experience,…
Read moreWhen you choose Okta as your IAM provider, one of the features you get access to is customizing your Okta-hosted Sign-In Widget (SIW), which is our recommended method for the highest levels of identity security. It's a customizable JavaScript component that provides a ready-made login interface you can use immediately…
Read moreAI is taking over the world by storm! This year, AI is our focus at Oktane. We want to ensure you have the tools, the know-how, and solutions to keep your software systems secure, from traditional user apps to AI agents.
Read moreIdentity-based attacks have become prevalent, and successful attacks are impactful. Attackers use increasingly sophisticated ways to breach privileged systems, so we must defend our accounts by elevating our identity security methods. Okta is committed to leading the industry in combating identity-based attacks through initiatives like the Secure Identity Commitment. Here…
Read moreSaaS apps not only have to meet the rigorous demands of managing users at an enterprise level but must also be secure and resilient by design.
Read more
Sohail Pathan 4 min read
"Sometimes, all it takes is a spark of curiosity to ignite a lifelong journey." - Unknown
Read moreAs part of Okta's Secure Identity Commitment (OSIC) to lead the industry in the fight against identity attacks, we are making changes to improve our architecture related to developer organizations.
Read moreI'm Akanksha Bhasin, and I'm all about building community for developers. I come from a developer background, and for over six years, I've been building and growing communities for developers. On top of that, I've spent the last four years diving into Developer Relations. I've had the chance to work…
Read more
E. Dunham 1 min read
The Developer Podcast is back, focusing on all things integrator this season! In this introductory episode, you'll meet the hosts and learn what's in store for the rest of the season. We'll get more hands-on with technical and architectural identity integration topics through the season.
Read more E. Dunham 1 min read
Are you working on an integration for the Okta Integration Network(OIN)?
Read more
Semona Igama 2 min read
You have an app with SSO capabilities. What else can you do with Okta to transform it into an enterprise-ready powerhouse?
Read moreWhether or not you use Okta's products, you may find yourself working on software whose target audience includes Okta customers. Adding your application to the Okta Integration Network creates a smoother and less error-prone user management experience for these shared customers, and can unlock the potential of additional features as…
Read moreWe've been discussing and reflecting on the Future of Identity over the last couple of months. It's apparent to us that Identity is rapidly growing in its complexity. The surface area that our customers need to protect is growing, like a sunrise revealing a hidden terrain in the morning twilight.…
Read moreWe are excited to have a presence at RSA Conference 2024! On Tuesday, May 7th, we will speak on Identity: Your key to stop breaches. Consider why you don't want to miss this session:
Read moreUpdate: This post was updated in July 2026 to include OAuth 2.0 Private Key JWT authorization, Okta Admin Console integration for initiating Universal Logout end-to-end, and an optional OIN submission guide. The original post covered building the Global Token Revocation endpoint and securing it with an API key.
Read more E. Dunham 4 min read
If you use Okta's embedded Sign-In Widget, users logging in via Chrome may encounter problems starting January 1st 2025. That's when Okta's extension to Google disabling the use of third-party cookies ends.
Read more E. Dunham 4 min read
NOTE: In July, Google provided an update on their third-party cookie deprecation effort. Okta will work with Google to understand the specific impact on Okta customers. In the meantime, we continue to advise customers to migrate away from using third-party cookies, as outlined below.
Read moreIn late September, in partnership with DevPost, we announced the AI and Identity - Okta Hackathon 2023, and invited developers across the globe to "build an app that integrates identity standards with a flair of AI."
Read moreStatic API tokens have long been used to call external APIs and access the resources of third parties such as software vendors. As API standards have evolved, OAuth 2.0 emerged as the option offering more robust security, greater flexibility, and a better developer experience. Let's explore the advantages of moving…
Read moreHaving an enterprise-ready SaaS application means your application supports authentication best practices, can scale across multiple customers and users, has automated means to re-create environments, and can securely add enhancements and value-adds your customers expect. Join this free virtual workshop series where we take your SaaS application on a journey…
Read moreReady to move beyond MVP in the journey of adding enterprise-ready identity in your SaaS app? With the must-have functionality in place, you're ready to make your app stand out, get noticed by enterprise customers, and handle user provisioning and automation that can scale!
Read moreUnderstanding what enterprise customers look for in a SaaS app is step one, but how do you achieve it? What steps do you take to support enterprise-ready identity in your app?
Read moreYou have a great SaaS application, and know everyone will find your app so productive and wonderful. But you're ready to move beyond a B2C or a B2B for small companies. You want to go enterprise! But are enterprise customers a different breed? And what sort of things are they…
Read moreWhat makes a SaaS application ready for enterprise customers when it comes to identity? Between handling application security, user onboarding, and scalable, secure authentication practices, there's much to consider and prepare before determining your app is "enterprise ready."
Read moreDo you enjoy podcasts? I find that, like audiobooks, podcasts can transform boring tasks into an opportunity for entertainment and education.
Read moreJetty is a small, highly-scalable Java-based web server and servlet engine. It supports HTTP/2, WebSockets, and many other protocols. It powers websites and frameworks, both large and small, such as Google AppEngine. Because it is an Eclipse project, its open source project is called Eclipse Jetty. It is standards-compliant and…
Read more
Team Okta 1 min read
We're thrilled to bring back Developer Day in 2023! Developer Day is an event for developers designed by developers. This year we're happy to announce this event is a free, two-day virtual event, so you can join us wherever you are! The event focuses on using identity to power secure…
Read more
Alisa Duncan 5 min read
Creating secure applications requires authentication. Delegating all the tedious details of the sign-in process to Okta is the most secure method to authenticate, not to mention speedier for development. So you'll see us advocating for and using the Okta-hosted sign-in page in our blog posts.
Read moreReact Native is a mobile app framework from Facebook. It allows you to quickly develop apps using React's API and deploy them to iOS and Android. It allows you to quickly refresh the apps when you make changes and generally offers a pleasant experience for web developers.
Read moreMicroservices have been quite popular in the Java ecosystem ever since Spring Boot and Spring Cloud made them easy to build and deploy. Things have gotten even easier in recent years with the proliferation of new Java frameworks built specifically for microservices: MicroProfile, Micronaut, Quarkus, and Helidon. Not only do…
Read moreOne of the traditional approaches for communicating between microservices is through their REST APIs. However, as your system evolves and the number of microservices grows, communication becomes more complex, and the architecture might start resembling our old friend the spaghetti anti-pattern, with services depending on each other or tightly coupled,…
Read moreJava has had good multi-threading and concurrency capabilities from early on in its evolution and can effectively utilize multi-threaded and multi-core CPUs. Java Development Kit (JDK) 1.1 had basic support for platform threads (or Operating System (OS) threads), and JDK 1.5 had more utilities and updates to improve concurrency and…
Read moreYou will use Vue and Spring Boot to build a todo list web application. The application will include CRUD abilities, meaning that you can create, read, update, and delete the todo items on the Spring Boot API via the client. The Vue frontend client will use the Quasar framework for…
Read moreContinuous integration and delivery (CI/CD) are essential practices for modern software development. In this post we cover the basics of how to add CI/CD for a JHipster microservices architecture and Kubernetes as the target cloud deployment environment.
Read more
Matt Raible 6 min read
Spring is a long-time friend to enterprise companies throughout the world. When Spring Boot came along in 2014, it greatly simplified configuring a Spring application. This led to widespread adoption and continued investment in related Spring projects.
Read moreUpdating an application to use OAuth 2.0 doesn't need to be complicated. Most of the time, your language or framework will already have an OAuth library. Sometimes, this isn't the case, and you need to find an alternative. In this post, I'll walk through setting up and using OAuth2 Proxy…
Read moreIn this tutorial, you'll use JHipster to build a microservice stack and deploy it to Amazon Elastic Kubernetes Service (EKS). The microservices will use Java and Spring Boot for resource servers and Vue for the frontend. The server-side applications will use Spring's Reactive technology stack. The microservice will include multiple…
Read more
Deepu K Sasidharan 7 min read
When it comes to infrastructure, public clouds are the most popular choice these days, especially Amazon Web Services (AWS). If you are in one of those lucky or unlucky (depending on how you see it) teams running microservices, then you need a way to orchestrate their deployments. When it comes…
Read moreReact was designed to make it painless to create interactive UIs. Its state management is efficient and only updates components when your data changes. Component logic is written in JavaScript, meaning you can keep state out of the DOM and create encapsulated components.
Read more Matt Raible 9 min read
You can use OAuth to secure apps, APIs, and devices. OAuth has become increasingly popular, especially as developers are asked to knit together hundreds of apps and thousands of users in enterprise environments.
Read moreMicroservices are not everyone's cup of tea, and they shouldn't be. Not every problem can or should be solved by microservices. Sometimes building a simple monolith is a far better option. Microservices are solutions for use cases where scale and scalability are important. A few years ago, microservices were all…
Read moreCloud adoption continues to increase rapidly worldwide, and not only in the software industry. Every year more and more companies move their applications to the cloud. In the last JHipster community survey, from December 2021, participants valued JHipster's ability to get them to production faster, and requested more tutorials on…
Read more Matt Raible 3 min read
In this tutorial, I'll show you how to create a secure REST API and native image with Helidon. You'll see how to run a secure, OAuth 2.0-protected, Java REST API that allows JWT authentication. Then, I'll compare its performance with Micronaut, Quarkus, and Spring Boot.
Read more Matt Raible 3 min read
In this tutorial, I'll show you how to create a secure REST API and native image with Micronaut. You'll see how to run a secure, OAuth 2.0-protected, Java REST API that allows JWT authentication. Then, I'll compare its performance with Quarkus, Spring Boot, and Helidon.
Read moreIn this tutorial, I'll show you how to create a secure REST API and native image with Spring Boot. You'll see how to run a secure, OAuth 2.0-protected, Java REST API that allows JWT authentication. Then, I'll compare its performance with Micronaut, Quarkus, and Helidon.
Read moreIn this tutorial, I'll show you how to create a secure REST API and native image with Quarkus. You'll see how to run a secure, OAuth 2.0-protected, Java REST API that allows JWT authentication. Then, I'll compare its performance with Micronaut, Spring Boot, and Helidon.
Read moreIonic is a framework for building mobile apps with web technologies that look and act like native apps. Because they're built with web technologies (HTML, JavaScript, and CSS), you can also deploy your Ionic apps as single-page applications. Or, even better, as progressive web apps (PWAs) that work offline.
Read moreIn this tutorial, you'll learn how to deploy a JHipster-based reactive microservice to Azure Kubernetes Service (AKS). You'll use Azure's Cosmos DB as a persistent store for one of the services. For security, you'll use Okta as an OAuth 2.0 and OpenID Connect (OIDC) provider. You'll also securely encrypt all…
Read moreThe Web Authentication (WebAuthn) specification, given official approval by the World Wide Web Consortium (W3C) and the FIDO Alliance in 2019, aims to strengthen online security by allowing users to sign in to sites with elements like biometrics and FIDO security keys. The WebAuthn API can replace or supplement less-secure…
Read moreGetting something to work is one of the greatest feelings you can have as a developer. Especially when you've spent hours, days, or months trying to make it happen. The last mile can be one of the most painful and rewarding experiences, all wrapped into the same day or two.
Read moreWhether you're coding, using a search engine, searching and replacing text in a text editor, or using the command-line utilities grep, sed, and awk in Linux, you're using regular expressions (also known as "regex" or "regexp"). Yes, they're everywhere.
Read moreAnyone who has tried to type a password using a television remote can tell you what a pain it is. Not only will you be frustrated with the keyboard, but it's not secure; everyone else in the room can see what you are typing. Fortunately, the OAuth 2.0 Device Authorization…
Read moreJava 18 was released last month (March 2022), and with it comes the second incubator of the Foreign Function & Memory API, so let us look at the state of Foreign Function Interface (FFI) in Java.
Read moreThe Thymeleaf library has been around at least for 10 years and it is still actively maintained as of today. It is designed to allow stronger collaboration between design and developer teams for some use cases, as Thymeleaf templates look like HTML and can be displayed in the browser as…
Read moreOver the years, I've developed a lot of Java applications. I started writing Java code in the late 90s and spent several years doing Java before I tried another server-side language. I was impressed when I first tried building apps in Ruby on Rails, Python, and Node.js - they all…
Read more
Alina Yurenko 4 min read
This post is syndicated from the JHipster community blog on dev.to. The Okta DevRel team thought you'd find it insightful. Okta is the platinum sponsor of the JHipster project.
Read moreYou've probably heard of Elasticsearch or the Elastic Stack. The project started as a search engine based on Lucene, an open-source search engine library built by Shay Banon to index his wife's cooking recipes. Since its early days, Elasticsearch has come a long way and has evolved into the Elastic…
Read moreSpring Cloud Contract was created as a way to help test interconnected microservices. Generally speaking, there are two options when testing microservices: 1) you can deploy the entire mesh of services in your integration tests and test against that, or 2) you can mock each service in your integration tests.…
Read moreIf you're developing a web application, chances are you want your dev environment as close to production as possible. One of the often-overlooked differences between local development and production servers is the use of Transport Layer Security (TLS), or Hypertext Transfer Protocol Secure (HTTPS). In this post, I'll cover three…
Read moreCLIs are great. I love the speed and productivity increases I get when using a CLI, but memorizing commands – especially when commands need arguments, options, flags, and so on – can be daunting. Luckily, there are tools available for CLI fans out there, and one tool I've been enjoying…
Read moreProject Helidon is a set of Java libraries for writing microservices. It's an open source, Apache 2.0-licensed, Oracle-sponsored project and contains support for MicroProfile as well as a reactive, functional API. Helidon's two different styles are known as Helidon MP and SE, respectively. The helidon.io website says:
Read moreMost applications require some sort of secret or password to enable access: database connection info, API keys, OAuth client secrets, and JWT keys, to list some examples. Dealing with secrets in your projects is always a chore, and it's often done wrong. In this post, I'll describe five common problems,…
Read moreIf you search for "Full Stack Java" on the internet, you'll likely find a lot of recruiting, courses, and jobs. Being a full stack developer can be exciting because you can create the backend and frontend of an app all by yourself. There is business logic and algorithms as well…
Read moreWhen defining classes for a simple aggregation of values, Java developers have traditionally relied on constructors, accessors, equals(), hashCode() and toString(), an error-prone practice that has low value and shifts the focus away from modeling immutable data. Java records were introduced as a first preview in JDK 14 in order…
Read moreHello Oktaverse!
Read more
Ryan Stewart 1 min read
As many of you may know, Okta completed the acquisition of Auth0 in May of 2021. We've since been busy, working out how our products will work together to help developers provide the best experiences for their users. If you joined us for Developer Day, you saw Okta and Auth0…
Read moreIn this tutorial, you are going to create a single-page application (SPA) that uses a Spring Boot resource server and a Vue front-end client. You'll see how to configure Spring Boot to use JSON Web Tokens (JWT) for authentication and authorization, with Okta as an OAuth 2.0 and OpenID Connect…
Read moreA common OAuth 2.0 question we get: "How do I deal with OAuth in a load-balanced application?" The short answer: There's nothing specific about session clustering for OAuth. The longer answer is—you likely still need to worry about cluster session management. This post will discuss how an OAuth login relates…
Read moreIn the fall of 2020, the Spring team released a new experimental Spring Native project that gave Spring developers hope for faster startup times. Spring Native is all about converting your Spring applications to native executables. It leverages GraalVM to make it happen. This announcement was huge because the new…
Read moreIt's been a big year for Okta and Auth0. Our two companies have officially joined forces over the past few months, and we are excited about the chance to shape the future of identity together. It's great to celebrate our combined developer communities at the first Developer Day event.
Read moreModern applications must work smoothly on high loads and with a high number of concurrent users. Traditional Java applications run blocking code and a common approach for scaling is to increase the number of available threads. When latency comes into the picture, many of these additional threads sit idle, wasting…
Read moreAmaze us! Build something unique and wonderful with early access to our new Okta Identity Engine Limited GA release. Here's how you can get involved.
Read moreContent negotiation allows for an HTTP server to respond to different types of clients. Many modern clients expect a JSON response, but there may be a need to format responses differently, maybe XML for older clients or a binary format for newer ones. Content negotiation is the mechanism used to…
Read moreSpring ẀebClient was added as part of the reactive web stack WebFlux in Spring Framework 5.0. WebClient allows performing HTTP requests in reactive applications, providing a functional and fluent API based on Reactor, and enabling a declarative composition of asynchronous non-blocking requests without the need to deal with concurrency. One…
Read moreSpring Cloud Sleuth allows you to aggregate and track log entries as requests move through a distributed software system. In a monolithic system, it's relatively easy to track requests as they move through the codebase because all requests can easily be logged to the same log file. You can generally…
Read moreWe know unit testing is a vital part of the software development process. We also know us developers love to debate techniques, frameworks, strategies, and how different layers and components need testing. Unit tests are the most valuable when they are stable, fast, and reproducible.
Read moreJava has been able to invoke native programs on an operating system for decades. Invoking native programs is often done using JNI (Java Native Interface) and JNA (Java Native Access). In the last few years, Java has also gained the ability to run JVM apps as native apps. That is,…
Read moreWhen your business or application is successful, it needs to scale. Not just technology-wise, but human-wise. When you're growing rapidly, it can be difficult to hire developers fast enough. Using a microservices architecture for your apps can allow you to divide up ownership and responsibilities, and scale teams along with…
Read moreNote: In May 2025, the Okta Integrator Free Plan replaced Okta Developer Edition Accounts, and the Okta CLI was deprecated. We preserved this post for reference, but the instructions no longer work as written. Replace the Okta CLI commands by manually configuring Okta following the instructions in our Developer Documentation.
Read moreReactive APIs are a powerful way to handle and serve large amounts of data and large numbers of requests in a web application. They rely on a "server-side event" model in which the client (e.g. your browser) subscribes to "events" on the server, and the server "pushes" events to the…
Read moreThe client credentials grant is used when two servers need to communicate with each other outside the context of a user. This is a very common scenario—and yet, it's often overlooked by tutorials and documentation online. In contrast, the authorization code grant type is more common, for when an application…
Read more
Ali Spivak 1 min read
Yesterday, Okta announced that we have finalized the acquisition of Auth0. You are probably looking at this blog post wondering what happens next for both companies. The post you are looking for, with a lot more details and information, is on the Auth0 blog. Please read it for more details…
Read moreA customer once asked me: "Hey – Can Okta integrate with Kong?" Spoiler alert: You totally can integrate Kong with Okta using its OpenID Connect plugin.
Read moreQuarkus is a Kubernetes-native, Java framework for building high-performance web, serverless, and native apps. It uses Ahead of Time (AOT) compilation and aggressive optimizations like classpath scanning, configuration reloading, and application bootstrap pre-configuration during the build process. This results in impressive startup performance. In other words, a Quarkus app starts…
Read moreJava has been at the forefront of microservice architectures since they came to prominence a few years ago. It's a popular language with well-known, high-quality frameworks, like Spring Boot, Spring Cloud, Spring Data, and Spring Security.
Read moreMicroProfile is an open-source community project with the goal to encourage the development of Java microservice solutions. It was created in 2016 in response to the changing needs of modern web development. In particular, it seeks to foster the development of smaller, less monolithic services (microservices) that can run on…
Read more
Ruslan Zaharov 4 min read
Those of you reading this have certainly heard of Docker. After years of hype, it has become the somewhat standard technology for everyday DevOps operations. It greatly helped to simplify deployments and testing by creating efficient, immutable images of the applications which are working in their own silo. More efficient…
Read moreToday, I'm going to show you how to plug Okta into a Force.com application (along with Mulesoft's API gateway) using the OpenID Connect protocol (aka 'OIDC').
Read moreSpring Boot and Spring Security have delighted developers with their APIs for quite some time now. Spring Security has done an excellent job of implementing OAuth and OpenID Connect (OIDC) standards for the last few years.
Read more
Micah Silverman 6 min read
Okta is an Identity Management Platform that takes all the hassle out of authentication and authorization. It's feature-packed with everything from workforce integrations for G-Suite to the latest version of OAuth 2.0 as-a-service for developers writing their own APIs.
Read moreThe microservice architecture pattern, in which business functionality is distributed among many small atomic applications as opposed to one or two monolithic chunks, is very powerful and in wide use across large and small tech companies. Each piece has a narrow, well-defined task and communicates with other services via a…
Read more Matt Raible 6 min read
The year is 1995...
Read more Matt Raible 2 min read
The Okta CLI is a new tool we've created here at Okta. It's designed to streamline the process of creating new Okta accounts, registering apps, and getting started. Wwwhhaaattt, you might say?! That's right, it's super awesome!
Read moreIn this tutorial, you're going to use Spring Boot and Spring Data to build a fully functioning web service with ridiculously little effort. You're also going to use Okta to secure the web service using professional, standards-compliant OIDC JWT authentication. All of this will be bootstrapped by the Okta CLI.
Read moreBuilding a web application involves a lot of moving pieces. You have a backend server handling API calls, a frontend application running business logic, and you need to somehow make sure both are in sync and secure.
Read moreIf you're a Java developer like me, you like to crank out code and get shit done. I like many things about IntelliJ IDEA, but I thought it'd be fun to write about the ones that make me most productive. First, a bit of my development history.
Read moreIn this tutorial, you will build your very own Nano Blogging Service (nabl for short) using a modern JVM stack. This includes using the Kotlin programming language, the Ktor web framework, and securing it with Okta. Users can log in or sign up, post updates, and browse specific or global…
Read moreSpring Boot is a ubiquitous and well-supported suite of tools for developing web applications in Java. Database authentication, in which credentials identifying authorized users are stored in a database accessible by the application, is maybe the most common and straightforward method of authenticating users. SAML is a well-supported open standard…
Read moreOkta is an Identity and Access Management platform. The TL;DR: you offload the responsibility for secure authentication and authorization to Okta so you can focus on the business logic of the app you're building.
Read moreSession management in multi-node applications presents multiple challenges. When the architecture includes a load balancer, client requests might be routed to different servers each time, and the HTTP session might be lost. In this tutorial, I'll walk you through the configuration of session sharing in a multi-node Spring Boot application.
Read moreDevelopers have cool ideas for pet projects all the time. I often have quite a clear picture of what I want to build and am ready to spend next weekend making the Next Big Thing. The weekend comes finally, and instead of building it, I find myself doing the same…
Read moreMicronaut is a new framework for developing JVM applications, including APIs and microservices. It uses ahead-of-time (AOT) compilation to compute the information that your application needs before runtime, removing the need for reflection. The result is a significant decrease in runtime overhead and startup time, and a substantial increase in…
Read moreNote: In May 2025, the Okta Integrator Free Plan replaced Okta Developer Edition Accounts, and the Okta CLI was deprecated. We preserved this post for reference, but the instructions no longer work as written. Replace the Okta CLI commands by manually configuring Okta following the instructions in our Developer Documentation.
Read moreThe topic of validating an OAuth 2.0 access tokens comes up frequently on this blog. Often we talk about how to validate JSON Web Token (JWT) based access tokens; however, this is NOT part of the OAuth 2.0 specification. JWTs are so commonly used that Spring Security supported them before…
Read moreArm processors have been in the news lately, and it's causing confusion and worries about processor performance for some folks. After Apple announced its plan to switch to Arm-based processors, I heard people (incorrectly!) speculating the performance would be similar to a Raspberry Pi. Java on Arm is nothing new,…
Read moreJava is one of the most mature and persistent development languages that exists. Recently, it shifted to a 6-month release schedule, enabling it to deliver more frequent updates to the language. One of the changes introduced in Java 9 was the modular system.
Read morePASETO is a new security token format designed to be easy to use and free from the issues inherent with JSON Web Token (JWT) related specifications. Platform Agnostic SEcurity TOkens (PASETO) is a draft RFC spec created by Scott Arciszewski. PASETO reduces the scope of the JavaScript Object Signing and…
Read moreMuch like React or Angular, Vue.js is a JavaScript view library. When coupled with a state management library like MobX, Vue.js becomes a full-featured application framework. Vue.js is designed to be incrementally adoptable, so you can use as much or as little of it as you like. Like React, Vue.js…
Read moreBuilding modern apps with Angular and Spring Boot is a common practice these days. In fact, if I use Google's Keyword Planner to look up popular search terms, it's one of the most popular combinations. The results in the list below are average monthly searches and not limited by location.
Read moreOne of the more popular combinations of frontend and backend frameworks is Angular + Spring Boot. I've written several tutorials about how to combine the two—from keeping them as separate apps to combining them into a single artifact. But, what about deployment?
Read moreServerless is the next iteration in cloud management. First, we let go of having physical hardware servers and moved all of our servers into the cloud because, hey, why bother managing all that hardware? This created cloud infrastructure providers that resulted in behemoths like Amazon and Google. Now, they're saying,…
Read moreRecently, a colleague pointed out that I was still configuring Travis-CI on new GitHub repos and suggested I used GitHub Actions instead. I had given Actions the ol' five-minute test when it was still in beta, but ran into a few problems and gave up. After all, I've been a…
Read moreI've always thought developers are a pretty rare collection of individuals. We all vary in our composition; from the quiet introverts to the boisterous extroverts, from button-downed professionals to aloof loose cannons -- we run the full spectrum of human personalities. However, we are unique in that we share a…
Read moreApache Shiro is a Java security framework that can perform authentication, authorization, session management, along with a host of other features for building secure applications.
Read moreMobile development offers a lot of options. To develop native apps, you can use Java or Kotlin on Android. On iOS, you can use Objective C or Swift. There are other options, too. You can build hybrid mobile apps and Progressive Web Apps (PWAs). Hybrid mobile apps are those created…
Read moreOn the Okta blog, we spend much of our time talking about logging in. That is because once you configure your application to log in, the log out just works. But there are a few things you should consider when you're thinking about your app's logout configuration. In this post,…
Read moreContinuous Integration (CI) is a popular development practice that helps to ensure software is high-quality and deployable, as you validate (compile and test) the software as soon as you check in changes to the Source Control Management System (SCM).
Read moreI've been a longtime fan of CSS frameworks since 2005. I led an open-source project called AppFuse at the time and wanted a way to provide themes for our users. We used Mike Stenhouse's CSS Framework and held a design content to gather some themes we liked for our users.…
Read morePASETO is the latest trend in security token formats. Its primary goal is to reduce the problems the JSON Web Token (JWT) related specifications introduce. In this post, I'll give you a brief introduction to PASETO tokens and then jump into an example that creates and parses tokens using in…
Read more
Thiago Negri 5 min read
REST APIs are hard to design so they serve multiple clients well. As each client has their own needs in terms of data searching, filtering and which fields they want, a traditional REST API will provide a single version of an entity and the client has the responsibility of navigating…
Read more
Joy Foster 11 min read
In modern app development, you quite frequently have a single resource server that provides data to multiple client applications. These applications may share a similar set of users, but need to enforce different permissions. For example, it's possible that not all users of the first application should be allowed to…
Read moreBrowser and mobile feature enhancements move fast. Often times, these technologies move faster than security standards designed to protect them can keep up. OAuth 2.0 offers the best and most mature standard for modern applications. However, there hasn't been an official release of this standard since 2012. Eight years is…
Read moreIn this tutorial, you're going to build a client and server application using React for the frontend and Kotlin with Spring Boot for the backend. You'll first build the app unsecured before securing it using Okta. To secure the React frontend, you'll use OAuth 2.0 login, and for the backend,…
Read moreDeveloping services in Java, including REST APIs, wasn't always easy or productive until Spring came along and changed the landscape. Many years have passed since then, and new frameworks have emerged in the community.
Read moreOne of the biggest challenges of adding OAuth 2.0 support to legacy applications is a lack of support in the underlying framework. Maybe it's homegrown, or maybe it's just old? Either way, migrating away from an old form-based login doesn't need to be so painful. In this post, I'll walk…
Read moreAngular is a web framework for building mobile and desktop applications. Its first version, AngularJS, was one of the first JavaScript MVC frameworks to dominate the web landscape. Developers loved it, and it rose to popularity in the early 2010s. AngularJS 1.0 was released on June 14, 2014. Angular 9…
Read moreREST is one of the most used architectural styles when it comes to developing web services. In Java, we have the JAX-RS specification that defines how to create a RESTful application. To show the power of the spec, Jersey, the reference implementation of JAX-RS was created. Building JAX-RS endpoints only…
Read moreDocker enables you to deploy a server environment in containers. A container is a standardized unit of software that assembles code, runtime, dependencies, settings, and initialization in a single package that you can run reliably from one computing environment to another. Deploying your app as a Docker container is not…
Read moreThis tutorial leverages two technologies that are commonly used to build web services: MongoDB and Java (we'll actually use Spring Boot). MongoDB is a NoSQL database, which is a generic term for any non-relational databases and differentiates them from relational databases. Relational databases, such as SQL, MySQL, Postgres, etc..., store…
Read more
Brian Demers 6 min read
Writing quality code takes practice. To write better code, you need to know what should improve. Code quality and what makes code easy to read are very subjective; ask five different developers, you will get six different answers. For this post, I'll avoid most of the subjective and focus on…
Read moreKotlin is a modern, statically typed language within the JVM. Kotlin is a cross-platform, multi-purpose, free and open-source language developed by JetBrains under the Apache 2.0 license and has constructs for both Object Oriented and Functional programming styles, which can be mixed. It can be used for web development, server…
Read moreSpring Boot is an awesome solution to speed up the development cycle of your app. Have an idea and want to transform it into a Spring Boot app, but don't know the best way to deploy it? Look no further, we will help you out!
Read moreThere has been much buzz about GraalVM and what it means for the Java world. GraalVM is a Java distribution from Oracle that adds a bunch of features, most notably a new JIT compiler, polyglot capabilities, an LLVM runtime... and the ability to turn your Java application into a native…
Read more
Andrew Hughes 6 min read
Netty is a non-blocking input/output (NIO) framework that makes it relatively simple to develop low-level network servers and clients. Netty provides an incredible amount of power for developers who need to work down on the socket level, for example when developing custom communication protocols between clients and servers. It supports…
Read moreToday's users expect your app to be accessible from their computer, mobile phone, tablet, or any other device! This transition to Software as a Service (SaaS) as the norm requires developers to effectively integrate with robust tools that scale to handle thousands (or even millions) of requests every second. Apache…
Read moreModern applications rely on user authentication, but it can present Java developers with a difficult challenge, as well as a range of framework-specific options to choose from. We have seen many Spring developers start with a simple, home-grown authentication service they plan to replace "later" with a more robust option...…
Read moreInterested in Android development? Then you should get familiar with Gradle, the only Android development build system that Google officially supports.
Read moreWebSockets is a modern transport layer technology that establishes a two-way communication channel between a client and a server, perfect for low-latency, high-frequency interactions. WebSockets tend to be used in collaborative, real-time or event-driven applications, where traditional client-server request-response architecture or long polling would not satisfy requirements. Use cases include…
Read moreQuarkus is a container-first Kubernetes Java framework designed to have a super-fast start-up time and low memory usage. The container-first strategy emphasizes packaging the runtime environment along with the application code, allowing both to be tightly optimized and avoiding the endless updates and configuration problems that can come along with…
Read moreJavaServer Faces (JSF) is a Java framework for building Web applications, centered on components as the building blocks for the user interface. JSF benefits from a rich ecosystem of tools and vendors, as well as out of the box components and libraries that add even more power.
Read more
Jimena Garbarino 5 min read
Good design principles require that microservices architectures are observable, and provide a centralized monitoring tool. This tool allows development teams to verify the overall system health, inspect logs and errors, and get feedback after deployments. So what is the Elastic (or ELK) Stack and why it is an excellent option…
Read more Brian Demers 4 min read
Apache Maven is still the most popular build tool in the Java space, thanks to the popularity of its ecosystem of plugins. It's easy to find an existing plugin to do almost anything your application needs, from ensuring your source files have license headers, to validating binary compatibility between versions.…
Read moreIn 2011, JetBrains, the company behind IntelliJ, decided to create a modern language that would run inside the Java Virtual Machine and address common concerns with Java at the time like its verbosity. This project became Kotlin, a quickly growing and popular language.
Read more Andrew Hughes 13 min read
In the Java world, there are two main build systems: Gradle and Maven. A build system chiefly manages potentially complex webs of dependencies and compiles the project. It also packages the compiled project along with all the resources and meta files into the final .war or .jar file. For simple…
Read moreSo you wanna go full reactive, eh? Great! Reactive programming is an increasingly popular way to make your applications more efficient. Instead of making a call to a resource and waiting on a response, reactive applications asynchronously receive a response. This allows them to free up processing power, only perform…
Read more Brian Demers 4 min read
My favorite way to test Java code is with Groovy. Specifically, writing tests in Groovy with Hamcrest. In this post, I'll walk through how to test a simple Spring Boot application with these tools.
Read moreJavaFX, a library of user interaction controls, allows Java developers to build cross-platform desktop applications and internet application. It was intended as a replacement for Swing (if you're old like me and remember that).
Read moreDocker is a very popular system for containerizing applications. Containerization packages the executable code along with the runtime environment in deployable virtual images using a repeatable, automatable process.
Read moreNearly all applications rely on authentication. Developers, and the companies that employ them, want to confirm who is making the request and are they who they say they are. And, this needs to happen fast enough for a good user experience. Fortunately, there are great tools to help.
Read more Joy Foster 6 min read
It can be very satisfying to build an application "the hard way", using few conveniences. This approach helps you understand core development principles and the inner workings of everyday abstractions. That's why today, you'll build an application from the ground up using Java Servlets with a login form.
Read moreHave you worked with Spring Boot Actuator yet? It's an immensely helpful library that helps you monitor app health and interactions with the app - perfect for going to production! Spring Boot Actuator includes a built-in endpoint for tracing HTTP calls to your application - very useful for monitoring OpenID…
Read more Matt Raible 8 min read
Java turned 24 years old on May 23, 2019. That's pretty old for a programming language. The fact that it's still widely used and runs many of the world's largest organizations is nothing short of incredible. But it has a unique impression problem among languages in that it means two…
Read moreIn this post, you will learn how to build a simple REST API using Eclipse MicroProfile and secure it using JSON Web Token (JWT) authentication. You'll also use a free developer account from Okta to configure an OAuth 2.0 / OpenID Connect (OIDC) application as the OAuth provider, with role-based…
Read moreIn this post, we will walk through how to build a simple CRUD application using Spring Boot, MySQL, JPA/Hibernate and Okta OpenID Connect (OIDC) Single Sign-On (SSO).
Read moreI'm a big fan of Ionic. I started using it several years ago when it was based on AngularJS. As a developer, I really liked it because I knew Angular. I found didn't have to learn much more to be a productive developer with Ionic.
Read moreThis tutorial will explore two ways to configure authentication and authorization in Spring Boot using Spring Security. One method is to create a WebSecurityConfigurerAdapter and use the fluent API to override the default settings on the HttpSecurity object. Another is to use the @PreAuthorize annotation on controller methods, known as…
Read moreAuthentication is vital to all but the most basic web applications. Who is making the request, wanting data, or wanting to update or delete data? Can you be sure that the request is coming from the stated user or agent? Answering this question with certainty is hard in today's computer…
Read moreOur customers here at Okta expect a highly-available service that is always there when they need it. We've worked hard to design a service architecture that allows us to deploy code and do maintenance without disrupting our customers in any way.
Read more
Lindsay Brunner 3 min read
Spring Boot, and the Spring framework in general, are the core tools for the modern Java developer. They abstract away many nuances of development and architecture, allowing you to focus on building your business logic, aka, the parts of your app that will move the needle for your organization.
Read moreDeveloping a microservice architecture with Java and Spring Boot is quite popular these days. It's definitely one of the most popular combinations in the Java ecosystem. If you need any proof, just look at all of the similar frameworks that have cropped up in the last few years: MicroProfile, Micronaut,…
Read moreJava is a great language to use when developing a microservice architecture. In fact, some of the biggest names in our industry use it. Have you ever heard of Netflix, Amazon, or Google? What about eBay, Twitter, and LinkedIn? Yes, major companies handling incredible traffic are doing it with Java.
Read moreIn this post, you're going to work through various options for implementing a login feature using Spring Boot 2.1. You'll start with the most simple, basic auth, which you'd likely never want to use except for perhaps an internal backend tool, and move on to a simple form-based authentication page.…
Read moreIf you've been a Java developer for more than 15 years, you probably remember when there were a plethora of Java web frameworks. It started with Struts and WebWork. Then Tapestry, Wicket, and JSF came along and championed the idea of component-based frameworks. Spring MVC was released in 2004 (in…
Read moreDeploying applications is hard. Often you need console access to the server from which you pull the latest code and then manually instantiate into your container. In this tutorial you'll see an easier way using Tomcat: you'll create an authenticated web app and deploy it through the browser using the…
Read more Matt Raible 7 min read
Using unit and integration tests to verify your code quality is an excellent way to show you care about your code. I recently did a bunch of work in the popular JHipster open source project to upgrade it to use the latest release of Spring Security.
Read moreThere's a lot going on in the Java ecosystem lately. Now that major Java versions are released every six months, it can be difficult to keep up. Personally, I develop the majority of my Java applications using Spring Boot. Because of this, I was stuck on Java 8 until Spring…
Read moreIn this tutorial, you're going to use Kubernetes to deploy a Spring Boot microservice architecture to Google Cloud, specifically the Google Kubernetes Engine (GKE). You're also going to use Istio to create a service mesh layer and to create a public gateway. The whole thing is going to be secured…
Read moreIn this post, you'll walk through how to build a simple Spring Boot application and test it with Junit 5. An application without testing is the proverbial Pandora's Box. What good is your application if you don't know that it will work under any condition? Adding a suite of tests…
Read moreWhen building a web application, authentication and authorization is a must. Doing it right, however, is not simple. Computer security is a true specialty. Legions of developers work day and night against equally numerous international hackers creating a continual development cycle of finding vulnerabilities, attacking them, and fixing them. Keeping…
Read moreBuilding a microservices architecture is possible with minimal code if you use Spring Boot, Spring Cloud, and Spring Cloud Config. Package everything up in Docker containers and you can run everything using Docker Compose. If you're communicating between services, you can ensure your services are somewhat secure by not exposing…
Read more Micah Silverman 9 min read
Spring Boot 1.5.x made it easier than ever before to integrate Spring Security with OAuth 2.0 into your application. Spring Boot 2.1.x dials it up to 11 by making OpenID Connect a first class citizen in the stack.
Read moreIn this post, you'll learn about microservices architecture and how to implement it using Spring Boot. After creating some projects with the technique, you will deploy the artifacts as Docker containers and will simulate a container orchestrator (such as Kubernetes) using Docker Compose for simplification. The icing on the cake…
Read moreWhat are i18n and l10n? Internationalization (i18n) is the process of making your application capable of rendering its text in multiple languages. Localization (l10n) means your application has been coded in such a way that it meets language, cultural, or other requirements of a particular locale. These requirements can include…
Read moreReactive apps allow you to scale better if you're dealing with lots of streaming data. They're non-blocking and tend to be more efficient because they're not tying up processing while waiting for stuff to happen.
Read moreNote: In May 2025, the Okta Integrator Free Plan replaced Okta Developer Edition Accounts, and the Okta CLI was deprecated. We preserved this post for reference, but the instructions no longer work as written. Replace the Okta CLI commands by manually configuring Okta following the instructions in our Developer Documentation.
Read moreSocial login is a great way to offer your customers a simple and secure authentication method. Why force them to create and forget yet another password? The vast majority of your users will have an account with Facebook or Google, so why no go ahead and let them use one…
Read moreNote: In May 2025, the Okta Integrator Free Plan replaced Okta Developer Edition Accounts, and the Okta CLI was deprecated. We preserved this post for reference, but the instructions no longer work as written. Replace the Okta CLI commands by manually configuring Okta following the instructions in our Developer Documentation.
Read more Matt Raible 9 min read
There has been a lot of confusion lately about Java and its available SDKs (Software Development Kits). You might've heard the Java SDK called the JDK. They're one and the same. Java SE (Standard Edition) is a specification that's governed by the JCP (Java Community Process). This process decides what…
Read more
Raphael do Vale 4 min read
"If it is useful, it will be modified." Those words of wisdom came from a QA teacher of mine, to explain that all software evolves when it becomes useful to someone, and for as long as it is useful. We all know this. Users ask us for new features, bug…
Read moreEvery non-trivial application needs a way to save and update data: a resource server that is accessible via HTTP. Generally, this data must be secured. Java is a great language with decades of history in professional, enterprise development, and is a great choice for any application's server stack. Within the…
Read more Matt Raible 4 min read
I started programming in Java way back in 1999. I had just started a job as the director of web development at a small startup called eDeploy.com. I wrote a lot of HTML, CSS, and JavaScript for a SaaS product that helped companies install network equipment. The backend for our…
Read moreVue is a web framework that's gotten a lot of attention lately because it's lean and mean. Its baseline framework cost is around 40K and is known as a minimalistic web framework. With all of the recent attention on web performance and mobile-first, mobile-fast, it's no surprise that Vue has…
Read moreSpring Boot 2.1 was recently released, eight months after the huge launch of Spring Boot 2.0. The reason I'm most excited about Spring Boot 2.1 to me is its improved performance and OpenID Connect (OIDC) support from Spring Security 5.1. The combination of Spring Boot and Spring Security has provided…
Read moreJava support for JWT (JSON Web Tokens) used to require a lot of work: extensive customization, hours lost resolving dependencies, and pages of code just to assemble a simple JWT. Not anymore!
Read moreJSON Web Tokens have quickly become the standard for securing web applications, superseding older technologies like cookies and sessions. Used properly, they address a range of security concerns, including cross-site scripting attacks (XSS), man-in-the-middle attacks (MITM), and cross-site request forgery (CSRF). They also give us the benefit of inspectable metadata…
Read moreReact Native is a framework for building mobile applications with React. React allows you to use a declarative style of programming to describe how your UI should look. It uses embedded HTML (called JSX) to render buttons, lists, scrollable views, and many other components.
Read moreWhen's the last time you had fun building a web application? We love Spring Boot because it makes it super easy to build a rich Java web application, and it can even be pretty fun. By combining Spring, Spring Boot, and Gradle, we have a complete build system that can…
Read moreDevelopers know that securing web apps can be a pain. Doing it right is tough. The worst part is that "right" is a moving target. Security protocols change. Vulnerabilities are found in dependencies and patches are released. Tons of often complex boilerplate code has to be generated. The software-as-service paradigm…
Read moreSpring WebFlux can be used to create a REST API with streaming data. Spring WebFlux can also be integrated with WebSockets to provide notifications that clients can listen to. Combining the two is a powerful way to provide real-time data streaming to JavaScript or mobile clients. Add React to the…
Read more Matt Raible 25 min read
Spring Boot 2.0 was a long-awaited release from the good folks at Pivotal. One of its new features is reactive web programming support with Spring WebFlux. Spring WebFlux is a web framework that's built on top of Project Reactor, to give you asynchronous I/O, and allow your application to perform…
Read moreReactive programming allows you to build systems that are resilient to high load. Handling lots of traffic isn't a problem because the server is non-blocking and doesn't block client processes to wait for responses. The client cannot directly observe, or synchronize with, the execution that occurs on the server. When…
Read moreJava EE allows you to build Java REST APIs quickly and easily with JAX-RS and JPA. Java EE is an umbrella standards specification that describes a number of Java technologies, including EJB, JPA, JAX-RS, and many others. It was originally designed to allow portability between Java application servers, and flourished…
Read moreKotlin was recently given official Android support status by Google, but it remains difficult to understand for many developers. The best way to start is by creating a complete app yourself, which you'll do in this tutorial. In this tutorial, you'll use Spring Boot for the API that powers your…
Read moreTechnology moves fast these days. It can be challenging to keep up with the latest trends as well as new releases of your favorite projects. I'm here to help! Spring Boot and Angular are two of my favorite projects, so I figured I'd write y'all a guide to show you…
Read moreGraphQL is a data query language developed by Facebook in 2012 to solve a shortcoming of REST APIs and traditional database models. All too often, when programmers write REST API data queries, they default to retrieving entire data structures when they need only a part of it. For example, if…
Read moreSpring Boot has dramatically simplified the development of Spring applications. Its autoconfiguration and starter dependencies reduce the amount of code and configuration you need to begin an app. If you were used to Spring and lots of XML back in the day, Spring Boot is a breath of fresh air.
Read moreWe've all seen social login. It's the "Log in with Facebook" or "Log in with Twitter" buttons we see below every username and password field on the Internet. But why do these exist?
Read moreA lot has happened in the last five years of software development. What it means to build, deploy, and orchestrate software has changed drastically. There's been a move from hosting software on-premise to public cloud and shift from virtual machines (VMs) to containers. Containers are cheaper to run than VMs…
Read moreAt its core, React is just a UI toolkit, ala GWT, but it has a very healthy ecosystem around it that provides everything you need to build a kick-ass progressive web app (PWA). PWAs are cool because if they're done right, they can offer a native-like experience for your users,…
Read moreI've written several posts on this blog that show you how to develop an Angular SPA (single-page application) that talks to a Spring Boot API. In almost all of them, I've used OAuth 2.0's implicit flow and built, tested, and deployed them as separate applications. IMHO, this is the way…
Read moreOAuth 2.0 has quickly become an industry standard for third party authentication for web applications. It's a super secure strategy, when implemented properly, but getting it right can be hard. Fortunately, you don't have to go it alone. Okta has done it for you. This is one place where it's…
Read moreGrails and Groovy can be a great alternative to Spring Boot, in some specific use cases. In this post, we'll start with that basic Grails app that already has secure authentication via Okta, and add some additional features. In this tutorial you will:
Read moreSpring Boot has experienced massive adoption over the last several years. For Spring users, it offers a breath of fresh air, where they don't have to worry about how things are configured if they're comfortable with defaults. The Spring Boot ecosystem is filled with a wealth of what they call…
Read more Matt Raible 17 min read
Writing apps with Spring Boot and Ionic (which is built on Angular) can be fun because both frameworks offer a good developer experience (DX). You change a file, save it, and the app automatically reloads with your changes. This feature is often called hot-reload and it's a blissful way to…
Read moreWhat is Grails, what is Groovy, and why would we choose them over Spring Boot? In this post I'll walk you through implementing server-side authentication in Grails using OAuth 2.0 and Okta. Before we dive in, however, I want to talk a little bit about why you'd be using Grails…
Read moreMost OAuth 2.0 guides are focused around the context of a user, i.e., login to an application using Google, GitHub, Okta, etc., then do something on behalf of that user. While useful, these guides ignore server-to-server communication where there is no user and you only have one service connecting to…
Read moreDropwizard is recognized as the pioneer in turn-key Java API frameworks, and rivals Spring Boot for ease of adoption. Whether you're interested in trying it out for the first time, or already have a mature platform built on top of Dropwizard, you can add secure authentication to your site in…
Read moreJHipster is a development platform to generate, develop, and deploy Spring Boot + Angular web applications and Spring microservices. It supports using many types of authentication: JWT, session-based, and OAuth 2.0. In its 5.0 release, it added React as a UI option.
Read more Matt Raible 7 min read
Building a microservices architecture with Spring Boot and Spring Cloud can allow your team to scale and develop software faster. It can add resilience and elasticity to your architecture that will enable it to fail gracefully and scale infinitely. All this is great, but you need continuous deployment and excellent…
Read moreWe 💙 Ionic, JHipster, and Java here at Okta. Ionic is a framework for building native mobile apps using web technologies. Technically, this is called a "hybrid" app because it's not using native SDKs. Hybrid mobile apps are distributed just like native apps: they can be installed on mobile devices,…
Read moreLocal Storage is a JavaScript API technically known as localStorage that arrived with HTML5. It allows you to store information on a user's browser quickly and easily. There are many debates on the web as to whether it's better than cookies. Some say it's faster (because it doesn't send data…
Read moreVert.x has continued to gain traction as a contender to the Spring ecosystem, largely due to improved performance and its polyglot accessibility. Fortunately, securing a Vert.x server with industry-leading authentication and authorization is almost as quick and easy as it is in Spring! In just a few minutes, you can…
Read moreSpring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications.
Read moreReact has been getting a lot of positive press in the last couple years, making it an appealing frontend option for Java developers! Once you learn how it works, it makes a lot of sense and can be fun to develop with. Not only that, but it's wicked fast! If…
Read moreNOTE: The video and code in this post has just been updated for 2021!
Read moreTechnology moves fast these days. It can be challenging to keep up with the latest trends as well as new releases of your favorite projects. I'm here to help! Spring Boot and Angular are two of my favorite projects, so I figured I'd write y'all a guide to show you…
Read moreNeed a secure web server right now? With Spring Boot and Okta, you can spin up an enterprise-quality REST server with complete user identity and authorization management in less than 20 minutes. Out of the box, Spring Boot and its Starter packages supply a near instant production-ready Tomcat server, and…
Read moreI've fallen in love with Play Framework in the past, but then found a more attractive framework in Spring Boot. I fell in love partly because Play was new and sexy at the time, but also because it's "live reloading" of Java code was a killer feature I'd been looking…
Read moreIf you have a JavaScript single-page application (SPA) that needs to securely access resources from a Spring Boot application, you likely want to use the OAuth 2.0 implicit flow! With this flow your client will send a bearer token with each request and your server side application will verify the…
Read moreSingle sign-on (SSO) is a feature that most developers don't care about when building one-off applications for clients or themselves. However, when developing apps for their company, which will be used by employees of their business, they often need to hook into an existing identity provider. It might be Active…
Read more Micah Silverman 6 min read
User management functions are required by a wide variety of apps and APIs, and it's a common use-case to partition access to parts of an application according to roles assigned to a user. This is the basis of role-based access control (RBAC). Okta manages these roles with groups. Users can…
Read moreLast month, I wrote about NoSQL Options for Java Developers. I analyzed the data available from a variety of sources (Indeed jobs, GitHub stars, Stack Overflow tags) to pick the top five options: MongoDB, Redis, Cassandra, Neo4j, and PostgreSQL. After writing this article, I shared it with a few experts…
Read moreA "hipster" is defined as a person who is exceptionally aware of or interested in the latest trends and tastes. JHipster is an open source project whose name stands for "Java Hipster." If you're using JHipster, chances are you're aware of and using the latest trends and techniques in Java…
Read moreI love my job as a developer advocate at Okta. I get to learn a lot, write interesting blog posts and create example apps with cool technologies like Kotlin, TypeScript, Spring Boot, and Angular, which I'm about to demo. When it comes to writing Hello World apps with authentication, I…
Read more Matt Raible 8 min read
The Java community is one I know and love, so even though a NoSQL database is rarely tied to a language I'm writing this article for you, Java developers around the world. In this article, I'll show you several options for NoSQL databases. After exploring all the options, I'll narrow…
Read more Brian Demers 3 min read
Developers use APIs to for everything! You build APIs for your own apps to consume, or as a part of a microservices architecture. Bottom line, you're building and using APIs to make your life easier. The ongoing effort to simplify development and work more efficiently, sometimes this also means looking…
Read moreNeed to decouple your web service and client? You're probably using REST endpoints, and if you're a Java shop you've probably tried out JAX-RS, Spring REST, or both. But is one better than the other? In this post I'll go over the differences between the two using basically the same…
Read more Matt Raible 5 min read
You've built a microservices architecture with Spring Boot and Spring Cloud. You're happy with the results, and you like how it adds resiliency to your application. You're also pleased with how it scales and how different teams can deploy microservices independently. But what about security?
Read moreMy favorite thing about Apache Shiro is how easy it makes handling authorization. You can use a role-based access control (RBAC) model of assigning roles to users and then permissions to roles. This makes dealing with the inevitable requirements change simple. Your code does not change, just the permissions associated…
Read moreJHipster is one of those open-source projects you stumble upon and immediately think, "Of course!" It combines three very successful frameworks in web development: Bootstrap, Angular, and Spring Boot. Bootstrap was one of the first dominant web-component frameworks. Its largest appeal was that it only required a bit of HTML…
Read moreAdopting a microservice architecture provides unique opportunities to add failover and resiliency to your systems, so your components can handle load spikes and errors gracefully. Microservices make change less expensive too. It can also be a good idea when you have a large team working on a single product. Your…
Read moreYou're developing a Progressive Web Application (PWA), and your service worker and web app manifest are working swimmingly. You've even taken the time to deploy it to a server with HTTPS, and you're feeling pretty good about things. But wait, you don't have any way of knowing who your users…
Read moreYou already know that building APIs with Spring Boot is incredibly easy. But, your API isn't complete without a UI, right? Well, building UIs with Ionic is pretty easy too, especially if you know Angular!
Read moreAn October 2016 DoubleClick report found 53% of visits are abandoned if a mobile site takes more than 3 seconds to load. That same report said the average mobile sites load in 19 seconds. According to Alex Russell in his recent talk on the state of mobile development, one of…
Read moreTo simplify development and deployment, you want everything in the same artifact, so you put your Angular app "inside" your Spring Boot app, right? But what if you could create your Angular app as a standalone app and make cross-origin requests to your API? Hey guess what, you can do…
Read moreIf you're building a Spring Boot application, you'll eventually need to add user authentication. You can do this with OAuth 2.0 (henceforth: OAuth). OAuth is a standard that applications can use to provide client applications with "secure delegated access". It works over HTTP and authorizes devices, APIs, servers, and applications…
Read more
Matt Loughran 4 min read
This post describes our odyssey with ActiveMQ, an open-source version of the Java Messaging Service (JMS) API. We use ActiveMQ as the message broker among our app servers.
Read more
Victor 2 min read
This is the third of a four part series on Android Unit Testing. In the last two articles I discussed the general principles of having good tests and the way to run Android tests on JVM making them fast and how to make your code less coupled. This article will…
Read moreThis is the third of a four part series on Android Unit Testing. In the last two articles I discussed the general principles of having good tests and the way to run Android tests on JVM making them fast. This part will show how to make your Android code less…
Read moreThis is the second of a four part series on Android Unit Testing. In these posts, we'll walk through the key steps engineers should take to make Android test fast by running them on JVM (versus running them on emulator).
Read more
Aasawari Sahasrabuddhe 
Gagan Sikri 
Alex Silk 
Michael Palermo 
Zahwah Jameel 
Layo Folaranmi 
Jeff Taylor 
Aaron Parecki 
John Gramila 
Karl Hughes 
Joyce 
Joe Cavazos 
Daniel Petisme 
Jefferson Haw 
Bruno Leite 
Chris Gustafson 
Daniel Pereira 
Mikel Pascual 
Karl Penzhorn 
Silas Brazil