Authentication Refactoring and Legacy Migration

Tasks

• •Reorganized authentication responsibilities scattered across PHP sessions and frontend token issuance into a Java/Spring-based authentication server
• •Migrated to server-side JWT authentication and applied Refresh Token Rotation
• •Moved JWT signing from HS256 to an RS256/JWKS model and designed a GCP KMS signing flow with `kid`-based key rotation
  • •Distributed only public keys to verification services and restricted signing authority to the authentication server and KMS permissions
  • •Kept a legacy decoder that temporarily accepted existing HS256 tokens to enable a no-downtime migration
  • •Defined a key-rotation order that considered JWKS cache TTL and access-token expiration
• •Migrated PHP legacy features such as authentication, user management, and API routing to Java to remove dual PHP/Java operation
• •Resolved a security issue where PHP session problems could expose another user's account information
• •Established a Spring OAuth2-based authentication flow
  • •Configured a flow that exchanges external login results for service-owned tokens
  • •Prepared an extensible structure for adding authentication providers
  • •Improved maintainability and operations efficiency by consolidating authentication into service-owned OAuth

Achievements

• •Consolidated authentication responsibilities from frontend and PHP into a Java/Spring authentication server
• •Separated signing authority and verification authority so multiple services can verify tokens with public keys

Related Posts