Safe JavaEE authentication implementation using client-side asymmetric encryption
- Asymmetric client-side encryption (RSA) of user credentials. (Thanks to jsencrypt)
- Server-side (Database) salted password hashing. (PBKDF2)
- Least possible JVM memory leakage of raw password.
- Cross RDBMS compatibility. (Thanks jOOQ!)
- As a SNAPSHOP version, SQLite used as backend database; use
modelgen/generate.sh
to generate database schema ($HOME/safeauth.db
) and jOOQ entity classes. Feel free to edit database schema script atmodelgen/skel.sql
and then update changes usinggenerate.sh
. - I'd used OracleJDK 1.8.0_144, Netbeans 8.2 as IDE, Glassfish 4.1 as web server. It seems there's acceptable stability on GNU/Linux operating systems. (Windows® not tested)