jlinks

app-1 will provide a copy of his public key to app-2 and signs the communication with its private key. Step 1: app-1 creates private/public key pair in its keystore: $ keytool -genkey -alias "app-1-key" -keystore app-1.jks Verify: $ keytool -v -list -keystore app-1.jks Step 2: app-1 generates a certificate file from its private keystore: $ keytool -export -alias "app-1-key" -file app-1.cer -keystore app-1.jks Step 3: app-2 imports the public key of app-1 into its keystore: $ keytool -import -alias "app-1-publickey" -file app-1.cer -keystore app-2-publickey.store

A puts an envelope in a box, locks the box with his key and sends it to B. The box can't be opened on the way, since it is locked. B receives the box, and accepts to view it. But can't open the box neither, since it is locked. B lockes the box again, this time with his own lock and sends it back to A. The box is now locked with 2 locks, one from A, and one from B. A receives the box and realizes, that B has accepted the communication by locking the box with his lock.  A can now remove his lock and send the box back to B.  The box still can't be opened by anyone other than B. B receives the box with his lock and can now open the box with his own key and open the envelope sent by A originally. For A and B to trust each others locks (certificates), a Certificate Authority (CA) must approve both certificates. See also: https://www.codeproject.com/Articles/326574/An-Introduction-to-Mutual-SSL-Authentication

An introduction to OAuth with Spring Boot: https://dzone.com/articles/build-a-secure-spa-with-spring-boot-and-oauth

"An open protocol to allow secure authorization in a simple and standard method from web, mobile and desktop applications...."   https://oauth.net/ Further links: OAuth Introduction Create your own REST API Using OAuth Authentication - DevX   OAuth for REST APIs - Atlassian

JPA Security is an Access Control Solution for the Java Persistence API (JPA) http://jpasecurity.sourceforge.net/index.html

Never trust user input and always filter metacharacters. This will eliminate the majority of XSS attacks. Converting < and > to &lt; and &gt; is also suggested when it comes to script output. Remember XSS holes can be damaging and costly to your business if abused. Often attackers will disclose these holes to the public, which can erode customer and public confidence in the security and privacy of your organization's site. Filtering < and > alone will not solve all cross site scripting attacks. It is suggested you also attempt to filter out ( and ) by translating them to &#40; and &#41;, " to &#34;, ' to &#39, and also # and & by translating them to &#35 (#) and &#38 (&).