This website requires JavaScript.
Authentication Flow (Spring Session JDBC, behind Caddy reverse proxy) Authentication Flow (Spring Session JDBC, behind Caddy reverse proxy) User Browser Caddy .TLS termination. Frontend .SvelteKit. Backend .Spring Boot. DB User User Browser Browser Caddy (TLS termination) Caddy (TLS termination) Frontend (SvelteKit) Frontend (SvelteKit) Backend (Spring Boot) Backend (Spring Boot) DB DB Phase 1 of the auth rewrite (ADR-020 / #523). Replaces the Basic-credentials-in-cookie model with an opaque server-side session id (fa_session). Login Enter email + password HTTPS POST /?/login (form action) Caddy terminates TLS and forwards to Frontend over HTTP with: X-Forwarded-Proto: https X-Forwarded-For: <client IP> X-Forwarded-Host: archiv.raddatz.cloud HTTP POST /?/login + X-Forwarded-Proto: https POST /api/auth/login {email, password} + X-Forwarded-Proto: https server.forward-headers-strategy: native → request.getScheme() = "https" → Secure cookie flag set automatically. AuthenticationManager authenticate(email, password) SELECT user WHERE email=? AppUser + groups + permissions BCrypt.matches(password, hash) (timing-safe: dummy hash on miss) getSession(true).setAttribute( SPRING_SECURITY_CONTEXT, ctx) INSERT spring_session + spring_session_attributes AuditService.log(LOGIN_SUCCESS, {userId, ip, ua}) 200 OK — AppUser Set-Cookie: fa_session=<opaque>; Path=/; HttpOnly; SameSite=Strict; Secure Parse Set-Cookie, re-emit fa_session (matches backend attrs) 303 → / Set-Cookie: fa_session=<opaque> HTTPS 303 + Set-Cookie Authenticated request HTTPS GET / Cookie: fa_session=<opaque> HTTP GET / + Cookie + X-Forwarded-Proto: https hooks.server.ts reads fa_session GET /api/users/me Cookie: fa_session=<opaque> SELECT * FROM spring_session WHERE SESSION_ID = ? row (or null if expired) alt [Session valid] UPDATE spring_session SET LAST_ACCESS_TIME = now 200 OK — AppUser rendered page HTTPS 200 [Session expired (idle > 8h) or unknown] 401 Unauthorized hooks: delete fa_session cookie 302 → /login?reason=expired HTTPS 302 Logout HTTPS POST /logout HTTP POST /logout Cookie: fa_session=<opaque> POST /api/auth/logout Cookie: fa_session=<opaque> session.invalidate() SecurityContextHolder.clearContext() DELETE FROM spring_session WHERE SESSION_ID = ? AuditService.log(LOGOUT, {userId, ip, ua}) 204 No Content cookies.delete('fa_session') 303 → /login HTTPS 303 (cookie cleared)
3438260090