Articles
Reference pages answer “how do I configure this”. These answer “why is this hard in the first place”, and they are readable without taking the dependency.
- An OAuth2 BFF for a single-page application, end to end: what the pattern actually requires once you leave the diagram, and the six Spring Security behaviours a browser-based frontend needs which the defaults do not provide.
- One refresh token flow at a time: why rotating refresh tokens produce random
401s under parallel requests, why Spring Security declined to solve it, and what a correct de-duplication has to get right.
Three tutorials from this repository are published on Baeldung: Getting started with Keycloak and Spring Boot, Creating an OAuth2 BFF with spring-cloud-gateway, and Testing access control with mocked OAuth2 authentications.