Secure ColdBox and BoxLang apps with annotation-based access control and JWT authentication.
npx skills add https://github.com/ColdBox/skills --skill cbsecurity
Please help me install this Agent Skill. Skill: cbsecurity Source: https://github.com/ColdBox/skills/tree/main/modules/cbsecurity Command: npx skills add https://github.com/ColdBox/skills --skill cbsecurity
Provides a structured, production-ready approach to authenticate and authorize ColdBox and BoxLang applications, removing the guesswork from securing handlers, routes, and APIs.
Install and enable the cbsecurity module, configure firewall rules and JWT settings, and annotate handlers or apply JwtAuthFilter to protect your routes.
High-intent search queries and answers about installing and using this skill.
Annotation-based access control secures ColdBox handlers by applying security rules directly to handlers and actions, keeping authorization logic close to the code. You configure the cbsecurity module and annotate handlers to enforce role or permission checks.
The best way to configure JWT authentication for a ColdBox REST API is using the cbsecurity module's JwtAuthFilter. It handles token issuance, refresh, logout, and optional token storage for revocation to protect your API endpoints.
Firewall rules protect specific routes like an admin panel in ColdBox by applying broad security configurations to URL prefixes. You can secure /admin routes while whitelisting public assets and enforcing JWT authentication on protected paths.
JWT authentication in ColdBox supports token revocation through optional token storage with CacheBox. This production hardening feature allows you to invalidate tokens before their expiration and enforce secure logout.
You need an IUserService implementation to enforce roles and permissions in ColdBox. It integrates with the centralized security context to validate user credentials against your application's specific authorization rules.
ColdBoxImplement WebAuthn passkey registration and authentication in ColdBox applications.
SparkymodEnforce role-based access control with `[MustHavePermission]` on endpoint handlers.
mrigsbyAutomate ColdBox route definitions and RESTful API endpoints via scripts.
jpoutrinImplement OAuth 2.0 and OpenID Connect authorization code flows with PKCE.