cbsecurity

What problem does it solve?

Provides a structured, production-ready approach to authenticate and authorize ColdBox and BoxLang applications, removing the guesswork from securing handlers, routes, and APIs.

Core Features & Use Cases

• Annotation-based authorization for handlers and individual actions to keep security rules close to code.
• Firewall rules and route-level security to broadly protect URL prefixes like /admin and public asset whitelisting.
• JWT API authentication with token issuance, refresh, logout, and optional token storage for revocation.
• Role and permission checks via a centralized security context and IUserService integration.
• Production hardening guidance such as storing secrets in environment variables, short token lifetimes, and revocation strategies.

Quick Start

Install and enable the cbsecurity module, configure firewall rules and JWT settings, and annotate handlers or apply JwtAuthFilter to protect your routes.