CoSecMulti-Tenant Reactive Security Framework

RBAC-based and Policy-based access control for JVM applications, inspired by AWS IAM

Get Started

Deep Dive

GitHub

🛡️

Policy-Based Authorization

AWS IAM-inspired deny-first evaluation engine. Composable policies with ActionMatcher and ConditionMatcher SPI.

⚡

Fully Reactive

Built on Project Reactor with Mono-based auth chain. Integrates with WebFlux, WebMvc, and Spring Cloud Gateway.

🏢

Multi-Tenant Native

First-class tenant support with TenantPrincipal, tenant-scoped policies, and role-based permissions per space.

🔑

JWT & Social Auth

JWT token lifecycle with refresh tokens, plus OAuth social login via JustAuth with 20+ providers.

🔌

Extensible SPI

Java ServiceLoader-based extension points for custom ActionMatcher and ConditionMatcher implementations.

📊

OpenTelemetry Tracing

Distributed tracing with detailed span attributes for authorization decisions, matched policies, and roles.

Quick Start

kotlin

// build.gradle.kts
implementation("me.ahoo.cosec:cosec-spring-boot-starter:<version>")

yaml

# application.yaml
cosec:
  jwt:
    algorithm: hmac256
    secret: your-secret-key-here
  authorization:
    local-policy:
      enabled: true
      init-repository: true

Tech Stack

Technology	Version	Purpose
Kotlin	2.3.20	Primary language
Java	17	Target JVM
Spring Boot	4.0.5	Application framework
Project Reactor	-	Reactive programming
auth0/java-jwt	4.5.1	JWT token handling
CoCache	4.0.2	Distributed Redis caching
JustAuth	1.16.7	OAuth social authentication
OpenTelemetry	2.26.1	Observability tracing