Winter Security: Planned Application Security Module

Winter Security is a planned module. The name is reserved in the suvera/winter-modules package, but no code ships yet.

Caution

Do not add a security module to modules: in application.yml — there is no module class to load yet.

Watch the winter-security directory on GitHub for updates. This page will document configuration and usage once the module is released.

Securing an application today

Until then, handle security in your own code:

• Authenticate requests with an interceptor before they reach the controller.
• Enforce authorization with a custom AOP attribute on controller or service methods — see the RBAC and ABAC guides for complete examples.
• Keep logins in sessions, stored in your database or Redis.