Vigil is a Spring Boot starter for application-owned JWT authentication. Read system boundaries before integrating it into an application.
-
Authentication guide — configure JWTs, cookies, Spring Security, tenants, and reset tokens.
-
Async and streaming security — preserve stateless authentication across MVC redispatches.
-
Configuration reference — every
vigil.*property and its defaults. -
Compatibility reference — certified platform and dependency versions.
-
System boundaries — understand ownership and extension points before integrating.
-
Java API contract — public services, SPIs, and compatibility expectations.
-
Step-up proof decision — why approvals are opaque and server-consumed.
-
Enrollment decision - why email contact verification is opt-in, route-free, and host-owned.
-
Enrollment proof-format decision - why manual codes are a closed opt-in format with keyed digests.
-
Pending password-state decision - why hosts may choose form order but must bind credential activation to continuity.
-
Contact enrollment guide - integrate explicit host-owned contact verification without routes or credentials in Vigil.
- Security model — security controls, threat assumptions, and secret-handling rules.
- Password-login protection — sources, design, and limits of
PasswordLoginGuard. - Step-up authorization — one-time authorization proofs and personal PIN integration.
- Deployment and operations — production configuration, key rotation, and multi-instance requirements.
- Testing and verification — local gates and integration coverage.
- Release policy — compatibility, versioning, and publication controls.
The root README is the concise package landing page. This index is the canonical navigation surface for repository documentation.