Open-source alternatives to Spring Security

Security-101 is a vendor-agnostic, foundational cybersecurity learning curriculum organized into modular, framework-aligned modules. It is designed to build core knowledge across multiple security domains without tying content to specific products or platforms, making it suitable for both beginners and professionals seeking a structured introduction to the field. The curriculum is built around established security frameworks, including the MITRE ATT&CK framework for standardized threat analysis and the NIST Cybersecurity Framework for incident response workflows. It covers a broad range of do

This project is a reference implementation and a collection of code samples for deploying the Apache Shiro security framework within Java-based web applications. It serves as a demonstration for implementing authentication, authorization, and user identity management. The implementation features distributed session management to coordinate user states across multiple server instances for high availability. It also includes samples for third-party OAuth2 integration, enabling external account authentication, and single sign-on support to grant access to multiple related applications. The proj

LoopBack Next is a Node.js API framework used for building REST and multi-protocol APIs. It functions as an OpenAPI server implementation that can either generate machine-readable specifications from code or produce implementation controllers and models from existing specifications. The framework distinguishes itself through a central dependency injection container and a repository-pattern data access layer. This architecture decouples application logic from component construction and persistent storage, allowing for a pluggable system where data sources and business logic are isolated throug

Flask-AppBuilder is a rapid application framework built on Flask that automates the creation of admin interfaces and database-driven applications. It functions as an automatic CRUD generator and a SQL database admin interface, enabling the generation of user interfaces and REST APIs directly from data models. The framework includes a security system for managing user identities and access roles through role-based access control. It supports authentication via internal databases or external providers such as LDAP, OAuth, and OpenID. The platform covers broader capabilities including multi-dia

Apollo Universal Starter Kit is a full-stack application boilerplate and starter template designed to accelerate cross-platform development across web, mobile, and server environments. It provides a modular architecture that organizes code into independent, self-contained feature directories, combined with a GraphQL-driven data layer and a server-side rendering pipeline to optimize performance and search engine optimization. The project incorporates compile-time code generation tooling to automatically scaffold schemas, resolvers, and components, alongside a real-time subscription engine for

CodeIgniter is a PHP web framework built on the Model-View-Controller pattern, designed for building full-stack web applications. It provides a lightweight toolkit with minimal configuration, organizing application logic into controllers, models, and views for clean separation of concerns. The framework includes a fluent query builder for constructing SQL statements programmatically, PSR-4 autoloading with namespace mapping, and a service-based dependency injection container for managing shared class instances. The framework distinguishes itself through its comprehensive set of built-in tools

SpringCloud is a development platform for building distributed systems and cloud-native microservices. It provides an integrated framework for microservice development, incorporating service governance, security, and system coordination. The platform features a microservice gateway for managing traffic through dynamic routing and rate limiting, alongside a service registry for discovery. It implements distributed security through token-based authentication, role-based access control, and a specialized system that uses aspect-oriented programming to automatically enforce data-level permissions

Logto is an open-source identity provider that serves as a centralized authentication and authorization server for web, mobile, and command-line applications. It implements the OpenID Connect and OAuth 2.1 standards to handle secure user sign-in and the issuance of identity tokens. The platform is specifically designed as a multi-tenant authentication framework for software-as-a-service environments, featuring built-in organization management and tenant isolation. It includes an enterprise single sign-on gateway to integrate external identity providers and supports role-based access control t

React-admin is a framework for building data-driven administrative interfaces that connect to REST or GraphQL backends. It provides a comprehensive suite of tools for managing the full lifecycle of administrative applications, including resource-oriented routing, declarative form scaffolding, and context-driven state management. By utilizing a modular adapter-based architecture, the framework abstracts backend communication, allowing developers to build consistent CRUD interfaces that handle data fetching, authentication, and synchronization automatically. The project distinguishes itself thr

SuperTokens Core is an open-source, self-hosted authentication and identity management platform designed for deployment within private infrastructure. It provides a comprehensive suite for managing user accounts, roles, and secure authentication flows, utilizing a modular, recipe-based architecture that allows developers to enable specific security features without modifying the core codebase. The platform distinguishes itself through its robust multi-tenancy capabilities, which allow for the logical or physical isolation of user records and configuration settings across different organizatio

Sa-Token is a Java-based authentication and authorization framework designed to manage user sessions, permissions, and identity verification within web applications and microservice architectures. It provides a centralized security layer that enforces access control policies and identity validation across distributed service environments and API gateways. The framework distinguishes itself through its support for cross-domain single sign-on and its ability to function as an OAuth2 identity provider. It manages user session lifecycles by applying configurable rules for single or multi-login re

SpringBlade is a development framework and platform designed for building multi-tenant SaaS applications. It provides a comprehensive scaffold for both Spring Cloud microservices and monolithic Spring Boot architectures, enabling the rapid construction of enterprise-grade software. The platform distinguishes itself through integrated LLM orchestration and industrial IoT management. It features an LLM orchestration platform that combines large language models with knowledge bases and visual AI agent workflows, alongside an IoT hub for device connectivity, state synchronization, and edge flow o

Platform is a framework for building back-office applications and administrative dashboards using Laravel. It functions as a schema-driven UI framework and CRUD generator that automatically constructs database management interfaces, input forms, and validation rules from programmatic model definitions. The project distinguishes itself through a comprehensive backend UI kit that supports advanced data capture, including geographic coordinate mapping, tabular JSON data matrices, and marketing metadata tracking. It features a robust role-based access control system for managing resource visibili

NestJS Access Control is a role-based and attribute-based authorization framework designed for the NestJS ecosystem. It provides a declarative system for securing application routes and resources, allowing developers to enforce granular access policies through metadata-driven decorators. The framework distinguishes itself by supporting hierarchical role inheritance, which enables the resolution of complex permission sets by traversing parent and child role relationships. It also facilitates dynamic authorization management, allowing security rules to be loaded asynchronously from external dat

Vue Manage System is a type-safe administrative dashboard framework built with Vue 3 and Element Plus. It serves as a management template for backend systems, integrating role-based access control to restrict pages and actions based on assigned user permissions. The project distinguishes itself through a comprehensive set of administrative tools, including a data visualization dashboard with interactive charts and a content management system featuring rich text editing and image cropping utilities. It utilizes TypeScript for static typing and Pinia for centralized state management. The syste

This project is a Spring Boot administrative framework and enterprise backend boilerplate designed for building management systems. It provides a foundation for enterprise-level applications using a reactive programming model and non-blocking data access patterns. The framework includes a reactive CRUD system for database operations and a role-based access control system to manage user accounts and administrative permissions. It further distinguishes itself with a centralized data dictionary for maintaining standardized labels and values across application modules. The system's broader capab

This project is a Vue 3 e-commerce administration dashboard designed as a centralized backend manager for online stores. It provides a web-based interface for overseeing store settings, product catalogs, and general business workflows using the Element Plus component library. The system integrates a business intelligence dashboard for visualizing financial metrics and operational performance through interactive charts and reports. It features a content management system for editing rich text and controlling promotional banners, alongside a role-based access control interface to restrict sensi

Mail for Good is a bulk email marketing platform designed for managing subscriber databases, designing templates, and executing high-volume outreach campaigns. It functions as an email list management tool that facilitates contact data imports and the capture of new leads. The platform features an analytics dashboard for monitoring delivery metrics, tracking bounce rates, and measuring recipient engagement. It includes a role-based access control system to manage user permissions and secure the coordination of shared marketing accounts and campaigns. The system covers a broad range of capabi

This project is a business intelligence suite and SQL data visualization platform used for data analysis, reporting, and monitoring. It provides a web application for exploring datasets and building interactive dashboards, complemented by a web-based SQL query editor for analyzing raw data from connected stores. The platform features a semantic data layer to define standardized metrics and dimensions, ensuring consistent data interpretation across reports. It includes a security framework with role-based access control to manage user permissions and authentication across shared dashboards. T

EasyAdminBundle is a tool for automatically generating backend management interfaces for Symfony applications. It builds administrative screens and forms by mapping database entity definitions to user interface components, providing a web-based system for managing database records through searchable lists and CRUD forms. The project supports the creation of separate administration backends tailored for different user roles or external collaborators. It includes a security layer for restricting dashboards, menus, and data fields based on role-based access control and user security tokens. The

mall4j is a Java-based e-commerce platform and B2B2C commerce suite designed to manage retail operations across web, mobile, and H5 storefronts. It serves as an omnichannel backend and multi-tenant retail manager, providing the infrastructure to handle product catalogs, shopping carts, and order processing. The system is built on a Spring Boot microservice framework, featuring an omnichannel architecture that exposes a unified API gateway to power diverse client interfaces. It distinguishes itself through a B2B2C workflow that coordinates sales between administrators, merchants, and end consu

Geeker-Admin is a Vue.js admin dashboard framework designed for building backend management interfaces. It utilizes Vue 3, TypeScript, and Vite to provide a foundation for creating data-driven administration panels. The framework features a configurable data table engine that generates complex grids automatically from predefined configuration objects. It incorporates a role-based access control system to restrict access to specific pages and interface elements based on user permissions. The system includes a centralized state management store for persistent global data and page state preserv

Frappe is a Python-based low-code web framework used for building data-driven business applications. It functions as a full-stack meta-framework that integrates a Python backend with a JavaScript frontend, providing a development environment for rapid application prototyping and deployment. The framework employs a model-driven architecture that automatically generates database schemas, REST API endpoints, and administrative interfaces based on defined metadata. This system is complemented by a command-line scaffolding tool for creating standardized project directory structures and boilerplate

This project is a self-hosted question and answer platform and knowledge management system. It provides a centralized repository for documented answers and community discussions used to support users and resolve technical issues. The system functions as a plugin-based community forum, utilizing a modular extension system to add custom features and tools. It employs a decoupled architecture with a RESTful API backend to separate business logic from the user interface. The platform covers several domain areas including internal knowledge management, customer help centers, and community Q&A hos

vue-framework-wz is a Vue.js admin dashboard framework and modular frontend boilerplate designed for building administrative interfaces. It provides an enterprise UI component library and a role-based access control system to manage user logins and restrict access to protected administrative routes. The framework features a command-line tool for managing optional plugin dependencies to optimize bundle size. It includes an automated navigation system that generates multi-level sidebars, breadcrumbs, and tabbed browsing interfaces based on the application routing configuration. The project cov

mall4cloud is a multi-tenant B2B2C e-commerce platform built on a Spring Cloud microservice architecture. It orchestrates independently deployable services with service discovery, configuration, caching, messaging, distributed transactions, object storage, and full-text search to support a marketplace with separate interfaces for platform administrators, merchants, and customers. The platform distinguishes itself through its comprehensive microservice infrastructure, using RocketMQ for event-driven messaging, Seata for distributed transaction coordination across services, and Redis for cachin

This project is a software-as-a-service application boilerplate and foundation designed to provide the core business infrastructure for building software services. It functions as a multi-tenant user management system that handles account creation, user authentication, and organizational team structures across multiple customer accounts. The kit integrates enterprise identity features, including a service for automating user and group management via the System for Cross-domain Identity Management standard. It also includes a billing implementation for managing recurring payments, one-time tra