AuthPlus is an authentication project built with Spring Boot, Spring Security, PostgreSQL, and a React frontend styled with Tailwind CSS. Users can sign in with email and password or use Google and GitHub through OAuth2. The backend issues access and refresh tokens, while HTTP-only cookies help keep token values out of ordinary client-side JavaScript. Passwords are hashed with BCrypt rather than stored as plain text. The project focuses on making authentication reusable while keeping the responsibilities of the frontend and backend clear.
The problem
Authentication is easy to underestimate when starting a web application. Repeating login logic across projects can lead to duplicated code and inconsistent decisions around password storage, token handling, and access control. Social login introduces another flow that needs to be handled without weakening the rest of the system.
The solution
I built AuthPlus with Spring Boot and Spring Security to bring the main authentication paths into one backend. It supports email-and-password login, OAuth2 sign-in through Google and GitHub, and separate access and refresh tokens. PostgreSQL stores application data, BCrypt is used for password hashing, and the browser-facing flow uses HTTP-only cookies for token handling.
What it does
- Email-and-password authentication
- Google and GitHub sign-in through OAuth2
- Separate access-token and refresh-token flow
- Token handling through HTTP-only cookies
- Password hashing with BCrypt
- React frontend styled with Tailwind CSS
- Spring Security configuration for protected routes
Screenshots
What was hard
One of the more involved parts is the refresh flow. Access tokens should be short-lived, but users should not have to sign in again every time one expires. The backend therefore needs to validate refresh requests carefully and issue replacement credentials without allowing the refresh path to become a shortcut around authentication. OAuth2 also adds callback handling and account-mapping considerations. Cookie settings, password hashing, and clear public-versus-protected route rules all need to work together rather than being treated as separate checkboxes.
Results
AuthPlus provides a reusable foundation for applications that need familiar login options without rebuilding the entire authentication flow from scratch. It also gave me hands-on experience with security configuration, OAuth2 callbacks, token renewal, and the details that matter when authentication crosses the frontend and backend boundary.
