Skip to content
Flag of Europe
Made in the European Union · Independently built · Released under EUPL 1.2
Documentation
Roadmap

Roadmap

The security, identity and hardening line is complete, and the framework has since become open core as jCustos. The latest published release on Maven Central is 00.83.00:

  • 00.51.00 (2026-05-08) — the multi-module split (security-core / security-vaadin / security-rest), the REST adapter, the two-tier demo-vaadin-rest-client, the first-run bootstrap and the central LogoutService.

  • 00.60.00 (2026-05-14) — all eight Konzept-V00.60 points as stable SPIs: audit, brute-force, session policy, action authorization, logout, bootstrap, plus the jSentinel-standalone adapter.

  • 00.70.00 (2026-05-31) · details — all eight Konzept-V00.70 phases: multi-tenancy, 11 persistence-store SPIs with an Eclipse-Store reference, JSentinelVersion drift detection, the Policy API

    • @Secured method-security processor, role hierarchy, account lifecycle, API keys, rate limiting, and the Phase-8 Vaadin component layer.

  • 00.71.00 · details — the credential-security stack: pluggable hashing (Argon2id / bcrypt / scrypt), post-KDF pepper, CredentialStore, atomic password change, single-use reset, breached-password checks, abuse detection, ASVS / NIST / CWE traceability. Ships in the 00.72 line.

  • 00.72.00 (2026-06-08) · details — the developer-experience release: typed fluent bootstrap, @JSentinelAutoService, the Vaadin starter, and secret-free diagnostics. 22 modules.

  • 00.73.00 (2026-06-10) · details — fluent-bootstrap completion + the jSentinel rebrand. The recorded-only sub-builders (.audit / .sessions / .policies / .roles / .credentials) now wire through, the wrapper-index writer ships, and SecuredUi / @SecureRoute become policy-aware. Plus a breaking move of all coordinates, packages and Security* types to the jSentinel namespace, and three STRICT-mode promotions.

  • 00.74.00 + 00.74.10 + 00.74.20 (2026-06) · details — declarative token propagation (@PropagateToken, TokenCredentialStore, pass-through / token-exchange / client-credentials, three new jSentinel-propagation* modules), plus the 00.74.10 JSentinelRuntime tooling API (healthCheck / toJson) and the 00.74.20 Storage-Pair (JSentinelStorageFactory / JSentinelStoragePair — framework + app Eclipse-Store under one parent dir, two-phase shutdown).

  • 00.75.00 (2026-06-24) · details — the Security Event Bus: ~34 typed JSentinelEvent records in signed (Ed25519) envelopes with replay protection, per-(tenant, producer) sequencing, producer policy, Eclipse-Store-backed stores and a REST/SSE bridge. Audit becomes a consumer of the bus. Four new modules; purely additive. Hardened by two production-review ticks — 00.75.10 (type-safe TokenHasher, a SpotBugs/FindSecBugs gate, urgent event-bus / Eclipse-Store fixes) and 00.75.20 (39 review findings: secret-leak redaction, concurrency races, fail-closed @SecureRoute, OWASP-minimum KDF floors).

  • 00.76.00 (2026-06-25) · details — standardized JWT validation: a new opt-in jSentinel-jwt module (Nimbus) with a JOSE-free JwtValidator SPI in the core, a disciplined JWKS client, a mandatory algorithm allow-list with hard algorithm-confusion defence (alg:none, HMAC-with-asymmetric-key, family mismatch all rejected), and a .jwt(...) bootstrap across all three adapters. The crypto base for the OAuth2 / OIDC arc; additive. Hardened by 00.76.10 — a full security review of all 25 library modules (14 findings fixed in-cycle), a reactor-wide SpotBugs / FindSecBugs gate, and all 46 Dependabot alerts closed.

  • 00.77.00 (2026-06-26) · details — OAuth2 Relying-Party flows: Authorization-Code + PKCE (S256-only), client authentication incl. private_key_jwt, refresh-token rotation with reuse-detection (revokes the family), introspection, revocation and the Device Authorization Grant — wired through .oauth2(...). Adds JWT signing (JwtSigner). Three new modules on the jSentinel-jwt base; additive.

  • 00.78.00 (2026-06-27) · details — OpenID Connect Relying-Party: ID-token validation (nonce / azp / at_hash / acr step-up), discovery, UserInfo, RP-initiated logout and claims-to-subject mapping — wired through .oidc(...). Three new modules.

  • 00.79.00 (2026-06-27) · details — Identity Interop + Stable-API (Etappe 1): the coordinated stable-API promotion of the JWT / OAuth2 / OIDC surfaces (47 types lose @ExperimentalJSentinelApi), six IdP vendor profiles (Keycloak, Entra, Auth0, Okta, Google, GitHub) and a no-mock OIDC test harness. Completed by 00.79.10 (replay-stores, DPoP / RFC 9449, OIDC back-/front-channel logout) and 00.79.20 (JWE, mTLS, PAR, JAR, FIPS) — with which the 00.76 → 00.79 identity trilogy is feature-complete. Followed by three security-hardening ticks (60 findings closed total, no new module): 00.79.30 (28 findings — secure-by-default session rotation, fail-closed empty-constraint evaluators, JWT/OIDC/DPoP spec-fidelity fixes), 00.79.40 (10 findings plus opt-in deny-by-default authorization), and 00.79.41 (21 findings — GitHub identity hardening, the OIDC nonce/CSRF fix, annotation inheritance, three new anti-drift shared homes).

  • 00.80.00 (2026-07-21) · details — Operations & Forensics: seven new modules delivering runtime metrics and health, a tamper-evident, independently verifiable audit hash chain, and production-grade event exporters (webhook, SIEM, OpenTelemetry, REST/SSE), plus strict-mode consume-failure wiring.

  • 00.81.00 (2026-08-31) — session-lifecycle integrity + critical backlog: SweepingSessionStore retention, OAuth2 login-CSRF binding (CWE-352), a compile-time empty-annotation guard (CWE-863) and pinned token-propagation audience selection (CWE-522).

  • 00.81.10 (2026-08-31) — the jSentinel → jCustos rebrand: new coordinates eu.jsentinel:jCustos-*, package root eu.jsentinel.jcustos; wire formats unchanged.

  • 00.81.20 (2026-08-31) — the edition split: jCustos becomes open core — a free Community Edition (EUPL 1.2) and a commercial Enterprise Edition for the operations and forensics modules. See Editions.

  • 00.82.00 (2026-09-01) — residual hardening: unprotected-handler reporting at startup (CWE-862), logout-redirect validation (CWE-601), time-bounded HTTP body reads (CWE-400) and constant-cost password verification during migration (CWE-208).

  • 00.83.00 (2026-09-01) — stable-API promotion: 43 types and 11 methods lose @ExperimentalJCustosApi, and a configured REST decision mapper finally reaches enforcement.

Planned

The high-security capabilities from the original 00.80 concept that have not yet shipped — each still a concept on develop, not committed to a version:

  • MFA / step-up authentication and WebAuthn / passkeys.
  • Device + remember-me management and risk-based authentication.
  • CSRF / web-adapter hardening (login-CSRF is already covered since 00.81.00).
  • Privacy, retention and backup / restore (GDPR-driven).

See the 00.80 concept for the full design of these remaining items.

Delivered in 00.70.00

AreaWhat shipped
Multi-tenancyTenantId / ResourceRef / ResourceAccessContext; every store key and service tenant-scoped. See Multi-Tenancy.
Persistence11 store SPIs + in-memory defaults + Eclipse-Store reference + contract testkit. See Persistence.
Active sessionsJSentinelVersion drift detection, role refresh for live sessions, store-backed SubjectSessionRegistry, SessionManagementView.
Method security@Secured compile-time processor + runtime SecuredProxy.wrap(...), one JSentinelEnforcer. See Method Security.
Policy API@RequiresPolicy, PolicyRegistry, sealed PolicyDecision. See Policy API.
Authorization ergonomicsRoleHierarchy SPI, @RequiresAnyPermission, @RequiresAllPermissions.
Account lifecyclePassword reset, email verification, JSentinelNotificationSender SPI.
Tokens + rate limitingAPI keys, rotating refresh tokens, sliding-window RateLimitPolicy.
Audit27 sealed AuditEvent variants (11 new), StoreBackedSecurityAuditService.

Delivered in 00.60.00

#CapabilityNotes
1Password hashingPasswordHasher + PasswordHash (typed record) + Pbkdf2PasswordHasher (PBKDF2-HMAC-SHA256, 120 000 iter). needsRehash(...) drift detection; both demo stores rehash transparently on successful login.
2Security audit pipelineJSentinelAuditService SPI with 16 sealed AuditEvent record types (incl. UserCreated/UserDeleted from the new admin UI). RingBufferAuditSink + LoggingAuditSink + CompositeAuditService. Vaadin /audit route + REST GET /api/audit. See Security Audit.
3Brute-force protectionLoginAttemptPolicy SPI with sealed LoginAttemptDecision = Allowed | LockedOut. InMemoryLoginAttemptPolicy default. Red lockout banner in both Vaadin demo login views; 429 + Retry-After in REST. See Brute-Force Protection.
4Session policiesSessionPolicy<U> SPI with TimeoutSessionPolicy default. Session-id rotation honoured on login as session-fixation defence. See Session Policy.
5Role persistenceAuthorizationService stays the boundary; no RoleStore forced into core. Both Vaadin demos ship a /admin/roles UI with role assignment, user create + delete (with ConfirmDialog).
6Multi-session logoutLogoutService.logout(SubjectId, LogoutScope) with LogoutScope = CurrentSession | AllSessionsOfSubject. SubjectSessionRegistry tracks active sessions; LogoutListener lets adapters plug in cleanup. See Logout Flows.
7Action authorizationActionAuthorizationService<U> SPI (stable, not just static helpers). ActionPermission record, StaticActionAuthorizationService default. Every denial automatically emits an ActionDenied audit event.
8First-run bootstrapModes, token store (POSIX 0600), TTL parsing, race-safe admin creation, leak-free validation, brute-force-protected. See Bootstrap.

Plus, beyond the Konzept

CapabilityNotes
Core-Java adapterNew jSentinel-standalone module (3 classes: Secured, StandaloneLoginFlow, ThreadLocalSubjectStore). Same annotations enforce security on plain Java services via dynamic proxy — no Vaadin, no REST. New demo-standalone CLI demonstrates. See Standalone Integration.
JSentinelServiceResolverCentral SPI cache for all eight services. Strict accessors throw IllegalStateException; find…() returns Optional; set…(…) is a programmatic test seam.
Role + User admin UI in both Vaadin demos/admin/roles with single-role-set semantics; new-user dialog; per-row delete with ConfirmDialog. Backend-driven in demo-vaadin-rest-client over GET/POST/PUT/DELETE /api/admin/users.
Mutation-tested libraryPitest runs on all four library modules — 79 / 90 / 95 / 98 %. See Architecture → Quality.
Vaadin Browserless TestingWired in jSentinel-vaadin + both Vaadin demos. Real adapter-test suite covers LoginView policy ordering, action-gated UI patterns, B3 session-id rotation against MockHttpSession, lockout banner formatting, /audit grid filtering, /setup, /admin/roles flows, MainView tab matrix per role. Replaces the planned Karibu / TestBench setup — free since Vaadin 25.1.
~570 tests across all modulesReactor-wide mvn test.

Open within the 00.60 line

CapabilityWhy it matters
PermissionName graduationStill marked @ExperimentalSecurityApi. Konzept calls for stable status alongside the now-shipped ActionAuthorizationService SPI.
Demo mutation-coverage pushdemo-rest (49 %) and demo-vaadin-rest-client (10 %) trail the library numbers. Pitest run pending for the next iteration.

Delivered in 00.71.00 (Credential Hardening)

✅ Shipped on Maven Central as part of the 00.72.00 release line. Phases 1a–5 complete (35 of 36 prompts). Pull it in via the Quick Start.

v00.71.00 is a dedicated credential-security stack built against modern standards (OWASP ASVS V2, NIST SP 800-63B, CWE):

  • Pluggable hashing — JDK-only PBKDF2 core plus an optional jSentinel-crypto-bc module adding Argon2id / bcrypt / scrypt (BouncyCastle lightweight API, no global JCA mutation).
  • Post-KDF HMAC pepper with rotation, calibration profiles, Unicode-aware input hygiene, SecretValue (AutoCloseable).
  • CredentialStore with compare-and-swap updates, an eight-state lifecycle, atomic password change, single-use selector/verifier reset.
  • Abuse detection — multi-dimensional sliding-window (username / client-address / tenant / global), credential-stuffing and password-spraying detectors, context-aware password validation, optional password history.
  • Compromised-password check — CompromisedPasswordChecker SPI with an optional jSentinel-credentials-hibp module (Have I Been Pwned via k-anonymity SHA-1 prefix; plaintext never leaves the JVM).
  • Compliance traceability — ASVS / NIST / CWE coverage matrix.

Read more: v00.71.00 · Credential Hardening · Compliance & CWE Coverage · 00.71.00 release notes.

Delivered in 00.72.00 (Developer Experience)

✅ Shipped on Maven Central (in the 00.72 line). All 35 V00.72 prompts shipped; the DX surface was marked @ExperimentalSecurityApi until the V00.73 wiring follow-ups.

v00.72.00 is a deliberate stabilisation / adoption release — no new security primitives, no SPI replaced. It lowers the integration barrier with four building blocks:

  • Typed fluent bootstrap — VaadinSecurity.bootstrap() / RestSecurity.bootstrap() / StandaloneSecurity.bootstrap() configure every subsystem in one call path and return a diagnostic JSentinelRuntime; JSentinelBootstrapMode (COMMUNITY_DEFAULTS / DEVELOPMENT / PRODUCTION / STRICT).
  • @JSentinelAutoService — a dependency-free annotation + JDK-only processor that generates META-INF/services files (no external Google AutoService); a marker-comment protocol preserves hand-written entries.
  • jSentinel-vaadin-starter — declarative SecuredUi.button / link / menuItem, @SecureRoute(roles, permissions, policy), and development / production / strict profiles.
  • JSentinelDiagnostics.inspect() — secret-free report of active services, applied defaults, generated wrappers, and missing / duplicate / conflicting SPIs.

Reactor grows 16 → 22 modules; jSentinel-core is unchanged.

Read more: v00.72.00 · 00.72.00 release notes.

The 00.80 high-security concept

Largely delivered. The operations-and-forensics half of the original 00.80 concept has shipped — tamper-evident audit, monitoring, the event bus and its exporters, strict mode and Argon2id. The remaining items — MFA / step-up, WebAuthn, device management, risk-based auth, CSRF and privacy / retention — are still ahead; their SPIs, module names and scope may shift before they land.
00.80 concept — delivered & planned
The full high-security concept. Delivered: tamper-evident audit (hash-chaining), the Security Event Bus and exporters, metrics + health, fail-closed strict mode, Argon2id. Still planned: MFA / step-up, WebAuthn / passkeys, OIDC-OAuth2 bridge, device + remember-me, risk-based authentication, CSRF hardening, GDPR / retention / backup-restore.

Explicitly out of scope

  • Built-in cluster mode. The SPIs (SubjectSessionRegistry, JSentinelAuditService, LoginAttemptPolicy) are deliberately shaped so Redis / database / IAM-backed implementations are drop-in replacements when needed.
  • security-javafx as a dedicated module. Both 00.70 and 00.80 concepts hold the line: jSentinel-standalone covers Swing / JavaFX / CLI functionally via manual SecuredProxy.wrap(...) + StandaloneLoginFlow. A JavaFX-specific module only makes sense once a real UI-lifecycle need surfaces.
  • Becoming a full IAM / OIDC stack. The 00.80 OIDC/OAuth2 bridge translates external identity into internal subjects; it does not replace established identity-provider clients.

License

EUPL 1.2