References · At Least Once

Primary specifications and official project documentation, in one place. Each part links the ones it leans on; this is the full list.

OAuth and IETF

OAuth 2.1 Authorization Framework — Internet-Draft

As of September 2026, OAuth 2.1 is an active IETF Internet-Draft (draft-ietf-oauth-v2-1-16), not yet a published RFC.

Datatracker: https://datatracker.ietf.org/doc/draft-ietf-oauth-v2-1/
HTML draft: https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-16

OAuth 2.0 Authorization Framework — RFC 6749

https://www.rfc-editor.org/rfc/rfc6749

Use primarily for historical/base OAuth 2.0 concepts. For modern security guidance, pair it with RFC 9700.

OAuth 2.0 Security Best Current Practice — RFC 9700 / BCP 240

Especially relevant for:

Authorization Code security;
refresh-token protection/rotation;
redirect URI security;
deprecated/insecure historical patterns;
password-change security events.

OpenID Connect

OpenID Connect Core 1.0

https://openid.net/specs/openid-connect-core-1_0.html

Relevant for:

openid scope;
ID Tokens;
claims;
Authorization Code Flow;
nonce;
UserInfo.

OpenID Connect Discovery 1.0

https://openid.net/specs/openid-connect-discovery-1_0.html

Spring

Spring Security — Authorization Server

Spring Authorization Server reference

Some documentation remains available under the standalone Spring Authorization Server reference tree:

https://docs.spring.io/spring-authorization-server/reference/
Configuration model: https://docs.spring.io/spring-authorization-server/reference/configuration-model.html
Core model/components: https://docs.spring.io/spring-authorization-server/reference/core-model-components.html
Protocol endpoints: https://docs.spring.io/spring-authorization-server/reference/protocol-endpoints.html
UserInfo guide: https://docs.spring.io/spring-authorization-server/reference/guides/how-to-userinfo.html

When publishing code that uses Spring Security 7.x / Spring Boot 4.x, verify version-sensitive APIs against the matching Spring Security reference.

Spring Security — Resource Server JWT

https://docs.spring.io/spring-security/reference/servlet/oauth2/resource-server/jwt.html

Spring Security — authentication events

https://docs.spring.io/spring-security/reference/servlet/authentication/events.html

Spring Security — password storage

https://docs.spring.io/spring-security/reference/features/authentication/password-storage.html

Spring Security — CORS

https://docs.spring.io/spring-security/reference/servlet/integrations/cors.html

Spring Boot — profiles

https://docs.spring.io/spring-boot/reference/features/profiles.html

Spring Boot — Actuator

https://docs.spring.io/spring-boot/reference/actuator/

Spring Data JPA

https://docs.spring.io/spring-data/jpa/reference/

Database and migrations

PostgreSQL

https://www.postgresql.org/docs/

Flyway

https://documentation.red-gate.com/fd

Testing

Testcontainers Java

https://java.testcontainers.org/

PostgreSQL Testcontainers module

https://java.testcontainers.org/modules/databases/postgres/

Spring Security MockMvc testing

https://docs.spring.io/spring-security/reference/servlet/test/mockmvc/index.html

Docker and CI

Docker multi-stage builds

https://docs.docker.com/build/building/multi-stage/

Docker Compose

https://docs.docker.com/compose/

GitHub Actions

https://docs.github.com/actions

Spring Boot container images

https://docs.spring.io/spring-boot/reference/packaging/container-images/index.html