Back to work
Case 03
Project Management System
Access control for a real-time team app
DESIGNVERIFYOPERATE
A team workspace with chat, invites and subscriptions, where every API request is checked against a JWT before it reaches the code that answers it.
How it fits together
browsersecurity filterREST APIWebSocketdatabase
The problem
One product holding private project data, changing membership, long-lived chat connections and payment callbacks — each with a different idea of who should be trusted.
Where it could go wrong
What is exposed
- REST endpoints
- JWT lifecycle
- WebSocket sessions
- payment callbacks
Checks in place
- request-level token validation
- role checks
- authenticated team workflows
Result
- bounded project access
- real-time team chat
- invitation and subscription flows
How I built it
A Spring Security filter chain validates the JWT and the user's role before any controller runs. STOMP over WebSocket carries team chat, SMTP sends invites, and Razorpay handles subscriptions. JPA/Hibernate persists to MySQL.
Java 17Spring Boot 3Spring SecurityJWTMySQLWebSocket