Flash5/flash-extensions/flash-ext-security-form/docs/README.md

flash-ext-security-form

Password sign-in for flash-ext-security-core.

app.install(new SecurityExtension())
   .install(new FormLoginExtension(username -> accounts.find(username)));   // PasswordStore

POST /auth/form/login takes username and password form-encoded, starts a session and answers 303 to ?redirect= (same-origin paths only) or /. A wrong password and an unknown account are the same 401, and cost the same time. The method is listed at /auth/methods with "kind":"form", and the entry point sends browsers to SecurityExtension.loginPage to render it.

PasswordEncoder.pbkdf2() hashes (PBKDF2-HMAC-SHA256, 600k iterations, JDK only); use it to create accounts, or pass another encoder to passwordEncoder(...). Rate-limit the route with flash-ext-limiter.