Neosrate

Each request passes through SecurityFilter, which extracts the token from the Authorization header, validates the HMAC256 signature via Auth0 SDK and injects UserDetails into the SecurityContext. CSRF disabled — no session cookie. Token carries userId, username and email as claims, no DB roundtrip to identify the caller.

Profile images, community photos and post media go directly to S3 — database stores only the file_path. S3Service validates file type (JPEG, PNG, GIF, MP4) before upload and uses timestamp naming to avoid collision. New users and communities receive a default image via server-side copy within S3, without transferring the file.

Deleting a user or community cleans all related tables (posts, comments, likes, memberships, profile) via sequential repository calls within a single @Transactional. The order is explicit and traceable.

Auth lives in four localStorage keys (authenticated, token, userId, username). On app load, the token is decoded with jwt-decode to check expiration without a server roundtrip. Auth state propagated via props where needed.

Posts use server pagination: maxPerPagegrows +10 per “load more”, API returns only the needed slice. Comments are fetched at once and sliced on the client: comments.filter(c => c.postId === id).slice(0, maxComments).