Secure Document Storage
A self-hosted file and software locker built from scratch with Spring Boot, Spring Security and PostgreSQL. Every account sees only its own files.
Every protection below was chosen and implemented deliberately, not inherited from a framework preset.
Passwords stored as salted BCrypt hashes. The plain text never touches the database.
Ownership is enforced inside the database query, not as a separate check that can be forgotten.
Uploaded filenames are never used as disk paths. Every file is stored under a generated UUID.
Tokens on every state-changing form, backed by SameSite and HttpOnly session cookies.
Five failed sign-ins locks the account for fifteen minutes, blocking automated guessing.
Only approved file types are accepted. Web-executable formats are refused outright.
Admin, standard and read-only demo roles, enforced server side rather than hidden in the UI.
No public registration. Accounts are created by an administrator and activated by email.
Spring Boot with Spring Security for authentication and authorisation, Spring Data JPA over PostgreSQL for persistence, and Thymeleaf for server-rendered views. Deployed on Railway with HTTPS and a persistent volume.