Platform Security

Use FAB platform-security for token generation/validation, ACR enforcement, service tokens, stepup authentication, and reactive security context handling.

Core Rule

Follow the service's existing security pattern first. Do not hand-roll JWT parsing, token validation, ACR checks, service-token caches, or custom WebFlux filters when platform-security already provides them.

Dependency

Add only if missing:

<dependency>
    <groupId>com.bankfab.ksa.middleware</groupId>
    <artifactId>platform-security</artifactId>
</dependency>