Retoin · Products

Secure WebCore Engine

Ultra-light · high-performance · security-first Java Web Server Framework

Why we built it

Why build our own WebCore Engine?

Standard WAS platforms such as Tomcat, Jetty and JBoss are excellent — but because their structure, vulnerabilities and attack patterns are all public, their attack surface is very wide.

Retoin pursues "simplicity + controllable code + predictable security". So instead of depending on an external stack, we built a WebCore engine we can control ourselves.

Overview

Secure WebCore Engine is an ultra-light, pure-Java Web Server & WebSocket Engine that Retoin designed and runs in-house.

A simple structure that runs without Servlet or JSP
Encrypted communication on a modern HTTPS / TLS stack
HTTP parser, secure URL normalization and WebSocket implemented in-house
HTML-native templating with HtmlAutoTag
Zero-dependency design
Simple, verifiable, with a very small attack surface

Engine components

Retoin Secure WebCore Engine components

WebCore Engine ├─ HTTP Core │ ├─ HttpQ (HTTP parser) │ ├─ SecURL (secure URL normalization) │ └─ SimURL (lightweight URL parser) │ ├─ Session & State │ └─ HSession (in-memory sessions) │ ├─ Template & View │ └─ HtmlAutoTag (HTML-native template engine) │ ├─ Localization │ └─ H_locale (i18n engine) │ ├─ Protocol Extensions │ └─ WebSocket Engine (custom WS protocol) │ └─ System └─ HttpStatus (HTTP status codes)

HtmlAutoTag

HTML-native template engine

HtmlAutoTag is not just an HTML generator. It keeps plain HTML syntax and extends it very thinly, on the server only.

Designers and front-end developers write plain HTML / CSS only
if, loop and ${...} placeholders handle conditions, loops and substitution
Java code just fills a Map<String,Object> with data
One HtmlAutoTag.doit(...) call renders the template and manages ETags

Example: a template using a terminal list, permissions and localized strings

<div if="terminal_list" class="gd_sw_terminal">
  <div loop="terminal_list" class="gd_sw_vector sub1"
       option="${terminal_list.name}">
    <div>${terminal_list.displayname}</div>
  </div>
  <div if="ADMIN" class="gd_sw_vector sub1 sub1all" option="ALL">
    <span class="sub1all">ALL</span>
  </div>
  <div class="gd_sw sub1">${L_mlog.archive}</div>
  <div class="gd_sw_vector sub2" option="ARCHIVE_USER">${L_mlog.archive_user}</div>
  <div if="ADMIN" class="gd_sw_vector sub2" option="ARCHIVE_DATE">${L_mlog.archive_date}</div>
</div>

Server-side rendering that keeps a pure HTML structure — no JSP, no complex template syntax.

Security design philosophy

Security by Simplicity

Small is safe

Minimal features keep the attack surface small.

No standard stack

Automated attack tools don't recognize the engine's structure.

Modern HTTPS / TLS

Encrypted traffic is handled on a modern TLS protocol stack.

TOTP admin authentication

Admin console access requires TOTP two-factor authentication by default.

Built in-house

We understand and control every layer's behavior, 100%.

Predictable behavior

A design stripped of unnecessary complexity.

Admin authentication and TOTP

Admin consoles running on WebCore Engine use TOTP-based two-factor authentication (time-based one-time passwords) by default.

Admin accounts can't sign in with ID and password alone — a TOTP code is always required
A TOTP secret is created at first setup and registered easily with a QR code (scanned by a TOTP app)
TOTP verification is implemented on the server, with no dependence on external authentication services
Works naturally with HSession (session engine), HtmlAutoTag templates and HTTPS / TLS

※ The admin console's TOTP flow is already applied to the live services Retoin runs, as a baseline policy that sharply reduces the risk of admin-account takeover and session hijacking.

Today and tomorrow

Retoin Secure WebCore Engine today and tomorrow

In use

Retoin's official website (retoin.com)
Some modules of MAIL PRISM AI internal systems
Engine for in-house automation and admin web tools

※ Details of specific internal systems are not disclosed for security reasons.

Performance

Memory use: about 1/20 of Tomcat
Method stack depth from request to HTML response: about 10% of Tomcat — very low latency and overhead
Request handling overhead: a few milliseconds
WebSocket: hundreds of clients without strain
Zero-dependency — no wasted build or memory
Built on Built on Java 8 for maximum platform compatibility

Roadmap

Formalize the Router DSL and static file server
Engine documentation and samples
Preparing a refined open-source release
Stronger WS performance and research into a lightweight API gateway