EstateManager: A JWT-Secured Real Estate Platform with Role-Based Access Control

Abstract

The digital transformation of real estate transactions faces significant scalability and security challenges, with small-to-medium agencies frequently relying on fragmented manual processes. Existing web platforms often lack robust authentication mechanisms and granular access control, exposing sensitive property data and complicating regulatory compliance. This paper presents EstateManager, a comprehensive Real Estate Management System designed to address these gaps through a secure, scalable full-stack implementation. The system integrates a Thyme- leaf-based frontend, Spring Boot backend, and MySQL database with JSON Web Token (JWT) authentication and role-based ac- cess control (RBAC). EstateManager implements two-tier security validation and property synchronization through REST API communication. The system architecture supports complete property lifecycle management, advanced client filtering with price- range optimization, secure contact channels with audit trails, and mobile-responsive design validated across multiple device categories. Functional testing with a dataset of 500 property records demonstrated query response times under 100 milliseconds for filtered searches and successful enforcement of role- based permissions across all test scenarios. EstateManager pro- vides a technically validated framework for modern property management, demonstrating how modular architecture with integrated security protocols can address current market gaps while establishing implementable standards for transaction efficiency and data protection.

Introduction

Human Resource Management (HRM) traditionally focuses on administrative functions such as employee management, attendance tracking, and payroll. However, the real estate sector presents additional operational complexities that exceed conventional HRM frameworks. The industry is undergoing rapid digital transformation driven by Property Technology (PropTech), shifting from manual, transaction-based processes to integrated digital platforms designed to improve transparency, efficiency, and stakeholder experience.

Despite technological advancement, significant implementation gaps remain—particularly among small-to-medium real estate agencies. Many agencies rely on fragmented digital tools or traditional paper/spreadsheet systems, leading to inefficiencies, security vulnerabilities, delayed property listings, and poor transaction visibility. Contemporary systems face three primary challenges:

1. Balancing feature complexity and usability

2. Inconsistent and retrofitted security implementations

3. Limited scalability under fluctuating demand

To address these issues, the paper introduces EstateManager, a full-stack Real Estate Management System prototype built using Spring Boot 4.0.1, Thymeleaf, and MySQL. The system follows a strict three-tier client–server architecture, separating presentation, business logic, and data persistence layers. It focuses on complete property lifecycle management, including listing creation, client discovery, and transaction facilitation, while incorporating:

• JWT-based authentication

• Role-Based Access Control (RBAC)

• RESTful API integration

• Advanced property filtering and geospatial search

• Client personalization features

Key Contributions

The system contributes to enterprise web application design through:

• Strict architectural layering using Controller–Service–Repository pattern

• Integrated security architecture (JWT + RBAC) applied across all layers

• Hybrid REST + server-side rendering design

• Optimized database design with indexing and geospatial querying

Literature Review Highlights

The review identifies several trends and gaps in existing real estate systems:

Evolution of Platforms

Real estate systems evolved from simple listing websites to scalable, distributed platforms with advanced features like interactive maps and virtual tours. However, increasing feature richness has often introduced complexity and maintainability issues.

Security Challenges

Research shows that many platforms suffer from weak authentication and access control mechanisms. Regulatory compliance (e.g., GDPR) further emphasizes the need for secure data handling and integrated architectural security.

Advanced Technology Integration

Emerging technologies such as:

• Blockchain (for secure, immutable transactions)

• Smart contracts

• AI-driven property valuation

• VR-enhanced property visualization

have improved trust, automation, and engagement but introduce scalability and integration challenges.

Identified Gaps in Existing Systems

1. Poor architectural separation of concerns

2. Security treated as an afterthought

3. Imbalance between usability and feature complexity

4. Limited performance optimization for search operations

EstateManager addresses these gaps by implementing:

• Layered MVC design with server-side rendering

• Security-first architecture with JWT and RBAC enforcement

• Optimized relational database design

• Dynamic multi-criteria and geospatial filtering

System Architecture Overview

The system adopts a three-tier architecture:

• Presentation Layer: Thymeleaf-based UI with JavaScript enhancements

• Application Layer: Spring Boot MVC with Controllers, Services, and Repositories

• Data Layer: MySQL 8.0 with Hibernate ORM and normalized schema

It exposes RESTful APIs supporting CRUD operations and follows HTTP standards for resource management.

Core System Modules

1. Authentication & Role Management

• Secure registration and login

• JWT tokens stored in HttpOnly cookies

• BCrypt password hashing

• Role separation between AGENT and CLIENT

• Method-level access control

2. Property Lifecycle Management

• Full CRUD operations

• Defined status transitions (DRAFT → ACTIVE → UNDER_OFFER → SOLD/RENTED)

• Ownership validation

• Soft and hard deletion strategies

• Optimistic locking for concurrency control

3. Property Discovery & Filtering

• Multi-criteria filtering (price, type, location, bedrooms, etc.)

• Geospatial proximity search

• Dynamic query generation using JPA Specifications

• Performance optimization via indexing

Conclusion

This paper presents EstateManager, a Real Estate Management System prototype demonstrating modern web application architecture with integrated security, balanced functionality, and performance optimization. The system successfully implements dual- role marketplace enabling agents to manage property lifecycles while providing clients with sophisticated discovery and personalization capabilities. Key achievements include comprehensive security framework through JWT authentication and RBAC enforcement at multiple architectural layers, performant search capabilities through optimized database design with spatial indexing and strategic caching, intuitive user interfaces through server-side rendering with progressive enhancement, and maintainable architecture through clear separation of concerns and modular design. The implementation validates practical application of enter- prise Java technologies to property management domain, contribut- ing concrete reference implementation demonstrating architectural patterns, security integration, and performance optimization tech- niques. Functional testing confirms correct enforcement of busi- ness rules and security policies across user workflows, while per- formance evaluation identifies capability boundaries and optimiza- tion opportunities guiding deployment decisions.

References

[1] L. Arion, G. Calis, and A. C. Tan, \"Emerging digitalization in property and facility management: A state-of-the-art re- view,\" Buildings, vol. 14, p. 415, 2024. [2] M. N. Postelnicu and C. V. Marian, \"Web-based real estate management system for urban planning and monitoring,\" IEEE Access, vol. 11, pp. 34211–34224, 2023. [3] F. Ahamad and M. Al-Maitah, \"Impact of cloud computing on real estate management information systems,\" IEEE Ac- cess, vol. 10, pp. 11200–11215, 2022. [4] P. Papadopoulos et al., \"The GDPR enforcement fines at a glance,\" Information Technology & People, vol. 34, no. 7, pp. 1874–1891, 2021. [5] K. M. Aloufi and A. S. Alsaedi, \"API-driven integration for smart city real estate platforms,\" IEEE Access, vol. 10, pp. 98765–98780, 2022. [6] B. S. Rawal and R. K. Dhanaraj, \"Security and privacy chal- lenges in smart real estate management: A survey,\" IEEE Internet of Things Journal, vol. 11, no. 4, pp. 5821–5835, 2024. [7] J. Ullah and K. Al-Turjman, \"A blockchain-based housing system architecture for trustworthy rental markets,\" Elec- tronics, vol. 13, no. 15, p. 3012, 2024. [8] T. Zhang and Q. Li, \"Design of a web-based process man- agement system with automatic code generation for real es- tate portals,\" Applied Sciences, vol. 13, no. 21, p. 11737, 2023. [9] S. Singh and S. K. Singh, \"Microservices in practice: A sur- vey of issues and solutions in real estate applications,\" IEEE Access, vol. 9, pp. 145678–145692, 2021. [10] M. A. Serhani et al., \"Cloud-based real estate services: Ar- chitecture, challenges, and solutions,\" IEEE Transactions on Services Computing, vol. 14, no. 6, pp. 1895–1908, 2021. [11] S. A. R. Khan et al., \"Smart contract security in real estate: Vulnerabilities and countermeasures,\" IEEE Access, vol. 11, pp. 45678–45692, 2023. [12] J. Grönroos and T. Knuuti, \"Blockchain’s grand promise for the real estate sector: A systematic review,\" Applied Sci- ences, vol. 12, no. 23, p. 11940, 2022. [13] L. Wu et al., \"Deep learning for real estate valuation: A com- prehensive benchmark,\" IEEE Transactions on Knowledge and Data Engineering, vol. 35, no. 8, pp. 8343–8356, 2023. [14] R. G. D’Agostino, \"Real estate app development based on AI/VR technologies,\" Electronics, vol. 12, no. 3, p. 707, 2023. [15] R. Valenta, J. Novak, and P. Svoboda, \"Blockchain and smart contracts to secure property transactions in smart cities,\" Ap- plied Sciences, vol. 13, no. 1, p. 66, 2022. [16] S. Y. Lee and J. H. Park, \"A systematic review of smart real estate technology: Drivers and barriers to online platforms,\" Sustainability, vol. 12, no. 9, p. 3142, 2020.

Copyright

Copyright © 2026 Kushal B. C., Saiju Barai, Shubham Timilsina, Prajwal Lekhi, B. Ganga Bhavani. This is an open access article distributed under the Creative Commons Attribution License, which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.