# Coding Practices and Recommendations of Spring Security for Enterprise
Applications

Mazharul Islam1, Sazzadur Rahaman1, Na Meng1, Behnaz Hassanshahi2, Padmanabhan
Krishnan2,
Danfeng (Daphne) Yao1 Virginia Tech, Blacksburg, VA1, Oracle Labs, Australia2
{mazharul, sazzad14, nm8247<EMAIL_ADDRESS>{behnaz.hassanshahi,
<EMAIL_ADDRESS>
###### Abstract

Spring security is tremendously popular among practitioners for its ease of
use to secure enterprise applications. In this paper, we study the application
framework misconfiguration vulnerabilities in the light of Spring security,
which is relatively understudied in the existing literature. Towards that
goal, we identify 6 types of security anti-patterns and 4 insecure vulnerable
defaults by conducting a measurement-based approach on 28 Spring applications.
Our analysis shows that security risks associated with the identified security
anti-patterns and insecure defaults can leave the enterprise application
vulnerable to a wide range of high-risk attacks. To prevent these high-risk
attacks, we also provide recommendations for practitioners. Consequently, our
study has contributed one update to the official Spring security documentation
while other security issues identified in this study are being considered for
future major releases by Spring security community.

##  I Introduction

††This work has been supported by the National Science Foundation under Grant
No. CNS-1929701.

Application frameworks enable reusing software designs at the architecture
level by capturing the common abstractions of an application domain [1].
Spring is the most popular application framework for enterprise Java
applications [2, 3]. Spring security [4] offers reusable authentication and
authorization modules for enterprise applications that are written in Spring.
It also provides default protection against common web-application related
vulnerabilities, e.g., CSRF protection, including common security response
headers. Spring security is highly customizable by design to enable seamless
integration with various use-cases. Unfortunately, the abuse of such
customization capabilities can be a great source of application insecurity.
For example, in [5], authors observed a common trend of disabling CSRF
protection for convenience in StackOverflow posts. Without careful
consideration, such customization can render a web application vulnerable to
classic CSRF attacks.

Prior research on security issues arising from reusable software components
mostly focuses on library API misuse [6, 7, 8, 9, 10, 11, 12], while framework
misconfigurations are largely unexplored. For example, [6, 9, 5, 11] focus on
understanding the nature of security API misuses. [6, 8] showed the dangers of
misusing application-level SSL/TLS and cryptographic APIs. Researchers
extensively studied the role of StackOverflow’s misleading advices [9, 5, 13],
poor API designs [14], lack of proper guidelines [15], etc., behind this
insecurity. Most of the existing methods to detect security API misuses rely
on static code analysis [7, 8, 10, 16, 12]. Although, misconfiguring of
security modules in application frameworks has great potential to cause
insecurity, their nature, severity, prevalence, and detection feasibility are
still mostly unknown.

In this paper, we present a thorough study of framework misconfiguration
vulnerabilities in Spring Security. Our goal is to identify various classes of
these vulnerabilities (referred to as security anti-patterns), their nature,
severity, and prevalence. Specifically, we pose the following research
questions. What are the common security anti-patterns in enterprise Spring
security applications? How severe are they? Most importantly, how prevalent
are they in real-world enterprise software?

To find answers, we took a measurement-based approach. We manually analyzed 28
Spring-based applications hosted on GitHub to observe any insecure
customization (i.e., security anti-patterns) of Spring security’s i)
authentication and ii) protection against exploits features. We also studied
the security of the default configurations of these features. Our analysis
discovered 6 types of security anti-patterns. We observed that programmers
tend to intentionally disable CSRF protections, store secrets insecurely, use
lifelong expiration of access tokens, etc. Our analysis of Spring security’s
default configuration revealed 4 major vulnerabilities. Our analysis found
that Spring security uses 10 as the default strength ($2^{10}$ number of
rounds) in Bcrypt during password encoding, while it is recommended to use at
least $16$ [17] to be secured. We also found that Spring security uses
insecure MD5 hashing to generate the “remember me” cookie. Most importantly,
we identified that Spring security does not offer any throttling policy to
limit the number of requests by users during API invocation. This
insufficiency might lead to denial of service (DoS) attacks to applications
using Spring security’s OAuth functionality. Our findings on 4 major
vulnerabilities of Spring security’s default configuration resulted in one
update to Spring security’s official documentation, while other issues are
being considered for future major releases after we disclosed them to the
Spring security community.

In summary our contributions are as follows.

  * •

Our analysis of 28 applications identified 6 common Spring security anti-
patterns that undermine its security guarantees. During our analysis, we
discovered 17 instances of disabling CSRF tokens, 14 instances of hard coded
JWT signing key, 17 instances of storing secrets insecurely. We also analyze
the security risk associated with them and highlight recommendations for
practitioners on how to avoid the anti-patterns and thus improve security.

  * •

Our analysis of Spring security’s default configuration revealed 4 major
vulnerabilities, including the insecure use of Bcrypt for password encoding,
the use of MD5 hash to generate “remember-me” cookie. We also identified that
the lack of throttling policy per API key is susceptible to denial of service
attacks.

  * •

We divided our dataset into two groups, i.e., real-world applications (8) and
demo (20) projects and cross-analyzed 6 security anti-patterns across the
groups. Our analysis revealed that the anti-pattern’s count ratio is higher in
demo projects than the real-world applications. However, the nature of the
anti-patterns is similar across the two group.

##  II Threat Model and Methodology

In this section, first, we present the threat model and then, discuss the
methodology of our study.

###  II-A Threat model

Existing cryptographic API misuse studies (e.g., [6, 7, 8, 9, 10, 11, 12]) are
not specific for Spring security framework. Enterprise security issues in
Spring security, such as the abuse of customization of reusable components or
improper security management policies, are not well examined, with a few
exceptions. For example, studies in [18, 19] designed authentication and
authorization patterns and access control policies of Spring security. In
comparison, our paper aims to report security anti-patterns in Spring projects
and their security threats. Specifically, we focus on the misconfigurations of
two Spring security features, i.e., i) authentication and ii) protection
against exploits. We also study the security status of default configurations
of these features.

Authentication. Spring security offers 9 types of authentications [20]. We
analyze the use of 4 of these authentication mechanisms as follows, i)
username-password, ii) “remember me” cookie, iii) OAuth 2.0 and iv) Java
authentication and authorization service (JAAS)-based authentication.
Username-password based authentication is the most common way to authenticate
users while “remember me” cookie facilitates remembering users between
sessions. JASS and OAuth2.0 based authentication are a bit different since
they delegate the authentication requests to their corresponding JASS server
and OAuth 2.0 provider respectively.

Misconfiguring them can lead to a wide range of problems i.e., leaking
application secrets (e.g., access tokens, passwords, etc), enabling man-in-
the-middle (MitM), denial of service (Dos) attacks, etc.

Protection against exploits. Spring security also provides protections against
common exploits. In most of the cases, these protections are enabled by
default. To protect against CSRF attacks, Spring security offers the following
protections; i) CSRF token and ii) “SameSite Attribute”-based protection. CSRF
token-based protection ensures the presence of CSRF token in the HTTP request
header to indicate its legitimacy. In “SameSite Attribute”-based protection,
the browser only sends the “SameSite” session cookie if and only if both the
requested resource and the resource in the top-level browsing context match
the cookie. Spring security also enables sending common HTTP security headers
by default including, HTTP Strict Transport Security, X-Frame-Options, X-XSS-
Protection, etc. Spring security also enables Strict Transport Security by
default to redirect HTTP traffic to HTTPS.

###  II-B Methodology of the study

To systematically discover security anti-patterns, we develop the following
methodology. First, we collect a dataset of real-world enterprise application
source codes that uses Spring security. Then, we carefully analyze and collect
their security configurations by using a descriptive coding technique [21].
After finding the use of a security feature, we extensively match its
configuration with the following seven knowledge-base of common security
issues; i) Common Weakness Enumeration (CWE) [22], ii) Openstack security
anti-patterns alert list [23], iii) Spring security official reference guide
[24], iv) Apigee Edge anti-patterns [25], v) Snyk vulnerability Database [26],
vi) previous research work on security anti-patterns [27, 28, 29, 30, 31],
vii) RFC documents [32, 33, 34, 35]. If any of these knowledge-base indicates
an insecure configuration, we analyze severity in the context of their usage.
If an insecure configuration is the result of a customization, we mark it as a
security anti-pattern. Otherwise, we mark it as an insecure default
configuration.

##  III Security Anti-patterns in Spring Security

TABLE I: Identified security misuses are presented with their corresponding knowledge-base references, affecting features, threats, severity and counts in 28 GitHub projects. High, medium, and low severity levels are denoted by H/M/L respectively. Type | Rule | Reference | Feature | Threat | Severity | Count (28)
---|---|---|---|---|---|---
Anti-patterns | (1) Using lifelong valid access tokens | [25, 22, 29] | Authentication | Secrets leaking | M | 7
(2) Absence of state param in redirect URL | [29] | Authentication | CSRF attacks | H | 11
(3) Using fixed secret to sign JWT tokens | [22, 28, 34] | Authentication | Brute-force | M | 14
(4) Storing secrets in insecure places | [26] | Authentication | Secrets leaking | H | 17
(5) Disabling CSRF protection | [26, 27] | Exploit protection | CSRF attacks | H | 17
(6) Not using TLS for HTTP communication | [22, 26, 28] | Exploit protection | Man-in-the-middle | H | 15
Insecure defaults | (7) Using Bcrypt with insecure params | [24] | Authentication | Brute-force | H | 11
(8) Using MD5 in remember me cookie | [23, 28] | Authentication | Brute-force | H | N/A
(9) Lack of req. throttling policy per API key | [33, 22] | Exploit protection | DoS attacks | L | N/A
(10) Absence of content security policy (CSP) | [26] | Exploit protection | Code injection | L | N/A

In this section, first, we will present our analysis result on the collected
data and then briefly illustrate each common security misuse and their
severity.

Data collection. We collected the source code of 28 applications hosted on
GitHub that uses Spring security. 8 of the selected projects are real-world
enterprise applications and 20 of them are demo projects with example use of
Spring security framework. We considered the following three criteria to
filter them [36]:

  * •

#Forks. The number of times the project has been forked. This gives an
indication that these repositories have been adopted widely by other
developers in their own code base [37].

  * •

#Stars. The number of times the project has been starred by other developers
which ensures that the curated repository is popular [38] among other
developers.

  * •

Originality. The project is not a clone or copy of another existing project.

###  III-A Analysis Result

After analyzing the usage of Spring security framework of the selected
projects, we identified 6 Spring security anti-patterns and 4 insecure default
behaviors. Table I presents these security misuses, with their reference
knowledge-base, affecting features, threat, severity, and counts in 28
projects. After that, we divided the dataset into two groups i.e., i) 8 real-
world applications and ii) 20 demo projects. Then we cross-checked the
security misuse instances across them. Table II, presents the results of our
analysis. Although the misuse count ratio is higher in demo projects than the
real-world projects, the nature of the misuse cases are vastly overlapped
(Column 3 in Table II). It will be interesting to see whether (and how)
developers are being influenced by these insecure demo codebases that can be
directly copied.

Next, we describe each of them, their severity, and recommend suggestions on
how developers can properly resolve them. After that, we present several
interesting case studies.

TABLE II: Security misuse counts for 8 real-world and 20 demo projects.

Anti-patterns | Real-word | Demo | Common
---|---|---|---
| projects (8) | projects (20) | cases
(1) lifelong valid access tokens | 1 | 6 | 0
(2) Absence of state param | 2 | 9 | 2
(3) Fixed secrets to sign JWT tokens | 6 | 8 | 4
(4) Storing secrets in insecure places | 5 | 12 | 5
(5) Disabling CSRF protection | 6 | 11 | 6
(6) Not using TLS | 4 | 11 | 4

###  III-B Common Spring security anti-patterns

####  III-B1 Using lifelong valid access tokens

Spring security allows the developers to specify an expiration time for each
randomly generated access tokens. Developers want access token with a long
lifetime as they are easier to manage. However, on the other hand, long
lifetime increases the risk of reply attacks if any access token gets leaked.
The general advise from [25, 23, 32] is to keep the life time just a bit
longer than a normal user session time which can be generalized to a period of
15 minutes to 2 hours depending on different use cases. However, we have
noticed a security anti-pattern among developers of setting lifetime of access
token primarily arbitrary long in the range of 10-20 days as shown on listing
1.

Listing 1: Setting lifelong valid access token

⬇

1 app:

2 auth:

3 tokenExpirationMsec: 864000000

4 // setting unnecessary long lifetime of 10 days

To avoid this security anti-pattern, we suggest the developers to minimize the
lifetime of access token as much as possible so that whenever an attacker
tries to reply the previously leaked secret access token it would already pass
the expiration period. We also suggest to leverage refresh token to facilitate
the user to provide a new access token effectively each time when the lifetime
of an access token expires.

####  III-B2 Absence of state parameter in OAuth 2.0 Redirect URLs

The continuous influx of increasing popularity of OAuth 2.0 [39] among
developers motivated the active Spring security community to introduce the
support for OAuth 2 in its lasted release [40]. One of the most crucial parts
among many of OAuth 2.0 authorization framework is sending the auth_code
generated by authorization server to client applications via redirection URLs
[32]. Interestingly redirect URL has a well define structure with guessable
query parameters (1st redirect URL on Fig. 1). This can enable the attacker to
construct a similar but malicious redirect URL by replacing user’s auth code
with their own auth code (2nd redirect URL on Fig. 1). By making the victim
user clicking on this malicious redirect URL, attacker can perform a forced
login CSRF attack [41].

To prevent this, RFC-6819 [33] has recommended a strict guideline to add an
additional state parameter - the value of which is randomly generated (as
shown on the 3rd redirect URL in Fig. 1). In this way the attacker won’t be
able to guess the value of state parameter and construct a malicious redirect
URL. However, we have noticed in contrast to this strict recommendation,
developers tend not to use the additional state parameter in redirect URL
rendering the client application vulnerable to previously mentioned forced
login attack CSRF attack. Hence we consider the missing of state parameter in
redirect URL as a security anti-pattern.

Figure 1: The 2nd redirect URL constructed from 1st is vulnerable to forced
login CSRF attack. The 3rd redirect URL is not vulnerable due to the non
guessable state parameter.

The proper way to handle this security anti-pattern is to randomly generate a
value and add this value to the state parameter in the redirect URL as shown
on listing 2.

Listing 2: Adding state param in redirect_URL

⬇

1 public String getToken(@RequestParam String code){

2 ...

3 params.add("grant_type","authorization_code");

4 params.add("code",code);

5 params.add("client_id","aiqiyi");

6 params.add("client_secret","secret");

7 params.add("state",127621437303857);

8 // Randomly generated value of state param

9 ...

10 }

####  III-B3 Using fixed secrets to sign JWT tokens

Spring security facilities the use of JSON Web Tokens (JWT) [42] to
authenticate users by adding JwtTokenFilter to the DefaultSecurityFilterChain
with only a few lines of additional code. The way JWT works is that there a
set of claims embedded inside JWT and the server signs these claims
cryptographically using secret key(s). The user must present these
cryptographically signed claims to the server and then the server verifies
them to check the authentication of these presented claims. This design allows
the server to be stateless and consequently scalable which is one of the major
reasons behind the emerging popularity of JWT.

However, we noticed that developers tend to sign the claims of JWT
cryptographically by predictable fixed secret key which makes it inherently
vulnerable [8] and relatively easy for attackers to crack the fixed secret key
by brute force attacks.

⬇

1 public class TokenProvider {

2 public String createToken(Authentication auth) {

3 Public String JWT_SIGN_KEY = "123456";

4 token = Jwts.builder()

5 ...

6 .signWith(SignatureAlgorithm.HS512, JWT_SIGN_KEY)

7 // signing with a hard coded fixed secret

8 .compact();

9 ...

10 return token;

11 }

12 }

This insecure practice of using a fixed secret to sign all JWT can lead to a
great inconvenience frequently when any one of the valid JWT gets leaked.
Because then invalidating the leaked JWT would require the developer to change
the fixed secret manually. This would automatically invalidate all other valid
JWT as well which have not been leaked. Perhaps a quick way around instead of
changing the fixed secret would be to keep a blacklist for leaked JWT in the
database. However keeping, maintaining, and querying to the database if the
JWT is blacklisted for each request can be expensive and most importantly
introduces scalability problems, which is one of the very basic problems why
JWT was introduced and is popular among developers.

RFC-8725 [35] strongly discourages this insecure coding practice and advises
the developers to use random cryptographic keys with sufficient entropy. To
solve this problem, we suggest to leverage the optionally available JWT key
identifier parameter kid which can be leveraged for managing multiple randomly
generated secret keys [34].

####  III-B4 Storing secrets in insecure places

To avoid application specific secrets e.g., password, DB-root password from
being leaked developers need to avoid keeping them in unsafe places (e.g.,
plain-text, local storage). We have noticed a security anti-pattern among
developers to write the application specific secrets to application.yml
configuration file in plain text as shown in listing 3.

Listing 3: Stroing secrets insecurely in application.yml

⬇

1 spring:

2 datasource:

3 username: root

4 password: uOtmALFgsfxgYzEg1uLXl3O

To circumvent this security anti-pattern and to handle application specific
secrets securely, Spring vault facilitates a succinct solution. Spring vault
which is an abstraction layer on top of HashiCorp vault [43] providing
annotation based access for clients to store and retrieve secrets in a secure
way as shown in listing 4.

Listing 4: Retrieving secrets from Spring vault

⬇

1 @Value("${clientPassword}")

2 String client_password;

####  III-B5 Disabling CSRF protection

Spring security by default secures the web applications by defining a method
csrf() and implicitly enabling this function invocation for each state-
changing request (e.g., PATCH, POST, PUT, DELETE) [44]. We have observed a
recurring insecure practice among developers to manually disabling the default
CSRF protection as shown on listing 5.

Listing 5: Manually disabling default CSRF protection

⬇

1 @Override

2 protected void configure(HttpSecurity hs) throws Exception {

3 hs.csrf.disable()

4 }

Spring security’s inherently different CSRF protection mechanism is a
plausible answer to the prominence of this insecure coding practice. Spring
security makes the CSRF token inaccessible to the front-end of the application
by setting httpOnly to true. Being unable to access the CSRF token, front-end
JavaScript frameworks (e.g., Angular JS, Vue JS, Laravel etc.) will throw
configuration errors. To avoid these errors developers primarily tend to turn
off the default CSRF protection the developers seeking a short workaround way
without understanding the insecurity associate with doing so.

The proper way to circumvent this error is to

set httpOnly to false as shown on listing 6. That being said, we want to point
out that even though setting the httponly to false can reveal the CSRF token
to JavaScript loaded from the same domain, third party JavaScript loaded from
different domain will not be able to access the access token because of same-
origin policy; thereby defeating Cross Site Scripting attacks.

Listing 6: Proper way to circumvent CSRF misconfiguration errors

⬇

1 @Override

2 protected void configure(HttpSecurity hs) throws Exception {

3 hs.csrf(c -> c

4 .csrfTokenRepository(CookieCsrfTokenRepository

5 .withHttpOnlyFalse())

6 // Marking the CSRF Token’s HttpOnly to False.

7 )

8 }

We further want to emphasize that disabling CSRF protection itself is not
always a security problem when authentication is done via bearer tokens.
However, it can be a severe security problem when Spring security will perform
authentication based on the authentication cookie (i.e., JESSIONID) stored on
the user’s browser.

####  III-B6 Not using TLS for HTTP communications

The security of many components of authentication and authorization packages
in Spring security (e.g., oauth 2.0, SAML 2.0, CAS, OpenID connect) recommend,
and in some cases mandate the use of TLS. However, our analysis found that
developers tend to avoid the use of TLS in many places and show a similar
trend highlighted in previous study [5, 12, 45].

⬇

1 eureka:

2 client:

3 serviceUrl:

4 defaultZone: http:root@paascloud-eureka:8761

5 // use of HTTP without TLS

Although, it is difficult to create, install, find, and validate TLS
certificates in development environment, we suggest the developers to enable
TLS in the production environment as suggested in [6].

###  III-C Insecure default configuration

####  III-C1 Using BCrypt with insecure params

Spring security supports multiple ways to implement a PasswordEncoder. A brief
summary of them is presented in section A. Here, we focus on
BCryptPasswordEncoder, which is popularly used to encode passwords. We found
that the default configuration of BCryptPasswordEncoder is vulnerable to
brute-force attacks.

BCryptPasswordEncoder is based a deliberately slow hashing function Bcrypt
[46]. This slowness or number of rounds in Bcrypt is one of the key factors
which makes it resistant to do feasible brute-force attack. The security
strength (i.e., slowness or number of rounds) of BCryptPasswordEncoder can be
specified by the developers as a parameter to the constructor. However we
noticed that the default strength of BCryptPasswordEncoder is $10$ ($2^{10}$
number of rounds) [47]. However as mentioned previously [17] and confirmed by
our own experiments presented in Appendix B, this default strength does not
have enough slowness and essentially lack the security strength needed to
prevent brute-force attack.

As developers tend not to pass any security strength parameter to the
constructor assuming the default strength is secure enough, this tendency (as
shown on listing 7) leaves an exploitable opportunity for the attackers.

Listing 7: Default strength is vulnerable to brute-force attack

⬇

1 @Bean

2 public PasswordEncoder passwordEncoder() {

3 return new BCryptPasswordEncoder();

4 /* using default strength 10 is vulnerable

5 to feasible brute-force attacks */

6 }

Hence, we consider using the default insecure strength for
BcryptPasswordEncoder as an insecure default configuration and recommend the
developers to override the default strength by adjusting it according to their
own system.

####  III-C2 Using weak hash algorithm MD5 in remember-me cookie

Spring security provides remember-me which stored in the browser. allows the
browser to remember the user for future sessions and causing automated login
to take place. This remember-me cookie is constructed from the MD5 hashing of
the username, expiration time of the cookie, and password and secret key as
shown in listing 8.

Listing 8: Construction of remember-me cookie

⬇

1 base64(username + ":" + expirationTime + ":" +

2 md5Hex(username + ":" + expirationTime +

3 // Use of weak hashing algorithm MD5

4 ":" password + ":" + key))

The problem with this approach is that MD5 is considered broken, which
susceptible to collision attacks [48] and modular differential attacks [49].
Hence, attackers can easily recover sensitive information or temper the
remember-me cookie. Therefore, we suggest the Spring security maintainers to
fix this issue by replacing MD5 with a secure hashing algorithm (e.g.,
SHA-256).

####  III-C3 Lack of required throttling policy per API key

One of the most important parts of resource management policy for web API is
to set a proper throttling policy per user. This throttling policy places a
limit on the number of requests a user can make with a secret API key.
Otherwise, an attacker can use use a valid secret API key to generate a
massive number of requests than the web service can handle. In this way, the
attacker will be able to make a denial of service attack for other users.
However, unlike other security framework (e.g., Django [50]), Spring security
lacks this as a built-in feature given the prevalence of this DoS attack with
custom made bots. An IP-based throttling policy can prevent DoS attack but
then attackers can switch to DDoS attack to abuse valid API keys. We suggest a
manual solution where the developers build custom filter and register it in
the Spring context.

Listing 9: Example of adding content security policy headers

⬇

1 @Override

2 protected void configure(HttpSecurity hs) {

3 hs

4 ...

5 .headers(headers -> headers

6 .contentSecurityPolicy(csp -> csp

7 .policyDirectives("script-src ’self’"))

8 ...

9 }

####  III-C4 Absence of content security policy

Unexpectedly, unlike other protection mechanisms, Spring security does not add
content security policy (CSP) HTTP headers by default. CSP helps the
developers to enforce a fine-grained security policy easily to prevent code
injection attacks e.g., cross site scripting, clickjacking, and data
injection, etc. For example, if a developer perceives JavaScript from all
external sources as untrusted then the developer needs to set the CSP header
to self to prevent the browser from loading unsafe JavaScript from any
untrusted external sources as shown on listing 9.

We have noticed a prominent tend among developers of not adding the CSP
headers manually even though adding the headers CSP to prevent varieties of
code injection attacks is important. Especially, because these code injection
attacks are not trivial to prevent from security stand point. Developers might
perceive that just like other protection mechanisms CSP headers are provided
by default on in Spring security. Hence, we consider the case of not setting
the CSP HTTP headers as an insecure default.

###  III-D Severity of the misconfigurations

Each security misuses discussed in the previous section III-B, III-C has
specific attack vectors presented in the literature. To prioritize them based
on their security severity, we group them into three categories high, medium,
and low. In this regard we consider two criteria i) attack difficulty, and ii)
attacker’s gain as inspired from the Common Vulnerability Scoring System
(CVSS) calculator [51]. The assignments of these severities to identified
security misuses are highlighted in Table I and described as follows.

####  III-D1 High

Anti-patterns causing CSRF and man-in-the-middle attacks are easy to construct
and provide large gain for the attackers. Insecure default MD5 in remember me
cookie and BCrypt with insecure param can be brute-force easily given the high
number of available cracking tools. Attacks originating from exploiting
secrets stored in insecure places are easy to construct as well.

####  III-D2 Medium

Attackers can try to do offline brute force attack to guess the fixed secret
key used to sign the JWT token which can be time consuming depending on the
entropy/randomness level and length of the fixed secret key. Moreover lifelong
access token can be reused/replayed by attackers if and only if it is leaked.

####  III-D3 Low

We place the two insecure defaults which depend on the presence of another
vulnerability for the attacker to take advantage. For example absence of
content security policy can be leveraged if and only if there is Cross site
vulnerability already present. In the same way lack of required throttling
policy per API key can cause DoS/DDoS attack if attacker can bypass the
network level protection to mitigate DoS/DDoS attack in the first place.

###  III-E Case Study

Simplicity and performance over insecure practices. In one real-world
application, we saw the following comments before one of the security anti-
pattern.

“THIS IS NOT A SECURE PRACTICE! For simplicity, we are storing a static key
here.”

In another case, a developer responded to us for a potential CSRF attack due
to the absence of state parameter in redirect URL as following,

“Increasing the state parameter can effectively prevent CSRF attacks. But my
demo is just a simple sso demonstration. The simplest way to demonstrate the
entire sso interaction process does not need to consider CSRF attacks.”

In another project, we noticed that the developer intentionally downgraded the
default strength $10$ ($2^{10}$ rounds) of BCryptPasswordEncoder to $8$ to
increase the performance. This illustrates that developers more often prefer
simplicity and performance over secure coding practices.

Storing application secrets in config file. We observed that in 3 applications
and 8 demo applications, developers stored secrets in the application.yml.
Especially, we observed 5 number of applications to store secrets to sign the
JWT in application.yml files. It is recommended to store these secrets in the
server’s key stores [12].

Separating development and production environments. Sometimes developers avoid
configuring TLS in their development environment [45]. A similar configuration
will cause a devastating effect on the production environment. Spring security
enables separating two different environments by simply using two separate
configuration files. However, we observed that in 13 projects, developers used
the same configuration of insecure TLS in both development and production.

##  IV Discussion

Disclosure of our findings. We made an effort to share our concerns about
these 3 major vulnerabilities found with the Spring security community. We
created two pull requests and one issue on the master branch of Spring
security project about i) replacing weak MD5 with a strong hashing algorithm
SHA-256 ii) adding proper guidelines in Spring security official documentation
about setting a secure strength for BCryptPasswordEncoder iii) possibility of
performing DoS attack exploiting lack of required throttling policy per API
key. The second request was already accepted and the community agreed with us
on others. However, they expressed to remain _passive_ for now but will
consider bringing our suggested changes in the next Spring security major
release. We also reported some of the severe cases to the application
developers and in the process of disclosing others.

Limitations. The derived security anti-patterns are mainly based on manual
inspection and therefore is subjected to human bias. To address this, the
first two authors of the paper carefully and independently apply analysis
multiple times to verify the security anti-patterns. We also acknowledge that
the data-set constructed by popularity and adaption measure is susceptible to
subjectivity, as this filtering measure may incorrectly remove some relevant
projects using spring security.

##  V Conclusion

Without careful considerations, customizing application frameworks can cause
critical vulnerabilities in an enterprise application. In this paper, we
studied the application framework misconfiguration vulnerabilities in the
light of Spring security. First, by analyzing 28 Spring security applications,
we identified 6 security anti-patterns and 4 insecure default behaviors
representing possible insecure use-cases of Spring security. Our analysis
showed that the security anti-patterns are prevalent and similar across the
real-world and demo applications, hence, pose a realistic threat.

## References

  * [1] D. C. Schmidt and F. Buschmann, “Patterns, frameworks, and middleware: Their synergistic relationships,” in Proceedings of the 25th International Conference on Software Engineering, May 3-10, 2003, Portland, Oregon, USA, pp. 694–704, 2003.
  * [2] “2020 java technology report.” https://www.jrebel.com/blog/2020-java-technology-report.  [Online; accessed 30-April-2020].
  * [3] “Developer survey results 2019: Web frameworks.” https://insights.stackoverflow.com/survey/2019#technology-_-web-frameworks.  [Online; accessed 30-April-2020].
  * [4] “Spring Security.” https://spring.io/projects/spring-security.  [Online; accessed 28-April-2020].
  * [5] N. Meng, S. Nagy, D. Yao, W. Zhuang, and G. A. Argoty, “Secure Coding Practices in Java: Challenges and Vulnerabilities,” in ACM ICSE’18, (Gothenburg, Sweden), May 2018.
  * [6] M. Georgiev, S. Iyengar, S. Jana, R. Anubhai, D. Boneh, and V. Shmatikov, “The most dangerous code in the world: validating SSL certificates in non-browser software,” in ACM CCS’12, 2012.
  * [7] S. Fahl, M. Harbach, T. Muders, M. Smith, L. Baumgärtner, and B. Freisleben, “Why Eve and Mallory love Android: an analysis of Android SSL (in)Security,” in ACM CCS’12, pp. 50–61, 2012.
  * [8] M. Egele, D. Brumley, Y. Fratantonio, and C. Kruegel, “An empirical study of cryptographic misuse in android applications,” in Proceedings of the 2013 ACM SIGSAC conference on Computer & communications security, pp. 73–84, 2013.
  * [9] F. Fischer, K. Böttinger, H. Xiao, C. Stransky, Y. Acar, M. Backes, and S. Fahl, “Stack Overflow Considered Harmful? The Impact of Copy&Paste on Android Application Security,” in IEEE S&P’17, pp. 121–136, 2017.
  * [10] S. Krüger, J. Späth, K. Ali, E. Bodden, and M. Mezini, “CrySL: An Extensible Approach to Validating the Correct Usage of Cryptographic APIs,” in ECOOP’18, pp. 10:1–10:27, 2018.
  * [11] R. Paletov, P. Tsankov, V. Raychev, and M. T. Vechev, “Inferring crypto API rules from code changes,” in Proceedings of the 39th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2018, pp. 450–464, 2018.
  * [12] S. Rahaman, Y. Xiao, S. Afrose, F. Shaon, K. Tian, M. Frantz, M. Kantarcioglu, and D. Yao, “Cryptoguard: High precision detection of cryptographic vulnerabilities in massive-sized java projects,” in Proceedings of the 2019 ACM SIGSAC Conference on Computer and Communications Security, pp. 2455–2472, 2019.
  * [13] M. Chen, F. Fischer, N. Meng, X. Wang, and J. Grossklags, “How reliable is the crowdsourced knowledge of security implementation?,” in Proceedings of the 41st International Conference on Software Engineering, ICSE 2019, Montreal, QC, Canada, May 25-31, 2019, pp. 536–547, 2019.
  * [14] Y. Acar, M. Backes, S. Fahl, S. L. Garfinkel, D. Kim, M. L. Mazurek, and C. Stransky, “Comparing the usability of cryptographic apis,” in 2017 IEEE Symposium on Security and Privacy, SP 2017, San Jose, CA, USA, May 22-26, 2017, pp. 154–171, 2017.
  * [15] Y. Acar, C. Stransky, D. Wermke, C. Weir, M. L. Mazurek, and S. Fahl, “Developers need support, too: A survey of security advice for software developers,” in IEEE Cybersecurity Development, SecDev 2017, Cambridge, MA, USA, September 24-26, 2017, pp. 22–26, 2017.
  * [16] A. Bianchi, Y. Fratantonio, A. Machiry, C. Kruegel, G. Vigna, S. P. H. Chung, and W. Lee, “Broken fingers: On the usage of the fingerprint API in android,” in 25th Annual Network and Distributed System Security Symposium, NDSS 2018, San Diego, California, USA, February 18-21, 2018, 2018\.
  * [17] “Recommended # of rounds for bcrypt.” https://security.stackexchange.com/questions/17207/recommended-of-rounds-for-bcrypt.  Last accessed: 2020-04-01.
  * [18] A. Dikanski, R. Steinegger, and S. Abeck, “Identification and implementation of authentication and authorization patterns in the spring security framework,” in The Sixth International Conference on Emerging Security Information, Systems and Technologies (SECURWARE 2012), pp. 14–30, 2012.
  * [19] A. Armando, R. Carbone, E. G. Chekole, and S. Ranise, “Attribute based access control for apis in spring security,” in Proceedings of the 19th ACM Symposium on Access Control Models and Technologies, SACMAT ’14, (New York, NY, USA), p. 85–88, Association for Computing Machinery, 2014.
  * [20] “Authentication Mechanisms.” https://docs.spring.io/spring-security/site/docs/current/reference/html5/#servlet-authentication.  Last accessed: 2020-04-01.
  * [21] J. Saldaña, The coding manual for qualitative researchers.  Sage, 2015.
  * [22] “MITRE.” https://cwe.mitre.org/index.html.  Last accessed: 2020-04-01.
  * [23] “Openstack Security Impact Check.” %****␣main.bbl␣Line␣125␣****https://wiki.openstack.org/wiki/Security/OpenStack_Security_Impact_Checks#Testing_for_Security_Anti-patterns.  [Online; accessed 29-April-2020].
  * [24] “Spring Security Reference.” https://docs.spring.io/spring-security/site/docs/5.3.0.RELEASE/reference/html5.  [Online; accessed 29-April-2020].
  * [25] “Introduction to antipatterns.” https://docs.apigee.com/api-platform/antipatterns/intro.  Last accessed: 2020-04-01.
  * [26] “Vulnerability DB — Snyk.” https://snyk.io/vuln.  Last accessed: 2020-04-01.
  * [27] T. Nafees, N. Coull, I. Ferguson, and A. Sampson, “Vulnerability anti-patterns: A timeless way to capture poor software practices (vulnerabilities),” in Proceedings of the 24th Conference on Pattern Languages of Programs, PLoP ’17, (USA), The Hillside Group, 2017.
  * [28] A. Rahman, “Anti-patterns in infrastructure as code,” in 2018 IEEE 11th International Conference on Software Testing, Verification and Validation (ICST), pp. 434–435, IEEE, 2018.
  * [29] P. Siriwardena, Advanced API Security.  Springer, 2014.
  * [30] R. G. Kula, D. M. German, A. Ouni, T. Ishio, and K. Inoue, “Do developers update their library dependencies?,” Empirical Softw. Engg., vol. 23, p. 384–417, Feb. 2018.
  * [31] M. del Pilar Salas-Zárate, G. Alor-Hernández, R. Valencia-García, L. Rodríguez-Mazahua, A. Rodríguez-González, and J. L. L. Cuadrado, “Analyzing best practices on web development frameworks: The lift approach,” Science of Computer Programming, vol. 102, pp. 1–19, 2015.
  * [32] Internet Engineering Task Force, “The OAuth 2.0 authorization framework.” https://tools.ietf.org/html/rfc6749.  Last accessed: 2020-04-01.
  * [33] Internet Engineering Task Force (IETF), “OAuth 2.0 threat model and security considerations.” https://tools.ietf.org/html/rfc6819.  Last accessed: 2020-04-01.
  * [34] “Json Web Signature (JWS).” https://tools.ietf.org/html/rfc7515.  Last accessed: 2020-04-01.
  * [35] “Json Web Token Best Current Practices.” https://tools.ietf.org/html/rfc8725.  Last accessed: 2020-04-01.
  * [36] N. Munaiah, S. Kroh, C. Cabrey, and M. Nagappan, “Curating github for engineered software projects,” Empirical Software Engineering, vol. 22, no. 6, pp. 3219–3253, 2017.
  * [37] J. Jiang, D. Lo, J. He, X. Xia, P. S. Kochhar, and L. Zhang, “Why and how developers fork what from whom in github,” Empirical Software Engineering, vol. 22, no. 1, pp. 547–578, 2017.
  * [38] H. Borges, A. Hora, and M. T. Valente, “Understanding the factors that impact the popularity of github repositories,” in 2016 IEEE International Conference on Software Maintenance and Evolution (ICSME), pp. 334–344, IEEE, 2016.
  * [39] “IETF OAuth working group.” https://oauth.net/2.  Last accessed: 2020-04-01.
  * [40] “What’s New in Spring Security 5.0.” https://docs.spring.io/spring-security/site/docs/5.0.x/reference/htmlsingle/#new-features.  Last accessed: 2020-04-01.
  * [41] A. Barth, C. Jackson, and J. C. Mitchell, “Robust defenses for cross-site request forgery,” in Proceedings of the 15th ACM conference on Computer and communications security, pp. 75–88, 2008.
  * [42] “Internet engineering task force (IETF), oauth 2.0 threat model and security considerations.” https://tools.ietf.org/html/rfc7519.  Last accessed: 2020-04-01.
  * [43] “Vault by HashiCorp.” https://www.vaultproject.io.  Last accessed: 2020-04-01.
  * [44] “java - simple example of spring security with thymeleaf.” https://stackoverflow.com/questions/25692735/simple-example-of-spring-security-with-thymeleaf.  Last accessed: 2020-04-01.
  * [45] A. Rahman, C. Parnin, and L. Williams, “The seven sins: Security smells in infrastructure as code scripts,” in 2019 IEEE/ACM 41st International Conference on Software Engineering (ICSE), pp. 164–175, IEEE, 2019.
  * [46] N. Provos and D. Mazières, “A future-adaptive password scheme,” in Proceedings of the Annual Conference on USENIX Annual Technical Conference, ATEC ’99, (USA), p. 32, USENIX Association, 1999.
  * [47] “Bcryptpasswordencoder (spring-security-docs-manual 5.3.2.RELEASE API).” https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/crypto/bcrypt/BCryptPasswordEncoder.html.  Last accessed: 2020-04-01.
  * [48] B. Den Boer and A. Bosselaers, “Collisions for the compression function of md5,” in Workshop on the Theory and Application of of Cryptographic Techniques, pp. 293–304, Springer, 1993.
  * [49] X. Wang and H. Yu, “How to break md5 and other hash functions,” in Annual international conference on the theory and applications of cryptographic techniques, pp. 19–35, Springer, 2005.
  * [50] “Throttling- Django REST framework.” https://www.django-rest-framework.org/api-guide/throttling/.  Last accessed: 2020-04-01.
  * [51] “Common Vulnerability Scoring System.” https://www.first.org/cvss/calculator/3.0.  Last accessed: 2020-04-01.

##  Appendix A Implementations of Password hashing

Spring security provides an array of PasswordEncoder implementation for
storing password. We provide here a summary of these implementations. However
among them Md4Password, MessageDigest, Standard, and LdapSha password encoders
use digest based password encoding which is not considered secure. As a result
they are deprecated to indicate that they are legacy implementation.
Argon2Password and SCryptPassword password encoder uses Bouncy castle. One
problem associated with this is that Bouncy castle does not exploit
parallelism/optimizations that other password crackers will. Therefore there
is an uneven asymmetry between attacker and defender. The most recommended way
to implement the PassworEncoder interface is BCryptPasswordEncoder. Table III
summarizes the 9 option for password encoding offered by Spring security.

TABLE III: Summary of Password encoding interface implementations

Implementation Name | Comment
---|---
BCryptPasswordEncoder | preferred implementation
NoOpPasswordEncoder | stores password in plain-text
Md4PasswordEncoder | digest based password encoding
MessageDigestPasswordEncoder |
StandardPasswordEncoder |
LdapShaPasswordEncoder |
Argon2PasswordEncoder | uses Bouncy castle
SCryptPasswordEncoder |
Pbkdf2PasswordEncoder | uses PBKDF2

##  Appendix B Insecure default strength for BCryptPassword Encoder

The Spring security reference guide mentions that the strength of
BCryptPasswordEncoder should be tuned to take about 1 second to verify a
password on the developer’s own system. However, according to our experiments
the default strength of BCryptPasswordEncoder which is 10 (number of rounds
$2^{10}$) takes around $~{}0.1$ seconds to verify a password. This is way less
than 1 second lower limit. Since developers tend to use the default strength
without any consideration assuming that the default implementation should have
enough strength we consider this an insecure default configuration.

On our system (LENOVO Ideapad- Intel(R) Core(TM) i5 CPU @ 1.60GHz - 7.4 GiB
RAM - running Ubuntu 20.04 64 bit), we found out that appropriate secure
strength should be 14 as shown on Figure 2. We emphasize that for GPU which
can perform orders of magnitude faster than a typical CPU like the one we have
used, the appropriate secure strength to prevent feasible brute-force attack
should be higher than 14.

Figure 2: Mean time to verify a password of size 128 bits on our own system
for different strength. Ideally the strength should add enough slowness so
that it takes at least 1 sec to verify a password as marked by the horizontal
dashed line.

##  Appendix C Finding vulnerabilities in 8 real world projects

We also test the 8 real-world projects using a know vulnerability scanning
tool Snyk [26] and then parse the scanning results. Snyk maintains an online
database of known vulnerability and can automatically build the project to
check against these known vulnerabilities. A summary of the results is shown
in Table IV.

TABLE IV: # of vulnerability found and their risk level in 8 real world
applications using Snyk. Risk level High, medium, and low are denoted by H, M,
L respectively.

No | Project | # forks | # stars | LoC | Risk | # of
---|---|---|---|---|---|---
| name |  |  |  | level | vulnerabilities
1 | paascloud-master | 3.6k | 7.7k | 55.8k | H | 68
|  |  |  |  | M | 18
|  |  |  |  | L | 7
2 | xboot | 968 | 2.6k | 21.2k | H | 3
|  |  |  |  | M | 3
|  |  |  |  | L | 0
3 | Spring-boot-cloud | 1.2k | 2k | 523 | H | 71
|  |  |  |  | M | 18
|  |  |  |  | L | 7
4 | sso | 323 | 702 | 3.3k | H | 55
|  |  |  |  | M | 10
|  |  |  |  | L | 5
5 | FEBS-cloud | 326 | 660 | 11.9k | H | 5
|  |  |  |  | M | 6
|  |  |  |  | L | 1
6 | fw-cloud-framework | 325 | 638 | 13.9k | H | 63
|  |  |  |  | M | 6
|  |  |  |  | L | 3
7 | cas | 3.2k | 7.5k | 33.5k | No vulnerability found
8 | microservices-platform | 736 | 1.6k | 25.4k | Can not run Snyk because of build errors


# Relaxation Critical Dynamics with Emergent Symmetry

Yu-Rong Shu  School of Physics and Materials Science, Guangzhou University,
Guangzhou 510006, China  Shuai Yin<EMAIL_ADDRESS>School of Physics,
Sun Yat-Sen University, Guangzhou 510275, China  Guangdong Provincial Key
Laboratory of Magnetoelectric Physics and Devices, School of Physics, Sun Yat-
sen University, Guangzhou 510275, China

###### Abstract

Different from usual critical point characterized by a single length scale,
critical point with emergent symmetry exhibits intriguing critical properties
characterized by two relevant length scales, attracting long-term
investigations from both theoretical and experimental aspects. A natural
question is how the critical dynamics is affected by the presence of two
relevant length scales. Here we study the relaxation critical dynamics in the
three-dimensional ($3$D) clock model, whose critical point has emergent $U(1)$
symmetry. We find that in contrast to the magnatization $M$, whose relaxation
process is described by the usual dynamic exponent $z$ of the $3$D $XY$
universality class, the angular order parameter $\phi_{q}$ shows a two-stage
evolution characterized by different dynamic critical exponents. While in the
short-time stage the relaxation dynamics is governed by $z$, in the long-time
stage the dynamics is controlled by a new dynamic exponent $z^{\prime}$. We
also show the off-critical-point effects in the critical relaxation. Our
results may be detected in the hexagonal RMnO3 (R$=$rare earth) materials
experimentally.

Introduction—Symmetry is at the heart of identifying, characterizing and
classifying phases and phase transitions, resulting in the profound notion of
the universality class, which is one of organizing principles in condensed
matter physics Landau  _et al._ (1999). At a critical point, long wave-length
fluctuations can gloss over some detailed information of the Hamiltonian,
endowing the critical system with higher emergent symmetry than that of the
original Hamiltonian. The emergent symmetry engenders plenty of intriguing
critical phenomena and attracts enormous investigations in various systems
ranging from classical to quantum phase transitions. For instance, in
classical systems, the three dimensional ($3$D) $q$-state clock model exhibits
$U(1)$ symmetry at the critical point for $q\geq 4$ Oshikawa (2000); Lou  _et
al._ (2007); Okubo  _et al._ (2015); Léonard and Delamotte (2015); Pujari  _et
al._ (2015); Ding  _et al._ (2016); Hasenbusch and Vicari (2011); Shao  _et
al._ (2020); Patil  _et al._ (2021). In quantum Dirac systems, the emergent
$U(1)$ symmetry arises at the fermion-induced quantum critical point hosted in
the Kekule VBS phase transition whose microscopic Hamiltonian has $Z_{3}$
discrete symmetry Li  _et al._ (2017); Jian and Yao (2017a, b); Torres  _et
al._ (2018); Classen  _et al._ (2017). In quantum magnets, the most prominent
example is the emergent symmetry appearing in deconfined quantum critical
point to reconcile different orders with incompatible symmetries T. Senthil
and Ashvin Vishwanath and Leon Balents and Subir Sachdev and Matthew P. A.
Fisher (2004); Senthil  _et al._ (2004); Nahum  _et al._ (2015); Wang  _et
al._ (2017); Takahashi and Sandvik (2020); Ma  _et al._ (2019).

A common feature for these critical points with emergent symmetry is that
there exists a dangerously irrelevant scaling variable (DISV), which is
irrelevant at the critical point, but relevant in the ordered phases Amit and
Peliti (1982). Pertinent to the DISV, a remarkable critical property stands
out: an extra divergent length scale $\xi^{\prime}$, measuring the thickness
of the domain walls in the ordered phase, develops, in addition to the
conventional correlation length $\xi$ Oshikawa (2000). Moreover, in sharp
contrast to usual critical properties dominated by single $\xi$, fertile
exotic scaling behaviors spring up as a result of the interplay between $\xi$
and $\xi^{\prime}$. Among them, the relation between $\nu^{\prime}$ and $\nu$,
which are critical exponents corresponding to $\xi^{\prime}$ and $\xi$,
respectively, is an enigmatic issue, and has attracted long-term interests
Nelson (1976); Amit and Peliti (1982); Miyashita (1997); Oshikawa (2000); Lou
_et al._ (2007); Okubo  _et al._ (2015); Léonard and Delamotte (2015); Hui
Shao and Wenan Guo and Anders W. Sandvik (2016); Shao  _et al._ (2020); Patil
_et al._ (2021); Jian and Yao (2017a, b); Torres  _et al._ (2018); Classen
_et al._ (2017).

Besides the static critical properties, symmetry and conserved quantities also
play pivotal roles in characterizing the critical dynamics. In particular, in
classical systems, different dynamic universality classes are classified
according to the symmetric property of the order parameter and the coupling
between the order parameter and the conserved secondary densities Hohenberg
and Halperin (1977); Folk and Moser (2006); Täuber (2014). Dictated by dynamic
universality classes, nonequilibrium critical dynamics shows colorful
universal time-dependent scaling behaviors and currently becomes one of the
most vibrant issues in statistical physics. A natural question is that how the
emergent symmetry with the DISV affects the critical dynamics. Recent
experiments in hexagonal RMnO3 (R$=$rare earth), which realize the critical
dynamics of $Z_{q}$-clock model, have shown that the scaling of topological
defects under external driving belongs to Model A with $3$D XY universality
class, establishing the “irrelevant” aspect of the DISV in critical dynamics
Chae  _et al._ (2012); Skjærvø  _et al._ (2019); Griffin  _et al._ (2012); Lin
_et al._ (2014); Meier  _et al._ (2017). However, it is still puzzling that
how the “dangerous” side of the DISV manifests itself in the dynamics. Thus, a
systematic numerical investigation is urgently called for.

In this paper, we study the dissipative nonequilibrium relaxation dynamics in
$3$D $Z_{q}$-clock model starting from an ordered initial state. For the $3$D
XY model, the magnitude and angular fluctuations share the same dynamic
exponent $z\approx 2$ Jensen  _et al._ (2000). For the $Z_{q}$-clock model, we
show that the whole relaxation process of the magnitude of magnetization $M$
is described by the usual correlation time scale $\zeta\propto\xi^{z}$
governed by the dynamic universality class of the $3$D XY model, showing the
irrelevant aspect of the DISV Oshikawa (2000); Lou  _et al._ (2007); Okubo
_et al._ (2015); Léonard and Delamotte (2015); Pujari  _et al._ (2015); Ding
_et al._ (2016); Hasenbusch and Vicari (2011); Shao  _et al._ (2020); Patil
_et al._ (2021). In contrast, the dynamics of the angular order parameter
$\phi_{q}$ is branded by the “dangerous” aspect of the DISV. A remarkable two-
stage evolution is discovered in the relaxation process of $\phi_{q}$. In the
short-time stage, $\phi_{q}$ is a dimensionless variable and its dynamics is
characterized by the $z$, whereas in the long-time stage $\phi_{q}$ gets a
scaling dimension from the DISV and its dynamics is characterized by a new
dynamic exponent $z^{\prime}\approx 2.25$, demonstrating that there is another
typical time scale $\zeta^{\prime}$ for angular fluctuation with
$\zeta^{\prime}\propto\xi^{\prime z^{\prime}}$. Off-critical-point effects are
then explored to confirm the dynamic scaling with $z^{\prime}$.

Model and numerical method—The Hamiltonian of the “hard” $Z_{q}$-clock model
in cubic lattice is Oshikawa (2000); Lou  _et al._ (2007); Okubo  _et al._
(2015); Shao  _et al._ (2020); Patil  _et al._ (2021)

$H=-\sum_{\langle ij\rangle}\cos(\theta_{i}-\theta_{j}),$ (1)

in which $\theta=2n\pi/q$ with $n\in\\{0,\cdots,q-1\\}$. The summation is
taken among nearest pairs denoted by $\langle\rangle$. In $3$D this model has
a direct phase transition between ordered and disordered phase at $T=T_{c}$,
as illustrated in Fig. 1. The discreteness of $\theta$ implies a Zq field
which serves as a hidden DISV and an emergent $U(1)$ symmetry appears at
$T_{c}$. An explicit DISV can be revealed in a “soft” version of (1) where the
angles vary continuously in $[0,2\pi)$, with an additional discrete symmetric
term $-h\sum_{i}\cos(q\theta_{i})$ serving as the DISV. When $q\geq 5$ for the
hard model and $q\geq 4$ for the soft model, the phase transition belongs to
the $3$D XY universality class Oshikawa (2000); Lou  _et al._ (2007); Okubo
_et al._ (2015); Léonard and Delamotte (2015); Pujari  _et al._ (2015); Ding
_et al._ (2016); Hasenbusch and Vicari (2011); Shao  _et al._ (2020); Patil
_et al._ (2021). However, when $T<T_{c}$ the discreteness becomes relevant and
the ordered phase breaks $Z_{q}$ symmetry. In addition to correlation length
$\xi$ with the $3$D XY exponent $\nu=0.6717(1)$ Shao  _et al._ (2020), the
critical point of (1) has another typical length scale $\xi^{\prime}$
describing the thickness of the domain wall, and the associated critical
exponent is $\nu^{\prime}$. The relation between $\nu^{\prime}$ and $\nu$ is
$\nu^{\prime}=\nu(1+|y_{q}|/p)$, in which $y_{q}$ is the scaling dimension of
the DISV depending on $q$, and a consensus of $p=2$ for the isotropic case was
obtained with scrutiny Ueno and Mitsubo (1991); Chubukov  _et al._ (1994);
Okubo  _et al._ (2015); Léonard and Delamotte (2015); Banerjee  _et al._
(2018); Shao  _et al._ (2020); Patil  _et al._ (2021).

Here we study the relaxation dynamics after a sudden quench from an ordered
initial state to the vicinity of the critical point at $t=0$, as shown in Fig.
1. The Monte Carlo method with standard Metropolis dynamics is used to
simulate the nonequilibrium evolution. The time unit is defined as a full
Monte Carlo sweep through the lattice. It has been shown that the relaxation
process belongs to the Model A universality class with the purely dissipative
physical evolution Täuber (2014), and is straightforward to implement in
experiments Chae  _et al._ (2012); Skjærvø  _et al._ (2019); Griffin  _et al._
(2012); Lin  _et al._ (2014); Meier  _et al._ (2017).

General scaling theory— For a physical quantity $P$ with dimension $\kappa$,
the general scaling form should satisfies

$P(t,g,L)=L^{-\kappa}f_{P}(tL^{-z},tL^{-z^{\prime}};gL^{1/\nu},gL^{1/\nu^{\prime}}),$
(2)

in which $g\equiv T-T_{c}$, $\kappa$ the scaling dimension of $P$, $\nu$,
$\nu^{\prime}$ correlation length exponents and $z$, $z^{\prime}$ dynamic
exponents. Here a second dynamic exponent $z^{\prime}$ is introduced as
$\zeta^{\prime}\propto\xi^{\prime z^{\prime}}$ in order to take account for
the time scale $\zeta^{\prime}$ describing the transverse fluctuations with
the DISV. In the absence of the DISV, Eq. (2) reduces into the usual scaling
form without $tL^{-z^{\prime}}$ and $gL^{1/\nu^{\prime}}$, which has been
verified by both renormalization group theory Fedorenko and Trimper (2006) and
numerical simulations Zheng (1998); Luo  _et al._ (1998); Stauffer (1992); Ito
(1993); Albano  _et al._ (2011). We explore the evolution of the square of
longitudinal order parameter $M^{2}=\langle M_{x}^{2}\rangle+\langle
M_{y}^{2}\rangle$, in which $\langle\rangle$ stands for statistical average.
The components are defined as $M_{x}\equiv\sum_{i}\cos(\theta_{i})/N$ and
$M_{y}\equiv\sum_{i}\sin(\theta_{i})/N$ with $N=L^{d}$. We also particularly
focus on the dynamics of the angular order parameter $\phi_{q}$ defined as
$\phi_{q}=\langle\cos(q\Theta)\rangle$ with $\Theta\equiv\arccos(M_{x}/M)$.
Note that $\phi_{q}$ characterizes the discrete symmetry breaking and becomes
nonzero in response to the $Z_{q}$ field. In equilibrium, $\phi_{q}$ is useful
in reflecting the scaling of the second length scale $\xi^{\prime}$Lou  _et
al._ (2007); Okubo  _et al._ (2015); Pujari  _et al._ (2015); Shao  _et al._
(2020); Patil  _et al._ (2021). In the following, without loss of generality,
we study the $q=5$ case but keep the notation of $q$ in the following.

Figure 1: Sketch of free energy landscape for different temperatures: (i)
ordered state at $T\ll T_{c}$ with the puddles representing the five possible
directions of $\theta$; (ii) critical state at $T_{c}$ with shallow minimum
region in the free energy; (iii) disordered state at $T\gg T_{c}$ with a deep
minimum in the free energy. The red arrow indicates a quench from an ordered
state (i) to the critical temperature (ii). The red sphere stands for an
ordered state with all spins pointing in the same chosen direction in (i) and
the relaxation after the quench in (ii). The blue arrow in (ii) indicates an
initial decrease of the magnitude of the order parameter and the yellow arrows
suggest the angular dispersion the order parameter.  Figure 2: Relaxation
dynamics of the $q$-state clock model quenched from an ordered state to the
critical point. (a1)-(a4): Distribution of $M_{x}$ and $M_{y}$ for four
typical time values characterizing different evolution stages. The five red
dots are a guide to the eye, showing the equilibrium value of $M$ and the
angular discreteness. (b1): Time dependence of $M^{2}$ for $L=16$ to $40$. The
dashed vertical lines which correspond to the time value in (a1)-(a4),
respectively, are shown to indicate different evolution stages. The solid line
indicates a power-law decay of $t^{-2\beta/\nu z}$. (b2): After rescaling
$M^{2}$ and $t$ as $M^{2}L^{2\beta/\nu}$ and $tL^{-z}$, all curves collapse
well. (c1)-(c2): Evolution of Binder cumulant $U$ before and after rescaling
$t$ as $tL^{-z}$. (d1): Time dependence of $\phi_{q}$. The dashed vertical
lines are the same as (b1). (d2): At early stage of evolution, $\phi_{q}$ is
dimensionless and $t$ is rescaled by $tL^{-z}$. (d3): At long times, no good
collapse is seen when $\phi_{q}$ is rescaled by $L^{|y_{q}|}$ and $t$ by
$tL^{-z}$. (d4): Similar to (d3) but $t$ is rescaled by $tL^{-z^{\prime}}$.
The good collapse indicates the dynamics is governed by $z^{\prime}$ instead
of $z$.  Figure 3: Off-critical-point effects quenched from an ordered state
with fixed $|g|L^{1/\nu}=0.8$. (a1)-(a2) and (a3)-(a4): Dynamics of $M^{2}$
for $g>0$ and $g<0$, respectively. The solid lines in (a1) and (a3) indicate a
power-law decay of $t^{-2\beta/\nu z}$. After rescaling $M^{2}$ and $t$ as
$M^{2}L^{2\beta/\nu}$ and $tL^{-z}$, all curves collapse well. (b1)-(b4) and
(c1)-(c4): Evolution of $\phi_{q}$ for $g>0$ and $g<0$, respectively. The
scaling analyses are the same with the case of $T=T_{c}$.

Quench to the critical point—We first study the relaxation dynamics at the
critical point $T_{c}=2.20502(1)$ Shao  _et al._ (2020) quenching from an
ordered state with $M_{x}=1$ as indicated in Fig. 1. Figures 2 (a1)-(a4) show
the evolution of the distribution of $M_{x}$ and $M_{y}$. In early stage, the
magnitude of $M$ (represented by the radius) decays as time increases, with
very limited angular dispersion. In later stage, the magnitude is almost
invariant, whereas the transverse fluctuations dominate and the angular
distribution spreads until the system reaches its equilibrium state, in which
a circular distribution forms, reflecting the emergent $U(1)$ symmetry. Note
that Fig. 2 (a4) only shows an approximate $U(1)$ symmetry since the emergent
symmetry only appears in the thermodynamic limit.

We first show the “irrelevant” aspect of the DISV in relaxation dynamics. The
evolution of $M^{2}$ is shown in Fig. 2(b1) for various system sizes. In the
short-time stage, we find that $M^{2}$ satisfies $M^{2}\propto t^{-2\beta/\nu
z}$, in which $\beta=0.3485(2)$ Campostrini  _et al._ (2001), $\nu=0.6717(1)$
Shao  _et al._ (2020), and $z\approx 2$ Jensen  _et al._ (2000) are all $3$D
XY critical exponents. Moreover, by rescaling $M^{2}$ and $t$ as
$M^{2}L^{2\beta/\nu z}$ and $tL^{-z}$, respectively, we find that the rescaled
curves collapse well, as shown in Fig. 2(b2), suggesting that the dynamics of
$M^{2}$ obeys $M^{2}(t,L)=L^{-2\beta/\nu}f_{M}(tL^{-z})$. Similarly, the
dimensionless Binder cummulant $U\equiv 2-\langle M\rangle^{4}/\langle
M^{2}\rangle^{2}$ satisfies $U=f_{U}(tL^{-z})$ in the whole relaxation
process, as confirmed in Figs. 2 (c1)-(c2). These results demonstrate that
emergent $U(1)$ symmetry can manifest itself in the nonequilibrium process,
which is of significance since as a property of the renormalization group
fixed point Léonard and Delamotte (2015), one expects that the emergent
symmetry only appears in the equilibrium state in the thermodynamic limit.

To reveal the “dangerous” aspect of DISV in nonequilibrium relaxation
dynamics, we investigate the evolution of the angular order parameter
$\phi_{q}$. Here we find that the relaxation process of $\phi_{q}$ exhibits a
remarkable two-stage evolution, distinctly different from other quantities.

In the short-time stage, $\phi_{q}$ is close to $1$, where the magnitude decay
of $M$ overwhelms the angular dispersion. In this case, $\phi_{q}$ should be
dimensionless as learned from the equilibrium scaling Shao  _et al._ (2020);
Patil  _et al._ (2021). Therefore, the dynamic scaling form of $\phi_{q}$
should have two relevant scaling variables, giving
$\phi_{q}(t,L)=f_{\phi}^{s}(tL^{-z},tL^{-z^{\prime}})$. By rescaling $t$ as
$tL^{-z}$, we find good collapse at short times, suggesting that $tL^{-z}$
dominates the scaling function $f_{\phi}^{s}$, as shown in Fig. 2 (d2).
Therefore, in the short-time stage, $\phi_{q}$ satisfies

$\phi_{q}(t,L)=f_{\phi}^{s}(tL^{-z}).$ (3)

However, in the long-time stage, the relaxation of $\phi_{q}$ apparently
deviates from Eq. (3) as shown in Fig. 2 (d2). A distinct scaling form of
$\phi_{q}$ for long times is required. It has been found that in equilibrium,
for finite-size systems discrete $Z_{q}$ symmetry can still cast itself at the
critical point and $\phi_{q}\propto L^{-|y_{q}|}$ Shao  _et al._ (2020).
Considering Eq. (2), one expects that the dynamic scaling form should be
$\phi_{q}\propto L^{-|y_{q}|}f_{\phi}^{l}(tL^{-z},tL^{-z^{\prime}})$. To make
out the dominant variable in $f_{\phi}^{l}$, $\phi_{q}$ is rescaled by
$\phi_{q}L^{|y_{q}|}$ with $y_{q}=-1.27(1)$ for $q=5$ Shao  _et al._ (2020),
and for $t$, the two cases of $tL^{-z}$, $tL^{-z^{\prime}}$ are shown in Figs.
2 (d3) and (d4), respectively. It is evident that $tL^{-z^{\prime}}$, rather
than $tL^{-z}$, can successfully collapse all the rescaled curves at long
times. The value $z^{\prime}\approx 2.25$ is determined by data-collapse
analyses in Fig. 2 (d4). Therefore, the long-time scaling form of $\phi_{q}$
should be

$\phi_{q}(t,L)=L^{-|y_{q}|}f_{\phi}^{l}(tL^{-z^{\prime}}).$ (4)

The new dynamic exponent $z^{\prime}$ arises to characterize the typical time
scale of the transverse fluctuations between different domains at long times,
which is very different from the case of Model A with $3$D XY universality
class, in which the longitudinal and transverse modes share the same dynamic
exponent $z$ Täuber (2014). This additional $z^{\prime}$ remarkably reflects
that the DISV is relevant in the long-time relaxation of $\phi_{q}$.

The fact that $z^{\prime}>z$ indicates that $\xi>\xi^{\prime}$ during the
relaxation from an uncorrelated initial state, since $\xi\sim t^{1/z}$ and
$\xi^{\prime}\sim t^{1/{z^{\prime}}}$. This is notably different from the
equilibrium case where $\xi^{\prime}>\xi$ Oshikawa (2000); Lou  _et al._
(2007); Okubo  _et al._ (2015); Léonard and Delamotte (2015); Pujari  _et al._
(2015); Ding  _et al._ (2016); Hasenbusch and Vicari (2011); Shao  _et al._
(2020); Patil  _et al._ (2021). In the short-time stage, the system can hardly
feel the energy barrier induced by discrete symmetry and $\xi$ dominates the
relaxation dynamics of both $M^{2}$ and $\phi_{q}$, as suggested in Figs.
2(a1)-(a2). As time increases and $\xi>L>\xi^{\prime}$, $M^{2}$ tends to its
equilibrium value and the dominant scale for $\phi_{q}$ crossovers to
$\xi^{\prime}$, which is reflected in Fig. 2(a3). The equilibrium stage of
$\phi_{q}$ follows when $\xi^{\prime}>L$ and $\phi_{q}$ equilibrates,
corresponding to the circular distribution in Fig. 2(a4). The hierarchy of the
dominant length scale leads to the different scaling behaviors of $M^{2}$ and
$\phi_{q}$. Note that the difference between magnitude fluctuations and the
phases fluctuations was also revealed in the driven dynamics of models without
emergent symmetry Yuan  _et al._ (2021); Yuan and Zhong (2021a, b).

Off-critical-point effects—To confirm the universal dynamics controlled by
$\xi$ and $\xi^{\prime}$, here we explore the off-critical-point effects in
the vicinity of the critical point with fixed $|g|L^{1/\nu}=0.8$ (results of
larger value are discussed in the Appendix). Figures 3 (a1)-(a4) shows the
scaling collapse of rescaled $M^{2}$ versus $t$, demonstrating that $M^{2}$ is
still governed by $\xi$ and its dynamics satisfies the scaling form
$M^{2}=L^{-2\beta/\nu}f_{M}(gL^{1/\nu},tL^{-z})$ for both $g>0$ and $g<0$.

For $g>0$, the relaxation dynamics of $\phi_{q}$ is shown in Figs. 3
(b1)-(b4). In the short-time stage $\phi_{q}$ obeys
$\phi_{q}(t,L)=f_{\phi}^{s}(gL^{1/\nu},tL^{-z})$, whereas in the long-time
stage, Figs. 3 (b3) and (b4) show that $\phi_{q}$ obeys
$\phi_{q}(t,L)=L^{-|y_{q}|}f_{\phi}^{l}(gL^{1/\nu},tL^{-z^{\prime}})$, in
which $tL^{-z^{\prime}}$, instead of $tL^{-z}$, governs. Note that it is
generally believed that $\xi^{\prime}$ only plays roles in the ordered phase
Amit and Peliti (1982). Here we show that $\xi^{\prime}$ can affect the
dynamic scaling for $T>T_{c}$ as well.

For $g<0$, when $|g|L^{1/\nu}$ is small, in Figs. 3 (c1)-(c4) we confirm that
the scaling forms in the short-time and long-time stages are the same as those
for $g>0$. In particular, for $t\rightarrow\infty$, the equilibrium scaling
form $\phi_{q}(t,L)=L^{-|y_{q}|}f_{\phi}^{l}(gL^{1/\nu})$ is recovered Shao
_et al._ (2020); Patil  _et al._ (2021). Therefore, the universal dynamic
scaling forms with the new exponent $z^{\prime}$ are also valid in the
vicinity of $T_{c}$. For larger $|g|L^{1/\nu^{\prime}}$, complex crossover
behavior can exist as discussed in the Appendix.

Summary—To summarize, we have studied the nonequilibrium relaxation dynamics
in $3$D $Z_{q}$-clock model with an ordered initial state for the first time.
Using Monte Carlo simulation, we have unveiled both the “irrelevant’ and
“dangerous” aspects of the DISV in the relaxation critical dynamics with
emergent symmetry. Although the whole process of $M^{2}$ is described by the
usual correlation time scale $\zeta\propto\xi^{z}$ governed by the dynamic
universality class of $3$D XY model Oshikawa (2000); Lou  _et al._ (2007);
Okubo  _et al._ (2015); Léonard and Delamotte (2015); Pujari  _et al._ (2015);
Ding  _et al._ (2016); Hasenbusch and Vicari (2011); Shao  _et al._ (2020);
Patil  _et al._ (2021), the dynamics of $\phi_{q}$ demonstrates a remarkable
two-stage evolution, characterized by the usual dynamic exponent $z$ and a new
dynamic exponent $z^{\prime}\approx 2.25$, respectively. Further
investigations of the off-critical-point effects have confirmed the existence
of $z^{\prime}$ and verified its value. Our present work can shed colorful
lights on the studies of nonequilibrium dynamics in quantum Dirac systems and
deconfined quantum criticality Shu  _et al._ (2022); Shu and Yin (2022); Shu
_et al._ (2023). Moreover, recently, nonequilibrium dynamics, including both
driven critical dynamics and phase ordering dynamics, has been explored in the
hexagonal RMnO3 materials experimentally, in which the system has $Z_{6}$
symmetry and its critical point has $U(1)$ symmetry Chae  _et al._ (2012);
Skjærvø  _et al._ (2019); Griffin  _et al._ (2012); Lin  _et al._ (2014);
Meier  _et al._ (2017). Our results also provide new ingredient for further
explorations in these experiments.

Acknowledgements—Y.R.S. acknowledges support from the National Natural Science
Foundation of China (Grant No. 12104109), the Science and Technology Projects
in Guangzhou (Grant No. 202201020222). S.Y. is supported by the National
Natural Science Foundation of China (Grants No. 12222515 and No. 12075324) and
the Science and Technology Projects in Guangdong Province (Grants No.
2021QN02X561).

##  Appendix A Appendix: Additional results for off-critical-point effects

Figure A1: Off-critical-point effect for $g<0$ with different fixed values of
$gL^{1/\nu}$ and $gL^{1/\nu^{\prime}}$. (a1)-(a3): Results of fixed
$gL^{1/\nu}=-2$. $\phi_{q}$ exhibits a two-stage evolution, same as the case
of $gL^{1/\nu}=-0.8$ shown in the main text. (b1)-(b3): Results of fixed
$gL^{1/\nu^{\prime}}=-2$. The behaviors of $\phi_{q}$ are different with
(a1)-(a3). $\phi_{q}$ is dimensionless during the whole relaxation and the
governing dynamic exponent is $z$. The good collapse in both (a2) and (b2)
suggests a complex crossover regime where both $\xi$ and $\xi^{\prime}$ play
roles.

For $g<0$, equilibrium critical properties of $\phi_{q}$ have attracted long-
term investigations. Here we explore the scaling of $\phi_{q}$ for a larger
fixed value of the scaling variables $gL^{1/\nu}$ and $gL^{1/\nu^{\prime}}$
when $g<0$.

As pointed out in the main text, the full scaling form of $\phi_{q}$ should
follow

$\phi_{q}(t,g,L)=L^{-\kappa}f_{\phi}(tL^{-z},tL^{-z^{\prime}};gL^{1/\nu},gL^{1/\nu^{\prime}}),$
(A1)

in which the scaling dimension $\kappa=0$ for the short-time stage and
$\kappa=-y_{q}$ for the long-time stage. Moving away from the critical point,
the effects of the two scaling variables $gL^{1/\nu}$ and
$gL^{1/\nu^{\prime}}$ need to be considered. In the main text, we have shown
that for $g<0$, when $|g|L^{1/\nu}$ is small and $|g|L^{1/\nu^{\prime}}$ is
even smaller, $gL^{1/\nu}$ dominates the behavior of $f_{\phi}$.

Here we focus on larger $|g|L^{1/\nu}$ and $|g|L^{1/\nu^{\prime}}$ for $g<0$.
In Figs. A1(a1)-(a3), with fixed $gL^{1/\nu}=-2$, the dynamics of $\phi_{q}$
also exhibits a two-stage evolution, governed by $z$ and $z^{\prime}$ for
short times and long times, respectively. In the short-time stage, $\phi_{q}$
satisfies

$\phi_{q}(t,g,L)=f_{\phi}(tL^{-z},gL^{1/\nu}),$ (A2)

whereas in the long-time stage, $\phi_{q}(t,g,L)$ obeys

$\phi_{q}(t,g,L)=L^{-|y_{q}|}f_{\phi}(tL^{-z^{\prime}},gL^{1/\nu}).$ (A3)

These results is consistent with those shown in the main text with
$gL^{1/\nu}=-0.8$, demonstrating that the scaling form is universal.

Moreover, for fixed $gL^{1/\nu^{\prime}}=-2$, as shown in Figs. A1(b1)-(b3),
in the short-time stage, $\phi_{q}$ satisfies

$\phi_{q}(t,g,L)=f_{\phi}(tL^{-z},gL^{1/\nu^{\prime}}).$ (A4)

But in the long-time stage, $\phi_{q}$ are close to each other for different
sizes. This indicates that $\phi_{q}$ no longer has a dimension. This
conclusion is confirmed in Fig. A1 (b3), in which when $\phi_{q}$ is rescaled
as $\phi_{q}L^{-|y_{q}|}$, the rescaled curves deviate from each other. In the
thermodynamic limit, Eq. (A4) tends to
$\phi_{q}(t,g,L)=f_{\phi}(gL^{1/\nu^{\prime}})$, which is consistent with the
equilibrium scaling form for larger $\phi_{q}$.

These results show that for this range of $|g|L^{1/\nu^{\prime}}$ and
$|g|L^{1/\nu}$, both of them can be used to describe the dynamic scaling
behaviors of $\phi_{q}$, demonstrating the existence of complex crossover
behaviors.

## References

  * Landau  _et al._ (1999) L. D. Landau, E. M. Lifshitz, and E. M. Pitaevskii,  _Statistical Physics_ (Butterworth-Heinemann, New York, 1999).
  * Oshikawa (2000) M. Oshikawa, “Ordered phase and scaling in ${Z}_{n}$ models and the three-state antiferromagnetic Potts model in three dimensions,” Phys. Rev. B 61, 3430–3434 (2000).
  * Lou  _et al._ (2007) J. Lou, A. W. Sandvik, and L. Balents, “Emergence of U(1) Symmetry in the 3D $XY$ Model with ${Z}_{q}$ Anisotropy,” Phys. Rev. Lett. 99, 207203 (2007).
  * Okubo  _et al._ (2015) T. Okubo, K. Oshikawa, H. Watanabe, and N. Kawashima, “Scaling relation for dangerously irrelevant symmetry-breaking fields,” Phys. Rev. B 91, 174417 (2015).
  * Léonard and Delamotte (2015) F. Léonard and B. Delamotte, “Critical Exponents Can Be Different on the Two Sides of a Transition: A Generic Mechanism,” Phys. Rev. Lett. 115, 200601 (2015).
  * Pujari  _et al._ (2015) S. Pujari, F. Alet, and K. Damle, “Transitions to valence-bond solid order in a honeycomb lattice antiferromagnet,” Phys. Rev. B 91, 104411 (2015).
  * Ding  _et al._ (2016) C. Ding, H. W. J. Blöte, and Y. Deng, “Emergent O($n$) symmetry in a series of three-dimensional Potts models,” Phys. Rev. B 94, 104402 (2016).
  * Hasenbusch and Vicari (2011) M. Hasenbusch and E. Vicari, “Anisotropic perturbations in three-dimensional O($N$)-symmetric vector models,” Phys. Rev. B 84, 125136 (2011).
  * Shao  _et al._ (2020) H. Shao, W. Guo, and A. W. Sandvik, “Monte Carlo Renormalization Flows in the Space of Relevant and Irrelevant Operators: Application to Three-Dimensional Clock Models,” Phys. Rev. Lett. 124, 080602 (2020).
  * Patil  _et al._ (2021) P. Patil, H. Shao, and A. W. Sandvik, “Unconventional U(1) to ${Z}_{q}$ crossover in quantum and classical $q$-state clock models,” Phys. Rev. B 103, 054418 (2021).
  * Li  _et al._ (2017) Z.-X. Li, Y.-F. Jiang, S.-K. Jian, and H. Yao, “Fermion-induced quantum critical points,” Nature Communications 8, 314 (2017).
  * Jian and Yao (2017a) S.-K. Jian and H. Yao, “Fermion-induced quantum critical points in three-dimensional weyl semimetals,” Phys. Rev. B 96, 155112 (2017a).
  * Jian and Yao (2017b) S.-K. Jian and H. Yao, “Fermion-induced quantum critical points in two-dimensional dirac semimetals,” Phys. Rev. B 96, 195162 (2017b).
  * Torres  _et al._ (2018) E. Torres, L. Classen, I. F. Herbut, and M. M. Scherer, “Fermion-induced quantum criticality with two length scales in dirac systems,” Phys. Rev. B 97, 125137 (2018).
  * Classen  _et al._ (2017) L. Classen, I. F. Herbut, and M. M. Scherer, “Fluctuation-induced continuous transition and quantum criticality in dirac semimetals,” Phys. Rev. B 96, 115132 (2017).
  * T. Senthil and Ashvin Vishwanath and Leon Balents and Subir Sachdev and Matthew P. A. Fisher (2004) T. Senthil and Ashvin Vishwanath and Leon Balents and Subir Sachdev and Matthew P. A. Fisher , “Deconfined quantum critical points,” Science 303, 1490–1494 (2004).
  * Senthil  _et al._ (2004) T. Senthil, L. Balents, S. Sachdev, A. Vishwanath, and M. P. A. Fisher, “Quantum criticality beyond the Landau-Ginzburg-Wilson paradigm,” Phys. Rev. B 70, 144407 (2004).
  * Nahum  _et al._ (2015) A. Nahum, P. Serna, J. T. Chalker, M. Ortuño, and A. M. Somoza, “Emergent SO($5$) Symmetry at the Néel to Valence-Bond-Solid Transition,” Phys. Rev. Lett. 115, 267203 (2015).
  * Wang  _et al._ (2017) C. Wang, A. Nahum, M. A. Metlitski, C. Xu, and T. Senthil, “Deconfined Quantum Critical Points: Symmetries and Dualities,” Phys. Rev. X 7, 031051 (2017).
  * Takahashi and Sandvik (2020) J. Takahashi and A. W. Sandvik, “Valence-bond solids, vestigial order, and emergent SO(5) symmetry in a two-dimensional quantum magnet,” Phys. Rev. Res. 2, 033459 (2020).
  * Ma  _et al._ (2019) N. Ma, Y.-Z. You, and Z. Y. Meng, “Role of noether’s theorem at the deconfined quantum critical point,” Phys. Rev. Lett. 122, 175701 (2019).
  * Amit and Peliti (1982) D. J. Amit and L. Peliti, “On dangerous irrelevant operators,” Annals of Physics 140, 207–231 (1982).
  * Nelson (1976) D. R. Nelson, “Coexistence-curve singularities in isotropic ferromagnets,” Phys. Rev. B 13, 2222–2230 (1976).
  * Miyashita (1997) S. Miyashita, “Nature of the Ordered Phase and the Critical Properties of the Three Dimensional Six-State Clock Model,” Journal of the Physical Society of Japan 66, 3411–3420 (1997).
  * Hui Shao and Wenan Guo and Anders W. Sandvik (2016) Hui Shao and Wenan Guo and Anders W. Sandvik , “Quantum criticality with two length scales,” Science 352, 213–216 (2016).
  * Hohenberg and Halperin (1977) P. C. Hohenberg and B. I. Halperin, “Theory of dynamic critical phenomena,” Rev. Mod. Phys. 49, 435–479 (1977).
  * Folk and Moser (2006) R. Folk and G. Moser, “Critical dynamics: a field-theoretical approach,” Journal of Physics A: Mathematical and General 39, R207 (2006).
  * Täuber (2014) U. C. Täuber,  _Critical Dynamics: A Field Theory Approach to Equilibrium and Non-Equilibrium Scaling Behavior_ (Cambridge University Press, 2014).
  * Chae  _et al._ (2012) S. C. Chae, N. Lee, Y. Horibe, M. Tanimura, S. Mori, B. Gao, S. Carr, and S.-W. Cheong, “Direct Observation of the Proliferation of Ferroelectric Loop Domains and Vortex-Antivortex Pairs,” Phys. Rev. Lett. 108, 167603 (2012).
  * Skjærvø  _et al._ (2019) S. H. Skjærvø, Q. N. Meier, M. Feygenson, N. A. Spaldin, S. J. L. Billinge, E. S. Bozin, and S. M. Selbach, “Unconventional Continuous Structural Disorder at the Order-Disorder Phase Transition in the Hexagonal Manganites,” Phys. Rev. X 9, 031001 (2019).
  * Griffin  _et al._ (2012) S. M. Griffin, M. Lilienblum, K. T. Delaney, Y. Kumagai, M. Fiebig, and N. A. Spaldin, “Scaling Behavior and Beyond Equilibrium in the Hexagonal Manganites,” Phys. Rev. X 2, 041022 (2012).
  * Lin  _et al._ (2014) S.-Z. Lin, X. Wang, Y. Kamiya, G.-W. Chern, F. Fan, D. Fan, B. Casas, Y. Liu, V. Kiryukhin, W. H. Zurek, C. D. Batista, and S.-W. Cheong, “Topological defects as relics of emergent continuous symmetry and Higgs condensation of disorder in ferroelectrics,” Nature Physics 10, 970–977 (2014).
  * Meier  _et al._ (2017) Q. N. Meier, M. Lilienblum, S. M. Griffin, K. Conder, E. Pomjakushina, Z. Yan, E. Bourret, D. Meier, F. Lichtenberg, E. K. H. Salje, N. A. Spaldin, M. Fiebig, and A. Cano, “Global Formation of Topological Defects in the Multiferroic Hexagonal Manganites,” Phys. Rev. X 7, 041014 (2017).
  * Jensen  _et al._ (2000) L. M. Jensen, B. J. Kim, and P. Minnhagen, “Dynamic critical behaviors of three-dimensional XY models related to superconductors/superfluids,” Europhysics Letters 49, 644 (2000).
  * Ueno and Mitsubo (1991) Y. Ueno and K. Mitsubo, “Incompletely ordered phase in the three-dimensional six-state clock model: Evidence for an absence of ordered phases of XY character,” Phys. Rev. B 43, 8654–8657 (1991).
  * Chubukov  _et al._ (1994) A. V. Chubukov, S. Sachdev, and J. Ye, “Theory of two-dimensional quantum Heisenberg antiferromagnets with a nearly critical ground state,” Phys. Rev. B 49, 11919–11961 (1994).
  * Banerjee  _et al._ (2018) D. Banerjee, S. Chandrasekharan, and D. Orlando, “Conformal Dimensions via Large Charge Expansion,” Phys. Rev. Lett. 120, 061603 (2018).
  * Fedorenko and Trimper (2006) A. A. Fedorenko and S. Trimper, “Critical aging of a ferromagnetic system from a completely ordered state,” Europhysics Letters 74, 89 (2006).
  * Zheng (1998) B. Zheng, “Monte carlo simulations of short-time critical dynamics,” International Journal of Modern Physics B 12, 1419–1484 (1998).
  * Luo  _et al._ (1998) H. J. Luo, L. Schülke, and B. Zheng, “Dynamic approach to the fully frustrated $\mathit{XY}$ model,” Phys. Rev. Lett. 81, 180–183 (1998).
  * Stauffer (1992) D. Stauffer, “Kinetics of clusters in ising models,” Physica A: Statistical Mechanics and its Applications 186, 197–209 (1992).
  * Ito (1993) N. Ito, “Non-equilibrium relaxation and interface energy of the ising model,” Physica A: Statistical Mechanics and its Applications 196, 591–614 (1993).
  * Albano  _et al._ (2011) E. V. Albano, M. A. Bab, G. Baglietto, R. A. Borzi, T. S. Grigera, E. S. Loscar, D. E. Rodriguez, M. L. R. Puzzo, and G. P. Saracco, “Study of phase transitions from short-time non-equilibrium behaviour,” Reports on Progress in Physics 74, 026501 (2011).
  * Campostrini  _et al._ (2001) M. Campostrini, M. Hasenbusch, A. Pelissetto, P. Rossi, and E. Vicari, “Critical behavior of the three-dimensional $\mathrm{XY}$ universality class,” Phys. Rev. B 63, 214503 (2001).
  * Yuan  _et al._ (2021) W. Yuan, S. Yin, and F. Zhong, “Self-similarity breaking: Anomalous nonequilibrium finite-size scaling and finite-time scaling,” Chinese Physics Letters 38, 026401 (2021).
  * Yuan and Zhong (2021a) W. Yuan and F. Zhong, “Phases fluctuations and anomalous finite-time scaling in an externally applied field on finite-sized lattices,” Journal of Physics: Condensed Matter 33, 375401 (2021a).
  * Yuan and Zhong (2021b) W. Yuan and F. Zhong, “Phases fluctuations, self-similarity breaking and anomalous scalings in driven nonequilibrium critical phenomena,” Journal of Physics: Condensed Matter 33, 385401 (2021b).
  * Shu  _et al._ (2022) Y.-R. Shu, S.-K. Jian, and S. Yin, “Nonequilibrium dynamics of deconfined quantum critical point in imaginary time,” Phys. Rev. Lett. 128, 020601 (2022).
  * Shu and Yin (2022) Y.-R. Shu and S. Yin, “Dual dynamic scaling in deconfined quantum criticality,” Phys. Rev. B 105, 104420 (2022).
  * Shu  _et al._ (2023) Y.-R. Shu, S.-K. Jian, A. W. Sandvik, and S. Yin, “Equilibration of Topological Defects at the Deconfined Quantum Critical Point,” arXiv:2305.04771 (2023).