JWT Authentication with Spring Security

Notebook Summary

Hand-copyable. Fully derivable from the detailed notes below.

Detailed Study Notes

Alex, a developer at a small firm, wrapped his new customer portal in Basic Authentication because it was the quickest thing to enable. One Friday he logged in over café Wi-Fi. Someone watching that network copied the one header his browser attached to every request, pasted it into a decoder, and read his email and password in plain text. Over the weekend they browsed customer accounts and created their own admin login. There was no token to expire, no session to kill — the team eventually reset every password just to lock the intruder out. The whole disaster traces back to one design choice: how the credentials travelled.

2.1Why Basic Authentication is not enough

Basic Authentication is a scheme where the client attaches the username and password to every request, encoded but not encrypted. When you use it, the browser builds one header and repeats it on every call:

Authorization: Basic YWxpY2VAY3Jpb2RvLmNvbTphbGljZTEyMw==

That trailing blob looks scrambled, but it is only Base64 encoding of the literal string username:password. Encoding is a reversible format change, not a lock — anyone can decode it. The example above is exactly alice@criodo.com:alice123. Paste it into any Base64 decoder and the password falls out.

The deeper problem is not just interception. Basic Auth has no memory and no lifecycle:

And because the credentials ride along on every single request, every request is another chance to leak them, plus needless overhead. Basic Auth is fine for a throwaway demo behind HTTPS; it should never guard a production system.

2.2What a JSON Web Token actually is

A JSON Web Token (JWT) is a small, signed packet of JSON that proves who you are without the server having to look you up. Instead of resending your password, you log in once, and the server hands back a token. From then on you present the token; the server trusts it because it carries a signature only the server could have produced.

Four properties are worth memorising because interviewers ask for them by name:

2.3Anatomy: header, payload, signature

Every JWT is three Base64URL-encoded chunks joined by dots: header.payload.signature. Decode the two dots and you can read the first two parts with the naked eye — they are not secret.

Take a real token from this lesson and decode it. The header names the algorithm:

{ "alg": "HS256" }

The payload holds the claims — statements about the user. Here sub is the subject (who the token is about), iat is "issued at", and exp is "expires at", both as Unix seconds:

{
  "sub": "abdulr@criodo.com",
  "iat": 1729342240,
  "exp": 1729428640
}

Subtract iat from exp and you get 86,400 seconds — exactly 24 hours of validity baked into the token itself. That single number is the thing Basic Auth never had.

2.4The authentication flow, end to end

The flow has two phases: get a token once, then present it on every later request. Keeping these two phases separate in your head is most of the battle.

The verification step never touches a database of sessions. The server recomputes the signature over the received header and payload using its secret, and compares it to the signature in the token. Match means untampered and authentic; mismatch means rejected. This is why JWT is called stateless.

2.5Setting up JWT in Spring Boot

Spring Security gives us the filter chain and role checks; a JWT library gives us the token building and parsing. The lesson uses jjwt (the io.jsonwebtoken library). [+] The exact coordinates below reflect the current jjwt release; add all three so signing and parsing work at runtime:

<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt-api</artifactId>
  <version>0.12.6</version>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt-impl</artifactId>
  <version>0.12.6</version>
  <scope>runtime</scope>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt-jackson</artifactId>
  <version>0.12.6</version>
  <scope>runtime</scope>
</dependency>

The heart of the setup is a JWTService — one class that owns the secret and knows how to mint and read tokens. The signing key is a shared secret; the token in this lesson uses HS256 (HMAC with SHA-256), a symmetric algorithm where the same secret both signs and verifies.

The lesson showed a neat way to avoid hard-coding that secret — generate a fresh one in the constructor:

private String secretkey = "";

public JWTService() {
    try {
        KeyGenerator keyGen = KeyGenerator.getInstance("HmacSHA256");
        SecretKey sk = keyGen.generateKey();
        secretkey = Base64.getEncoder().encodeToString(sk.getEncoded());
    } catch (NoSuchAlgorithmException e) {
        throw new RuntimeException(e);
    }
}

[+] With the key in place, building a token is a fluent chain: set the claims, subject, issued-at and expiry, then sign and compact into the dotted string. Reading it back decodes the key from Base64 into a real SecretKey:

public String generateToken(String username) {
    Map<String, Object> claims = new HashMap<>();
    return Jwts.builder().claims(claims).subject(username).issuedAt(new Date(System.currentTimeMillis())).expiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 24)).signWith(getKey()).compact();
}

private SecretKey getKey() {
    byte[] keyBytes = Decoders.BASE64.decode(secretkey);
    return Keys.hmacShaKeyFor(keyBytes);
}

2.6Generating the token in the login API

The login endpoint is the only place credentials appear. It hands the username and password to Spring's AuthenticationManager; if they check out, it asks the JWTService for a token and returns it. After this, the password is never sent again.

@RestController
public class AuthController {

    @Autowired private AuthenticationManager authManager;
    @Autowired private JWTService jwtService;

    @PostMapping("/login")
    public String login(@RequestBody User user) {
        Authentication auth = authManager.authenticate(new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword()));

        if (auth.isAuthenticated()) {
            return jwtService.generateToken(user.getUsername());
        }
        return "login failed";
    }
}

2.7Validating the token on every request

Reading a token safely means three things: pull the username out, confirm the signature, and confirm it hasn't expired. jjwt's parser does the heavy lifting — verifyWith(getKey()) checks the signature, and it throws automatically on an expired or malformed token.

public String extractUsername(String token) {
    return extractClaim(token, Claims::getSubject);
}

private<T> T extractClaim(String token, Function<Claims, T> resolver) {
    return resolver.apply(extractAllClaims(token));
}

private Claims extractAllClaims(String token) {
    return Jwts.parser().verifyWith(getKey()).build().parseSignedClaims(token).getPayload();
}

public boolean validateToken(String token, UserDetails userDetails) {
    final String username = extractUsername(token);
    return username.equals(userDetails.getUsername()) && !isExpired(token);
}

private boolean isExpired(String token) {
    return extractAllClaims(token).getExpiration().before(new Date());
}

A filter is a checkpoint every request passes through before it reaches a controller. We add one that runs early in Spring Security's chain, reads the Authorization header, and — if a valid Bearer token is present — tells Spring "this request is authenticated as this user" by populating the SecurityContext.

@Component
public class JwtFilter extends OncePerRequestFilter {

    @Autowired private JWTService jwtService;
    @Autowired private ApplicationContext context;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException {

        String authHeader = request.getHeader("Authorization");
        String token = null, username = null;

        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            token = authHeader.substring(7);
            username = jwtService.extractUsername(token);
        }

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = context.getBean(MyUserDetailsService.class).loadUserByUsername(username);

            if (jwtService.validateToken(token, userDetails)) {
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(userDetails, null, userDetails.getAuthorities());
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        filterChain.doFilter(request, response);
    }
}

2.8Securing endpoints with role-based authorization

Authentication asks "who are you?"; authorization asks "are you allowed?" Once the filter has established who you are, Spring Security decides which endpoints your role may touch. This is configured in one SecurityConfig bean.

Three settings matter for JWT. Turn off CSRF (it defends cookie-based sessions we no longer use), mark the session policy stateless so Spring never creates a server session, and register our filter before the built-in username/password filter so our token is read first.

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired private JwtFilter jwtFilter;

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        return http.csrf(c -> c.disable()).authorizeHttpRequests(req -> req.requestMatchers("/login", "/register").permitAll().requestMatchers("/admins").hasRole("ADMIN").anyRequest().authenticated()).sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS)).addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class).build();
    }
}

Now the roles do their job. A token minted with role USER reaches / but is refused at /admins; a token with role ADMIN reaches both.

2.9Testing the secured endpoints in Postman

To call a protected route, Postman must attach the token the way the filter expects. In the request's Authorization tab, choose type Bearer Token and paste a token you got from /login. Postman then adds the Authorization: Bearer <jwt> header to every send.

• Log in first (POST /login with valid credentials) and copy the returned token.
• Paste it as the Bearer token, then hit GET / — a USER token succeeds.
• Swap in a USER token and hit GET /admins — expect 403; swap in an ADMIN token — expect 200.
• Paste the token into jwt.io with the Base64 secret to confirm the signature verifies and read the claims.

2.10Interview & practice Q&A

2.11Key takeaways

• Basic Auth resends decodable credentials on every request, with no expiry, logout, or rate limiting — unfit for production.
• A JWT is a signed, self-contained JSON token: header.payload.signature, stateless and compact.
• The signature proves authenticity and detects tampering; the payload is readable, so keep secrets out of it.
• Log in once to get a token, then send Authorization: Bearer <jwt> on each request.
• In Spring: a JWTService mints/reads tokens, a OncePerRequestFilter validates them, and SecurityConfig enforces stateless sessions and role rules.
• 401 = unknown identity; 403 = known identity, insufficient role.

Microexercises

Reading proves you recognise it; these prove you can use it. Attempt each before opening the walkthrough.

3.1Build it — mint an HS256 token

public String generateToken(String username) {
    Map<String, Object> claims = new HashMap<>();
    return Jwts.builder().claims(claims).subject(username).issuedAt(new Date(System.currentTimeMillis())).expiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 24)).signWith(getKey()).compact();
}

private SecretKey getKey() {
    byte[] keyBytes = Decoders.BASE64.decode(secretkey);
    return Keys.hmacShaKeyFor(keyBytes);
}

3.2Diagnose it — every token is rejected

// signing (in generateToken)
.signWith(Keys.hmacShaKeyFor(secretkey.getBytes()))

// verifying (in extractAllClaims)
Jwts.parser()
    .verifyWith(Keys.hmacShaKeyFor(Decoders.BASE64.decode(secretkey)))
    .build()
    .parseSignedClaims(token);

private SecretKey getKey() {
    byte[] keyBytes = Decoders.BASE64.decode(secretkey);
    return Keys.hmacShaKeyFor(keyBytes);
}

// signing
.signWith(getKey())

// verifying
Jwts.parser().verifyWith(getKey()).build().parseSignedClaims(token);

Sources: Java 301 · Session 8 slide deck. Code marked [+] reconstructs the standard jjwt / Spring Security implementation the deck's code screenshots demonstrate; the verbatim key-generator snippet is from the deck. No separate voice transcript was provided, so scope follows the slides.