Spring Security JWT

3 min readNov 30, 2021

In this example, we’ll see the Spring Boot Security and JWT integration example. In this example I used below

Spring Boot v2.6.1
Spring Security
H2 DB
Lombok
Spring Data JPA
jjwt from io.jsonwebtoken

pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
   <modelVersion>4.0.0</modelVersion>
   
   <parent>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-parent</artifactId>
      <version>2.6.1</version>
      <relativePath /> <!-- lookup parent from repository -->
   </parent>
   <groupId>com.example</groupId>
   <artifactId>spring-security-jwt</artifactId>
   <version>0.0.1-SNAPSHOT</version>
   <name>spring-security-jwt</name>
   <description>Demo project for Spring Boot</description>
   <properties>
      <java.version>1.8</java.version>
   </properties>   <dependencies>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-security</artifactId>
      </dependency>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-web</artifactId>
      </dependency>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-data-jpa</artifactId>
      </dependency>
      <dependency>
         <groupId>io.jsonwebtoken</groupId>
         <artifactId>jjwt</artifactId>
         <version>0.9.1</version>
      </dependency>
      <dependency>
         <groupId>com.h2database</groupId>
         <artifactId>h2</artifactId>
         <scope>runtime</scope>
      </dependency>
      <dependency>
         <groupId>org.projectlombok</groupId>
         <artifactId>lombok</artifactId>
         <optional>true</optional>
      </dependency>
      <dependency>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-test</artifactId>
         <scope>test</scope>
      </dependency>
      <dependency>
         <groupId>org.springframework.security</groupId>
         <artifactId>spring-security-test</artifactId>
         <scope>test</scope>
      </dependency>
   </dependencies>

   <build>
      <plugins>
         <plugin>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-maven-plugin</artifactId>
            <configuration>
               <excludes>
                  <exclude>
                     <groupId>org.projectlombok</groupId>
                     <artifactId>lombok</artifactId>
                  </exclude>
               </excludes>
            </configuration>
         </plugin>
      </plugins>
   </build>

</project>

User.java

@Builder
@Data
@AllArgsConstructor
@NoArgsConstructor
@Entity
@Table(name = "USER_TBL")
public class User {
   @Id
   @GeneratedValue(strategy = GenerationType.AUTO)
   private int id;
    private String userName;
    private String password;
    private String email;
}

AuthRequest.java

@Data
@AllArgsConstructor
@NoArgsConstructor
public class AuthRequest {
   private String userName;
   private String password;
}

UserRepository.java

public interface UserRepository extends JpaRepository<User, Integer> {
   User findByUserName(String username);
}

CustomUserDetailsService.java

@Service
public class CustomUserDetailsService implements UserDetailsService {

   @Autowired
   private UserRepository userRepository;

   @Override
   public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
      User user = userRepository.findByUserName(username);
      return new org.springframework.security.core.userdetails.User(user.getUserName(), user.getPassword(),
            new ArrayList<>());
   }
}

JwtUtil.java

@Service
public class JwtUtil {

   private String secret = "mylearnings";

   public String extractUsername(String token) {
      return extractClaim(token, Claims::getSubject);
   }

   public Date extractExpiration(String token) {
      return extractClaim(token, Claims::getExpiration);
   }

   public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
      final Claims claims = extractAllClaims(token);
      return claimsResolver.apply(claims);
   }

   private Claims extractAllClaims(String token) {
      return Jwts.parser()
            .setSigningKey(secret)
            .parseClaimsJws(token)
            .getBody();
   }

   private Boolean isTokenExpired(String token) {
      return extractExpiration(token).before(new Date());
   }

   public String generateToken(String username) {
      Map<String, Object> claims = new HashMap<>();
      return createToken(claims, username);
   }

   private String createToken(Map<String, Object> claims, String subject) {
      return Jwts.builder()
            .setClaims(claims)
            .setSubject(subject)
            .setIssuedAt(new Date(System.currentTimeMillis()))
            .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10))
            .signWith(SignatureAlgorithm.HS256, secret)
            .claim("APP_NAME", "Spring Security App")
            .compact();
   }

   public Boolean validateToken(String token, UserDetails userDetails) {
      final String username = extractUsername(token);
      return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
   }
}

JwtFIlter.java

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.web.authentication.WebAuthenticationDetailsSource;
import org.springframework.stereotype.Component;
import org.springframework.web.filter.OncePerRequestFilter;

import com.example.demo.service.CustomUserDetailsService;
import com.example.demo.util.JwtUtil;

@Component
public class JwtFilter extends OncePerRequestFilter {
   @Autowired
   private JwtUtil jwtUtil;
   @Autowired
   private CustomUserDetailsService service;

   @Override
   protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
         throws ServletException, IOException {
      String authorizationHeader = request.getHeader("Authorization");

      String token = null;
      String userName = null;

      if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
         token = authorizationHeader.substring(7);
         userName = jwtUtil.extractUsername(token);
      }

      if (userName != null && SecurityContextHolder.getContext().getAuthentication() == null) {

         UserDetails userDetails = service.loadUserByUsername(userName);

         if (jwtUtil.validateToken(token, userDetails)) {

            UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken(
                  userDetails, null, userDetails.getAuthorities());
            usernamePasswordAuthenticationToken
                  .setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
            SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken);
         }
      }
      filterChain.doFilter(request, response);
   }
}

SecurityConfig.java

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.config.BeanIds;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

import com.example.demo.filter.JwtFilter;
import com.example.demo.service.CustomUserDetailsService;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

   @Autowired
   private CustomUserDetailsService customUserDetailsService;
   @Autowired
    private JwtFilter jwtFilter;

   @Override
   protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      auth.userDetailsService(customUserDetailsService);
   }

   @Bean(name = BeanIds.AUTHENTICATION_MANAGER)
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }
   
   @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable().authorizeRequests().antMatchers("/authenticate")
                .permitAll().anyRequest().authenticated()
                .and().exceptionHandling().and().sessionManagement()
                .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        
        http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);;
    }
}

WelcomeController.java

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;

import com.example.demo.entity.AuthRequest;
import com.example.demo.util.JwtUtil;

@RestController
public class WelcomeController {
   @Autowired
   private JwtUtil jwtUtil;
   @Autowired
   private AuthenticationManager authenticationManager;

   @GetMapping("/")
   public String welcome() {
      return "Welcome to javatechie !!";
   }

   @PostMapping("/authenticate")
   public String generateToken(@RequestBody AuthRequest authRequest) throws Exception {
      try {
         authenticationManager.authenticate(
               new UsernamePasswordAuthenticationToken(authRequest.getUserName(), authRequest.getPassword()));
      } catch (Exception ex) {
         throw new Exception("inavalid username/password");
      }
      return jwtUtil.generateToken(authRequest.getUserName());
   }
}

MainApp.java — Here password is BcryptPasswordDecoder , username and password value is same.

@SpringBootApplication
public class SpringSecurityJwtApplication {

   public static void main(String[] args) {
      SpringApplication.run(SpringSecurityJwtApplication.class, args);
   }

   @Autowired
   private UserRepository userRepository;

   @PostConstruct
   public void initUsers() {
      List<User> users = Stream
            .of(User.builder().userName("john").password("$2a$10$yxMa7uWqfBlNpb6UTt.Rnumpvz1/8pgOCZRsWCD.aLAyL1M6F8b.O").email("john.doe@gmail.com").build(),
                  User.builder().userName("radha").password("$2a$10$zpdRB8eQgwsreyEX8svvr.QDG.pA.4Xq5epd/hL71TkvjMrm0Oz.G").email("radha.kumari@gmail.com").build(),
                  User.builder().userName("neha").password("$2a$10$7Ir5tKqveBcN6FzVZep8XOb/u.UDQT2ZXABZX/rhdjgQlHLa.yPMK").email("neha.parate@gmail.com").build(),
                  User.builder().userName("jane").password("$2a$10$YIVQrYBh9mODuR0pW1jUVua8lbqf9Bv1LmO/bw3WP8.fHwtEDc.Ba").email("jane.doe@gmail.com").build())
            .collect(Collectors.toList());
      userRepository.saveAll(users);
   }

   @Bean
   public PasswordEncoder passwordEncoder() {
      return new BCryptPasswordEncoder();
   }
}

application.yml

spring:
  h2:
    console:
      enabled: true

server:
    port: 9192

CURL to get JWT —

curl — location — request POST ‘http://localhost:9192/authenticate' \
— header ‘Content-Type: application/json’ \
— header ‘Cookie: JSESSIONID=F468057F9BFB5B4BFCD15CA58B416E04’ \
— data-raw ‘{
“userName”: “john”,
“password” : “john”
}’

Response —

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqb2huIiwiQVBQX05BTUUiOiJTcHJpbmcgU2VjdXJpdHkgQXBwIiwiZXhwIjoxNjM4MzE1NDM3LCJpYXQiOjE2MzgyNzk0Mzd9.Mk4ykXtG3O0DMqCe_O_O9twm-XbRANDcQokjb8wvFFE

Make the API call

curl — location — request GET ‘http://localhost:9192/' \
— header ‘Content-Type: application/json’ \
— header ‘Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqb2huIiwiQVBQX05BTUUiOiJTcHJpbmcgU2VjdXJpdHkgQXBwIiwiZXhwIjoxNjM4MzE1NDM3LCJpYXQiOjE2MzgyNzk0Mzd9.Mk4ykXtG3O0DMqCe_O_O9twm-XbRANDcQokjb8wvFFE’ \
— header ‘Cookie: JSESSIONID=F468057F9BFB5B4BFCD15CA58B416E04’

Spring Security JWT

Written by Prateek

No responses yet