JWT Using Spring Boot 3 and Spring Security

Introduction

• Overview of JWT and its importance in API security.
• Crash course brought by Alibou.
• Previous crash course on Spring Security 6 with a missing JWT section.

Importance of Security

• Security is essential when designing APIs.
• Understanding Spring Security and JWT is crucial for securing APIs.

Source Code Availability

• Complete source code available in the video description.
• Community support for JWT-related questions.

JWT Validation Mechanism

1. HTTP Request

   • Customer sends an HTTP request to the backend system running Spring Boot.
   • First executed component: JWT Authentication Filter.

2. JWT Token Check

   • Check if JWT token is present.
   • If missing, return a 403 Forbidden response.

3. Validation Process

   • If token present, extract username/email from the token.
   • Fetch user details from the database using user details service.
   • Validate the token against the user:
     • If token is invalid (expired, not for the user), return 403.
     • If valid, update security context holder with authenticated user.

4. Request Dispatch

   • Upon successful authentication, request is dispatched to the controller for further processing.

Setting Up a Spring Boot Project

• Create a new Spring Boot project using Spring Initializr.
• Use Maven and select Spring Boot version 3.0 and Java 17.
• Add necessary dependencies:
  • Spring Web, Spring Security, Spring Data JPA, PostgreSQL Driver, Lombok.

Database Configuration

• Configure PostgreSQL as the database.
• Create a new database for JWT security.
• Application properties need to specify:
  • Data source URL, username, and password.
  • JPA properties for schema generation and SQL formatting.

User Class Creation

• Create a User class with fields:
  • Integer ID, String first name, String last name, String email, String password.
• Use Lombok annotations for boilerplate reduction:
  • @Data, @Builder, @NoArgsConstructor, @AllArgsConstructor.
• Annotate class with @Entity to map to the database.

User Details Implementation

• Implement UserDetails interface for Spring Security compatibility.
• Override methods:
  • getAuthorities(), getUsername(), isAccountNonExpired(), isCredentialsNonExpired(), isAccountNonLocked(), isEnabled().

User Repository

• Create UserRepository interface extending JpaRepository.
• Add a method to find user by email.

JWT Authentication Filter

• Create JWTAuthenticationFilter extending OncePerRequestFilter.
• Implement doFilterInternal method:
  • Check for JWT token in the request header.
  • Validate token using JWT service.
  • Authenticate user and update security context.

JWT Service Implementation

• Create JWTService class for token operations.
• Implement methods for:
  • Extracting claims, generating tokens, validating tokens, etc.

Token Structure

• JWT consists of:
  • Header: Type of token and signing algorithm.
  • Payload: Contains claims about the user.
  • Signature: Used to verify token integrity.

Generating Tokens

• Implement methods for generating tokens with claims and user details.
• Set expiration times and signing keys for tokens.

Security Configuration

• Create a SecurityConfig class.
• Configure a filter chain for authentication.
• Setup session management to be stateless and register the JWT filter.

Authentication Controller

• Create AuthenticationController with endpoints:
  • Register a user.
  • Authenticate a user.

Conclusion

• Demonstrate the implementation of JWT in Spring Boot 3 and Spring Security.
• Encouragement to engage with the community and subscribe for more content.