JWT Authentication (JSON Web Token)

JWT Authentication is a stateless, token-based security mechanism widely used to secure REST APIs and microservices in Spring Boot. It eliminates server-side sessions and is ideal for scalable, cloud-native applications.

---

What is JWT?

JWT (JSON Web Token) is a compact, URL-safe token used to securely transmit information between a client and server.

A JWT has three parts:

• Header – Token type (JWT) and signing algorithm (HS256, RS256)
• Payload – User data (username, roles, expiration time)
• Signature – Ensures token integrity (prevents tampering)

JWTs are signed, not encrypted (unless using JWE).

Example: Generating a JWT Token

Stringtoken= Jwts.builder()
        .setSubject(user.getUsername())
        .claim("roles", user.getAuthorities())
        .setIssuedAt(newDate())
        .setExpiration(newDate(System.currentTimeMillis() +1000 *60 *10))// 10 min
        .signWith(SignatureAlgorithm.HS256,"mysecret123")
        .compact();
System.out.println("Generated Token: " + token);

---

Why Use JWT Authentication?

• Stateless – No session stored on server
• Scalable – Perfect for microservices
• Fast – No DB lookup on every request
• Cross-platform – Works with web, mobile, SPA
• Secure – Signed and optionally encrypted

Practical Exercise: Try generating a token for a dummy user and decoding it using https://jwt.io.

---

How JWT Authentication Works (End-to-End Flow)

1. User logs in with username & password
2. Server authenticates credentials
3. Server generates JWT Access Token
4. Client stores token (HTTP header / secure storage)
5. Client sends token with every request:

Authorization: Bearer <JWT>

       6. Server validates token → allows or denies access

Example: Login API

@PostMapping("/auth/login")
public ResponseEntity<?> login(@RequestBody AuthRequest request) {
    authenticationManager.authenticate(
newUsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword())
    );
UserDetailsuser= userDetailsService.loadUserByUsername(request.getUsername());
Stringtoken= jwtUtil.generateToken(user);
return ResponseEntity.ok(Map.of("accessToken", token));
}

---

JWT Authentication Flow in Spring Security

Client → Login API → JWTGenerated Client → AuthorizationHeader → JWTFilter JWTFilter → Validate Token → Security Context Controller → Protected Resource

---

Access Token vs Refresh Token

Aspect	Access Token	Refresh Token
Purpose	Access protected APIs	Generate a new access token
When Used	Sent with every API request	Used only when access token expires
Lifetime	Short-lived (5–15 minutes)	Long-lived (days or weeks)
How It Is Sent	Authorization: Bearer <token>	Sent to refresh endpoint (e.g. /auth/refresh)
Client Storage	Memory / HTTP header	Secure storage (HttpOnly cookie preferred)
Server Storage	Not stored (stateless)	Stored in DB / Redis
Security Risk if Leaked	Lower (expires quickly)	Higher (can issue new access tokens)
Revocation	Auto-expire	Can be revoked / blacklisted
Token Rotation	Not required	Recommended
Contains User Data	Yes (user, roles, expiry)	Minimal or reference only
Best Use Case	API authorization	Maintain login without re-login
Spring Security Usage	Validated in JWT Filter	Validated in Refresh API

Implement /auth/refresh endpoint with token rotation

@PostMapping("/auth/refresh")
public ResponseEntity<?> refresh(@RequestBody Map<String, String> request) {
StringrefreshToken= request.get("refreshToken");
// Validate refresh token and rotate
StringnewAccessToken= jwtUtil.generateToken(userDetailsService.loadUserByUsername("admin"));
StringnewRefreshToken= UUID.randomUUID().toString();// simple rotation
return ResponseEntity.ok(Map.of("accessToken", newAccessToken,"refreshToken", newRefreshToken));
}

---

Refresh Token Rotation Strategy

Refresh Token Rotation means issuing a new refresh token every time the old one is used.

Why Rotation Is Needed

• Prevents refresh token reuse attacks
• Limits damage if a token is stolen
• Improves overall security

Implement refresh token rotation by storing refresh tokens in Redis or DB and invalidating used tokens.

Refresh Token Rotation Flow

1. Access token expires
2. Client sends refresh token
3. Server validates refresh token
4. Server issues:
   • New access token
   • New refresh token
5. Old refresh token is invalidated

? If an old refresh token is reused → request is rejected.

---

Token Blacklisting (JWT Revocation Strategy)

JWTs cannot be revoked naturally. Token blacklisting solves this limitation.

When Blacklisting Is Required

• User logout
• Token theft or compromise
• Admin force logout
• Password change

How Blacklisting Works

• Store invalid tokens in:
  • Redis (recommended)
  • Database
  • In-memory (small apps only)
• On every request:
  • JWT Filter checks blacklist
  • Rejects blacklisted tokens

Example: Check Blacklist in Filter

if(redisTemplate.hasKey(token)) {
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED,"Token is blacklisted");
return;
}

---

Key Components in Spring Boot JWT Setup

JWT-based security in Spring Boot is built around a few core components. Each plays a specific role in authenticating users and securing API requests.

1. AuthenticationManager

• Validates username & password
• Delegates authentication to UserDetailsService & PasswordEncoder

Configure AuthenticationManager in SecurityConfig:

@Bean
public AuthenticationManagerauthManager(HttpSecurity http, BCryptPasswordEncoder encoder, CustomUserDetailsService userDetailsService)throws Exception {
return http.getSharedObject(AuthenticationManagerBuilder.class)
               .userDetailsService(userDetailsService)
               .passwordEncoder(encoder)
               .and()
               .build();
}

---

2. JWT Utility (JwtUtil / TokenProvider)

• Generate Access Token
• Validate signature & expiration
• Extract username & roles

Add a method to extract roles from JWT for role-based access:

public List<String>extractRoles(String token) {
return ((List<?>) Jwts.parser().setSigningKey(SECRET_KEY)
           .parseClaimsJws(token).getBody().get("roles")).stream()
           .map(Object::toString).collect(Collectors.toList());
}

---

3. JWT Filter

• Intercepts all HTTP requests
• Extracts JWT from Authorization header
• Sets authentication in SecurityContext

Test JWT filter by accessing /todos with and without a token.

---

4. Security Filter Chain

• Registers JWT Filter
• Disables session (STATELESS)
• Configures endpoint rules

Protect APIs selectively:

http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/auth/**").permitAll()
        .requestMatchers("/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated()
    );

---

JWT vs Session-Based Authentication

Feature	JWT Authentication	Session-Based Authentication
State	Stateless	Stateful
Scalability	High (easy horizontal scaling)	Limited (session sharing needed)
Server Storage	None	Session store (memory / DB)
Client Request	JWT sent in Authorization header	Session ID sent via cookie
Best Use Case	REST APIs, Microservices, Mobile apps	Traditional web applications
Performance	High (no session lookup)	Medium (session validation required)

---

Security Best Practices for JWT

• Always use HTTPS
• Keep access tokens short-lived
• Use refresh tokens
• Never store JWT in localStorage (prefer HttpOnly cookies)
• Validate signature & expiration
• Use strong algorithms (RS256 preferred)

---

When to Use JWT

Use JWT (JSON Web Token) when your application needs stateless, scalable security.

Best Use Cases

• REST APIs
• Mobile Applications
• SPA (React, Angular, Vue)
• Microservices Architecture
• Distributed Systems

Avoid JWT When

• Simple server-rendered web applications – Form Login better

---

Key Takeaways

• JWT is stateless, scalable, and secure
• Ideal for REST APIs and microservices
• Eliminates server-side sessions
• Works seamlessly with Spring Security
• Best combined with OAuth2 for enterprise systems

---

Conclusion

JWT Authentication is a modern, industry-standard approach to securing APIs. Mastering JWT in Spring Security helps you build:

• Secure REST APIs
• Scalable microservices
• Cloud-ready Spring Boot applications