JWT Authentication (JSON Web Token)

JWT Authentication is a stateless, token-based security mechanism widely used to secure REST APIs and microservices in Spring Boot. It eliminates server-side sessions and is ideal for scalable, cloud-native applications.

What is JWT?

JWT (JSON Web Token) is a compact, URL-safe token used to securely transmit information between a client and server.

A JWT has three parts:

• Header – Token type (JWT) and signing algorithm (HS256, RS256)
• Payload – User data (username, roles, expiration time)
• Signature – Ensures token integrity (prevents tampering)

JWTs are signed, not encrypted (unless using JWE).

Example: Generating a JWT Token

Stringtoken= Jwts.builder()
        .setSubject(user.getUsername())
        .claim("roles", user.getAuthorities())
        .setIssuedAt(newDate())
        .setExpiration(newDate(System.currentTimeMillis() +1000 *60 *10))// 10 min
        .signWith(SignatureAlgorithm.HS256,"mysecret123")
        .compact();
System.out.println("Generated Token: " + token);

Why Use JWT Authentication?

• Stateless – No session stored on server
• Scalable – Perfect for microservices
• Fast – No DB lookup on every request
• Cross-platform – Works with web, mobile, SPA
• Secure – Signed and optionally encrypted

Practical Exercise: Try generating a token for a dummy user and decoding it using https://jwt.io.

How JWT Authentication Works (End-to-End Flow)

1. User logs in with username & password
2. Server authenticates credentials
3. Server generates JWT Access Token
4. Client stores token (HTTP header / secure storage)
5. Client sends token with every request:

Authorization: Bearer <JWT>

       6. Server validates token → allows or denies access

Example: Login API

@PostMapping("/auth/login")
public ResponseEntity<?> login(@RequestBody AuthRequest request) {
    authenticationManager.authenticate(
newUsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword())
    );
UserDetailsuser= userDetailsService.loadUserByUsername(request.getUsername());
Stringtoken= jwtUtil.generateToken(user);
return ResponseEntity.ok(Map.of("accessToken", token));
}

JWT Authentication Flow in Spring Security

Client → Login API → JWTGenerated Client → AuthorizationHeader → JWTFilter JWTFilter → Validate Token → Security Context Controller → Protected Resource

Access Token vs Refresh Token

Implement /auth/refresh endpoint with token rotation

@PostMapping("/auth/refresh")
public ResponseEntity<?> refresh(@RequestBody Map<String, String> request) {
StringrefreshToken= request.get("refreshToken");
// Validate refresh token and rotate
StringnewAccessToken= jwtUtil.generateToken(userDetailsService.loadUserByUsername("admin"));
StringnewRefreshToken= UUID.randomUUID().toString();// simple rotation
return ResponseEntity.ok(Map.of("accessToken", newAccessToken,"refreshToken", newRefreshToken));
}

Refresh Token Rotation Strategy

Refresh Token Rotation means issuing a new refresh token every time the old one is used.

Why Rotation Is Needed

• Prevents refresh token reuse attacks
• Limits damage if a token is stolen
• Improves overall security

Implement refresh token rotation by storing refresh tokens in Redis or DB and invalidating used tokens.

Refresh Token Rotation Flow

1. Access token expires
2. Client sends refresh token
3. Server validates refresh token
4. Server issues:
   • New access token
   • New refresh token
5. Old refresh token is invalidated

📌 If an old refresh token is reused → request is rejected.

Token Blacklisting (JWT Revocation Strategy)

JWTs cannot be revoked naturally. Token blacklisting solves this limitation.

When Blacklisting Is Required

• User logout
• Token theft or compromise
• Admin force logout
• Password change

How Blacklisting Works

• Store invalid tokens in:
  • Redis (recommended)
  • Database
  • In-memory (small apps only)
• On every request:
  • JWT Filter checks blacklist
  • Rejects blacklisted tokens

Example: Check Blacklist in Filter

if(redisTemplate.hasKey(token)) {
    response.sendError(HttpServletResponse.SC_UNAUTHORIZED,"Token is blacklisted");
return;
}

Key Components in Spring Boot JWT Setup

JWT-based security in Spring Boot is built around a few core components. Each plays a specific role in authenticating users and securing API requests.

1. AuthenticationManager

• Validates username & password
• Delegates authentication to UserDetailsService & PasswordEncoder

Configure AuthenticationManager in SecurityConfig:

@Bean
public AuthenticationManagerauthManager(HttpSecurity http, BCryptPasswordEncoder encoder, CustomUserDetailsService userDetailsService)throws Exception {
return http.getSharedObject(AuthenticationManagerBuilder.class)
               .userDetailsService(userDetailsService)
               .passwordEncoder(encoder)
               .and()
               .build();
}

2. JWT Utility (JwtUtil / TokenProvider)

• Generate Access Token
• Validate signature & expiration
• Extract username & roles

Add a method to extract roles from JWT for role-based access:

public List<String>extractRoles(String token) {
return ((List<?>) Jwts.parser().setSigningKey(SECRET_KEY)
           .parseClaimsJws(token).getBody().get("roles")).stream()
           .map(Object::toString).collect(Collectors.toList());
}

3. JWT Filter

• Intercepts all HTTP requests
• Extracts JWT from Authorization header
• Sets authentication in SecurityContext

Test JWT filter by accessing /todos with and without a token.

4. Security Filter Chain

• Registers JWT Filter
• Disables session (STATELESS)
• Configures endpoint rules

Protect APIs selectively:

http.authorizeHttpRequests(auth -> auth
        .requestMatchers("/auth/**").permitAll()
        .requestMatchers("/admin/**").hasRole("ADMIN")
        .anyRequest().authenticated()
    );

JWT vs Session-Based Authentication

Security Best Practices for JWT

• Always use HTTPS
• Keep access tokens short-lived
• Use refresh tokens
• Never store JWT in localStorage (prefer HttpOnly cookies)
• Validate signature & expiration
• Use strong algorithms (RS256 preferred)

When to Use JWT

Use JWT (JSON Web Token) when your application needs stateless, scalable security.

Best Use Cases

• REST APIs
• Mobile Applications
• SPA (React, Angular, Vue)
• Microservices Architecture
• Distributed Systems

Avoid JWT When

• Simple server-rendered web applications – Form Login better

Key Takeaways

• JWT is stateless, scalable, and secure
• Ideal for REST APIs and microservices
• Eliminates server-side sessions
• Works seamlessly with Spring Security
• Best combined with OAuth2 for enterprise systems

Conclusion

JWT Authentication is a modern, industry-standard approach to securing APIs. Mastering JWT in Spring Security helps you build:

• Secure REST APIs
• Scalable microservices
• Cloud-ready Spring Boot applications