4.0.0 com.example spring-jwt-example 0.0.1-SNAPSHOT jar spring-jwt-example Demo project for Spring Boot JWT org.springframework.boot spring-boot-starter-parent 3.2.0 17 0.12.3 org.springframework.boot spring-boot-starter-web org.springframework.boot spring-boot-starter-security io.jsonwebtoken jjwt-api ${jjwt.version} io.jsonwebtoken jjwt-impl ${jjwt.version} runtime io.jsonwebtoken jjwt-jackson ${jjwt.version} runtime org.springframework.boot spring-boot-starter-test test org.springframework.security spring-security-test test org.springframework.boot spring-boot-maven-plugin # Use a strong, base64 encoded secret key in a real application # Generate one using: Base64.getEncoder().encodeToString(Keys.secretKeyFor(SignatureAlgorithm.HS512).getEncoded()) jwt.secret=your-very-secure-and-long-secret-key-replace-this-in-production-your-very-secure-and-long-secret-key-replace-this-in-production # Token validity in milliseconds (e.g., 1 hour = 3600000, 24 hours = 86400000) jwt.expiration=3600000 package com.example.security.util; import io.jsonwebtoken.Claims; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import io.jsonwebtoken.io.Decoders; import io.jsonwebtoken.security.Keys; import org.springframework.beans.factory.annotation.Value; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Component; import javax.crypto.SecretKey; import java.util.Date; import java.util.HashMap; import java.util.Map; import java.util.function.Function; @Component public class JwtUtil { @Value("${jwt.secret}") private String secret; @Value("${jwt.expiration}") private long expiration; private SecretKey getSigningKey() { byte[] keyBytes = Decoders.BASE64.decode(secret); return Keys.hmacShaKeyFor(keyBytes); } public String extractUsername(String token) { return extractClaim(token, Claims::getSubject); } public Date extractExpiration(String token) { return extractClaim(token, Claims::getExpiration); } public T extractClaim(String token, Function claimsResolver) { final Claims claims = extractAllClaims(token); return claimsResolver.apply(claims); } private Claims extractAllClaims(String token) { return Jwts.parser() .verifyWith(getSigningKey()) .build() .parseSignedClaims(token) .getPayload(); } private Boolean isTokenExpired(String token) { return extractExpiration(token).before(new Date()); } public String generateToken(UserDetails userDetails) { Map claims = new HashMap<>(); // Add any custom claims here if needed // claims.put("role", userDetails.getAuthorities()); return createToken(claims, userDetails.getUsername()); } private String createToken(Map claims, String subject) { Date now = new Date(); Date expiryDate = new Date(now.getTime() + expiration); return Jwts.builder() .claims(claims) .subject(subject) .issuedAt(now) .expiration(expiryDate) .signWith(getSigningKey(), SignatureAlgorithm.HS512) // Use appropriate algorithm .compact(); } public Boolean validateToken(String token, UserDetails userDetails) { final String username = extractUsername(token); return (username.equals(userDetails.getUsername()) && !isTokenExpired(token)); } } package com.example.security.filter; import com.example.security.util.JwtUtil; import io.jsonwebtoken.ExpiredJwtException; import io.jsonwebtoken.MalformedJwtException; import io.jsonwebtoken.UnsupportedJwtException; import io.jsonwebtoken.security.SignatureException; import jakarta.servlet.FilterChain; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.web.authentication.WebAuthenticationDetailsSource; import org.springframework.stereotype.Component; import org.springframework.web.filter.OncePerRequestFilter; import java.io.IOException; @Component public class JwtRequestFilter extends OncePerRequestFilter { private static final Logger logger = LoggerFactory.getLogger(JwtRequestFilter.class); @Autowired private UserDetailsService userDetailsService; @Autowired private JwtUtil jwtUtil; @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { final String authorizationHeader = request.getHeader("Authorization"); String username = null; String jwt = null; if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) { jwt = authorizationHeader.substring(7); try { username = jwtUtil.extractUsername(jwt); } catch (ExpiredJwtException e) { logger.warn("JWT token is expired: {}", e.getMessage()); } catch (UnsupportedJwtException e) { logger.warn("JWT token is unsupported: {}", e.getMessage()); } catch (MalformedJwtException e) { logger.warn("Invalid JWT token: {}", e.getMessage()); } catch (SignatureException e) { logger.warn("Invalid JWT signature: {}", e.getMessage()); } catch (IllegalArgumentException e) { logger.warn("JWT claims string is empty: {}", e.getMessage()); } } else { // logger.trace("Authorization header does not begin with Bearer String or is null"); } if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) { UserDetails userDetails = this.userDetailsService.loadUserByUsername(username); try { if (jwtUtil.validateToken(jwt, userDetails)) { UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken( userDetails, null, userDetails.getAuthorities()); usernamePasswordAuthenticationToken .setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); logger.debug("Set authentication in SecurityContext for user '{}'", username); } } catch (Exception e) { // Log validation errors if validateToken throws exceptions (though handled above mostly) logger.error("Cannot set user authentication: {}", e.getMessage()); } } chain.doFilter(request, response); } } package com.example.security.service; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.stereotype.Service; import java.util.ArrayList; import java.util.HashMap; import java.util.Map; @Service public class UserDetailsServiceImpl implements UserDetailsService { // In-memory user store for demonstration. Replace with DB lookup. private final Map users = new HashMap<>(); private final PasswordEncoder passwordEncoder; public UserDetailsServiceImpl(PasswordEncoder passwordEncoder) { this.passwordEncoder = passwordEncoder; // Add a demo user users.put("user", User.builder() .username("user") .password(passwordEncoder.encode("password")) // Store encoded password .authorities(new ArrayList<>()) // Add roles/authorities if needed .build()); users.put("admin", User.builder() .username("admin") .password(passwordEncoder.encode("adminpass")) // Store encoded password .authorities(new ArrayList<>()) // Add roles/authorities if needed .build()); } @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { UserDetails user = users.get(username); if (user == null) { throw new UsernameNotFoundException("User not found with username: " + username); } return user; } } package com.example.security.config; import com.example.security.filter.JwtRequestFilter; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.configuration.AuthenticationConfiguration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; @Configuration @EnableWebSecurity public class SecurityConfig { @Autowired private JwtRequestFilter jwtRequestFilter; @Bean public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { http .csrf(AbstractHttpConfigurer::disable) // Disable CSRF for stateless APIs .authorizeHttpRequests(auth -> auth .requestMatchers("/authenticate").permitAll() // Allow access to authentication endpoint .requestMatchers("/api/public/**").permitAll() // Allow public access .anyRequest().authenticated() // Require authentication for all other requests ) .sessionManagement(session -> session .sessionCreationPolicy(SessionCreationPolicy.STATELESS) // Use stateless sessions ) .addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class); // Add JWT filter return http.build(); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Bean public AuthenticationManager authenticationManager(AuthenticationConfiguration authenticationConfiguration) throws Exception { return authenticationConfiguration.getAuthenticationManager(); } } package com.example.model; // Simple DTO for authentication request payload public class AuthenticationRequest { private String username; private String password; // Default constructor for JSON deserialization public AuthenticationRequest() { } public AuthenticationRequest(String username, String password) { this.username = username; this.password = password; } public String getUsername() { return username; } public void setUsername(String username) { this.username = username; } public String getPassword() { return password; } public void setPassword(String password) { this.password = password; } } package com.example.model; // Simple DTO for authentication response payload public class AuthenticationResponse { private final String jwt; public AuthenticationResponse(String jwt) { this.jwt = jwt; } public String getJwt() { return jwt; } } package com.example.controller; import com.example.model.AuthenticationRequest; import com.example.model.AuthenticationResponse; import com.example.security.util.JwtUtil; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.ResponseEntity; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.BadCredentialsException; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RestController; @RestController public class AuthController { @Autowired private AuthenticationManager authenticationManager; @Autowired private UserDetailsService userDetailsService; @Autowired private JwtUtil jwtUtil; @PostMapping("/authenticate") public ResponseEntity createAuthenticationToken(@RequestBody AuthenticationRequest authenticationRequest) throws Exception { try { authenticationManager.authenticate( new UsernamePasswordAuthenticationToken(authenticationRequest.getUsername(), authenticationRequest.getPassword()) ); } catch (BadCredentialsException e) { throw new Exception("Incorrect username or password", e); } final UserDetails userDetails = userDetailsService.loadUserByUsername(authenticationRequest.getUsername()); final String jwt = jwtUtil.generateToken(userDetails); return ResponseEntity.ok(new AuthenticationResponse(jwt)); } } package com.example.controller; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RestController; import java.security.Principal; @RestController @RequestMapping("/api") public class HelloController { @GetMapping("/hello") public String hello(Principal principal) { // Principal is automatically populated by Spring Security if authenticated String username = (principal != null) ? principal.getName() : "Anonymous"; return "Hello, " + username + "! This is a secured endpoint."; } @GetMapping("/public/info") public String publicInfo() { return "This is public information, accessible without authentication."; } } package com.example; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @SpringBootApplication public class Application { public static void main(String[] args) { SpringApplication.run(Application.class, args); } }