Okay, here is a basic setup for handling JWT authentication in a Spring Boot application. This setup includes: 1. Dependencies for Spring Web, Spring Security, and JJWT. 2. Configuration for JWT properties (secret key, expiration). 3. A utility class for creating and validating JWTs. 4. A custom `UserDetailsService`. 5. A JWT request filter to intercept and validate tokens on incoming requests. 6. Security configuration to integrate the filter and define access rules. 7. An authentication controller to issue tokens upon successful login. 8. A sample protected controller. <?xml version="1.0" encoding="UTF-8"?> <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd"> <modelVersion>4.0.0</modelVersion> <parent> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-parent</artifactId> <version>2.7.5</version>  <relativePath/>  </parent> <groupId>com.example</groupId> <artifactId>spring-boot-jwt</artifactId> <version>0.0.1-SNAPSHOT</version> <name>spring-boot-jwt</name> <description>Demo project for Spring Boot JWT</description> <properties> <java.version>11</java.version> <jjwt.version>0.9.1</jjwt.version>  </properties> <dependencies> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-web</artifactId> </dependency>  <dependency> <groupId>io.jsonwebtoken</groupId> <artifactId>jjwt</artifactId> <version>${jjwt.version}</version> </dependency>  <dependency> <groupId>javax.xml.bind</groupId> <artifactId>jaxb-api</artifactId> <version>2.3.1</version>  </dependency> <dependency> <groupId>org.glassfish.jaxb</groupId> <artifactId>jaxb-runtime</artifactId> <version>2.3.1</version>  </dependency> <dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-test</artifactId> <scope>test</scope> </dependency> <dependency> <groupId>org.springframework.security</groupId> <artifactId>spring-security-test</artifactId> <scope>test</scope> </dependency> </dependencies> <build> <plugins> <plugin> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-maven-plugin</artifactId> </plugin> </plugins> </build> </project> # Choose a strong, secure secret key and keep it confidential (e.g., use environment variables) jwt.secret=YourSecretKeyWhichIsLongAndSecureEnough32CharsMin # Expiration time in milliseconds (e.g., 1 hour = 3600000) jwt.expiration=3600000 package com.example.jwt; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @SpringBootApplication public class JwtApplication { public static void main(String[] args) { SpringApplication.run(JwtApplication.class, args); } } package com.example.jwt.model; import java.io.Serializable; // Data Transfer Object for authentication request public class AuthenticationRequest implements Serializable { private static final long serialVersionUID = -8445943548965154778L; private String username; private String password; // Need default constructor for JSON Parsing public AuthenticationRequest() { } public AuthenticationRequest(String username, String password) { this.setUsername(username); this.setPassword(password); } public String getUsername() { return this.username; } public void setUsername(String username) { this.username = username; } public String getPassword() { return this.password; } public void setPassword(String password) { this.password = password; } } package com.example.jwt.model; import java.io.Serializable; // Data Transfer Object for authentication response (containing the JWT) public class AuthenticationResponse implements Serializable { private static final long serialVersionUID = -8091879091924046844L; private final String jwt; public AuthenticationResponse(String jwt) { this.jwt = jwt; } public String getJwt() { return this.jwt; } } package com.example.jwt.util; import io.jsonwebtoken.Claims; import io.jsonwebtoken.Jwts; import io.jsonwebtoken.SignatureAlgorithm; import org.springframework.beans.factory.annotation.Value; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.stereotype.Service; import java.util.Date; import java.util.HashMap; import java.util.Map; import java.util.function.Function; @Service public class JwtUtil { @Value("${jwt.secret}") private String SECRET_KEY; @Value("${jwt.expiration}") private long EXPIRATION_TIME; // in milliseconds public String extractUsername(String token) { return extractClaim(token, Claims::getSubject); } public Date extractExpiration(String token) { return extractClaim(token, Claims::getExpiration); } public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) { final Claims claims = extractAllClaims(token); return claimsResolver.apply(claims); } private Claims extractAllClaims(String token) { return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody(); } private Boolean isTokenExpired(String token) { return extractExpiration(token).before(new Date()); } public String generateToken(UserDetails userDetails) { Map<String, Object> claims = new HashMap<>(); // Add additional claims if needed // claims.put("roles", userDetails.getAuthorities()); return createToken(claims, userDetails.getUsername()); } private String createToken(Map<String, Object> claims, String subject) { return Jwts.builder().setClaims(claims).setSubject(subject).setIssuedAt(new Date(System.currentTimeMillis())) .setExpiration(new Date(System.currentTimeMillis() + EXPIRATION_TIME)) .signWith(SignatureAlgorithm.HS256, SECRET_KEY).compact(); } public Boolean validateToken(String token, UserDetails userDetails) { final String username = extractUsername(token); return (username.equals(userDetails.getUsername()) && !isTokenExpired(token)); } } package com.example.jwt.service; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.core.userdetails.UsernameNotFoundException; import org.springframework.stereotype.Service; import java.util.ArrayList; @Service public class MyUserDetailsService implements UserDetailsService { // In a real application, you would load user details from a database // For simplicity, we use a hardcoded user here. @Override public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException { if ("user".equals(username)) { // Password is "password" (should be encoded in a real app) // The empty list means no specific authorities/roles for this simple example return new User("user", "$2a$10$slYQmyNdGzTn7ZLBXBChFOC9f6kFjAqPhccnP6DxlWXx2lPk1C3G6", // Encoded "password" new ArrayList<>()); } else { throw new UsernameNotFoundException("User not found with username: " + username); } } } package com.example.jwt.filter; import com.example.jwt.service.MyUserDetailsService; import com.example.jwt.util.JwtUtil; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.web.authentication.WebAuthenticationDetailsSource; import org.springframework.stereotype.Component; import org.springframework.web.filter.OncePerRequestFilter; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import java.io.IOException; @Component public class JwtRequestFilter extends OncePerRequestFilter { @Autowired private MyUserDetailsService userDetailsService; @Autowired private JwtUtil jwtUtil; @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException { final String authorizationHeader = request.getHeader("Authorization"); String username = null; String jwt = null; if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) { jwt = authorizationHeader.substring(7); try { username = jwtUtil.extractUsername(jwt); } catch (Exception e) { // Handle exception (e.g., token expired, malformed) logger.warn("JWT Token processing error: " + e.getMessage()); } } if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) { UserDetails userDetails = this.userDetailsService.loadUserByUsername(username); if (jwtUtil.validateToken(jwt, userDetails)) { UsernamePasswordAuthenticationToken usernamePasswordAuthenticationToken = new UsernamePasswordAuthenticationToken( userDetails, null, userDetails.getAuthorities()); usernamePasswordAuthenticationToken .setDetails(new WebAuthenticationDetailsSource().buildDetails(request)); SecurityContextHolder.getContext().setAuthentication(usernamePasswordAuthenticationToken); } } chain.doFilter(request, response); } } package com.example.jwt.config; import com.example.jwt.filter.JwtRequestFilter; import com.example.jwt.service.MyUserDetailsService; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter; @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private MyUserDetailsService myUserDetailsService; @Autowired private JwtRequestFilter jwtRequestFilter; @Autowired public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception { auth.userDetailsService(myUserDetailsService).passwordEncoder(passwordEncoder()); } @Bean public PasswordEncoder passwordEncoder() { return new BCryptPasswordEncoder(); } @Override @Bean public AuthenticationManager authenticationManagerBean() throws Exception { return super.authenticationManagerBean(); } @Override protected void configure(HttpSecurity httpSecurity) throws Exception { httpSecurity.csrf().disable() // Permit access to the authenticate endpoint without authentication .authorizeRequests().antMatchers("/authenticate").permitAll() // Any other request must be authenticated .anyRequest().authenticated().and() // Ensure we use stateless session; session won't be used to store user's state. .exceptionHandling().and().sessionManagement() .sessionCreationPolicy(SessionCreationPolicy.STATELESS); // Add a filter to validate the tokens with every request httpSecurity.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class); } } package com.example.jwt.controller; import com.example.jwt.model.AuthenticationRequest; import com.example.jwt.model.AuthenticationResponse; import com.example.jwt.service.MyUserDetailsService; import com.example.jwt.util.JwtUtil; import org.springframework.beans.factory.annotation.Autowired; import org.springframework.http.ResponseEntity; import org.springframework.security.authentication.AuthenticationManager; import org.springframework.security.authentication.BadCredentialsException; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestBody; import org.springframework.web.bind.annotation.RestController; @RestController public class AuthController { @Autowired private AuthenticationManager authenticationManager; @Autowired private JwtUtil jwtTokenUtil; @Autowired private MyUserDetailsService userDetailsService; @PostMapping("/authenticate") public ResponseEntity<?> createAuthenticationToken(@RequestBody AuthenticationRequest authenticationRequest) throws Exception { try { authenticationManager.authenticate( new UsernamePasswordAuthenticationToken(authenticationRequest.getUsername(), authenticationRequest.getPassword()) ); } catch (BadCredentialsException e) { throw new Exception("Incorrect username or password", e); } final UserDetails userDetails = userDetailsService .loadUserByUsername(authenticationRequest.getUsername()); final String jwt = jwtTokenUtil.generateToken(userDetails); return ResponseEntity.ok(new AuthenticationResponse(jwt)); } } package com.example.jwt.controller; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RestController; @RestController public class HelloController { // This endpoint requires authentication @GetMapping("/hello") public String hello() { return "Hello from protected resource!"; } } **To Run This:** 1. Make sure you have Java (JDK 11 or later) and Maven installed. 2. Save the files in the specified directory structure. 3. Open a terminal in the root directory (where `pom.xml` is). 4. Run the application: `mvn spring-boot:run` 5. **Test Authentication:** * Send a POST request to `http://localhost:8080/authenticate` with a JSON body like: json { "username": "user", "password": "password" } * You should receive a response with a JWT token: ```json { "jwt": "eyJhbGciOiJIUzI1NiJ9..." } ``` 6. **Test Protected Endpoint:** * Copy the received JWT token. * Send a GET request to `http://localhost:8080/hello`. * Add an `Authorization` header to the request: `Authorization: Bearer ` * You should receive the response: `"Hello from protected resource!"` * If you try accessing `/hello` without a valid token, you'll get a 403 Forbidden or 401 Unauthorized error. Remember to replace the `jwt.secret` in `application.properties` with a strong, unique secret key for production environments and manage it securely (e.g., using environment variables or a secrets manager). The password encoding uses BCrypt; the example password "password" is encoded in `MyUserDetailsService`.