Securing Spring Boot APIs with JWT Authentication

JSON Web Tokens (JWTs) are stateless, compact, and self-contained standard to transmit the information as a JSON object. This object is usually encoded and encrypted to ensure the authenticity of the message. JWTs are small enough to be sent through URLs. Since they are self-contained, applications can glean sufficient authentication information from them, saving trips to the database. Being stateless, JWTs are particularly suitable to work with REST and HTTP (which are also stateless).

So, how does this work?

• When an application is secured using a JWT-based authentication, it requires a user to login with their credentials. These credentials can be backed by a database, a dedicated Identity and Access Management (IAM) system, etc.
• Once the login is successful, the application returns a JWT token. This token can be saved on the client-side (using localStorage, cookie, etc.).
• When a subsequent request is made to the application, the token should be sent with it in an Authorization header, often using a Bearer schema.

In this post, we'll create a Spring Boot API and secure it using Spring Security and JWT-based authentication.

httpie is a user-friendly HTTP client with first-class JSON support and many other features. We'll use it to send requests to our APIs.

Configure the project

Generate a Spring Boot project with Spring Initializr, and add the spring-boot-starter-web as a dependency.

 1<?xml version="1.0" encoding="UTF-8"?>
 2<project xmlns="http://maven.apache.org/POM/4.0.0"
 3  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 5  <modelVersion>4.0.0</modelVersion>
 6
 7  <parent>
 8    <groupId>org.springframework.boot</groupId>
 9    <artifactId>spring-boot-starter-parent</artifactId>
10    <version>2.3.5.RELEASE</version>
11    <relativePath/> <!-- lookup parent from repository -->
12  </parent>
13
14  <groupId>dev.mflash.guides</groupId>
15  <artifactId>spring-security-jwt-auth</artifactId>
16  <version>0.0.1-SNAPSHOT</version>
17
18  <properties>
19    <java.version>15</java.version>
20  </properties>
21
22  <dependencies>
23    <dependency>
24      <groupId>org.springframework.boot</groupId>
25      <artifactId>spring-boot-starter-web</artifactId>
26    </dependency>
27
28    <dependency>
29      <groupId>org.springframework.boot</groupId>
30      <artifactId>spring-boot-starter-test</artifactId>
31      <scope>test</scope>
32      <exclusions>
33        <exclusion>
34          <groupId>org.junit.vintage</groupId>
35          <artifactId>junit-vintage-engine</artifactId>
36        </exclusion>
37      </exclusions>
38    </dependency>
39  </dependencies>
40
41  <build>
42    <plugins>
43      <plugin>
44        <groupId>org.springframework.boot</groupId>
45        <artifactId>spring-boot-maven-plugin</artifactId>
46      </plugin>
47    </plugins>
48  </build>
49
50</project>

Create some endpoints

Let's create some endpoints to begin with. Here's a GenericController that exposes a GET endpoint which returns a message. This is the functional way of implementing a controller.

 1// src/main/java/dev/mflash/guides/jwtauth/controller/GenericController.java
 2
 3public @Controller class GenericController {
 4
 5  public static final String PUBLIC_ENDPOINT_URL = "/jwt/public";
 6
 7  private ServerResponse publicEndpoint(ServerRequest request) {
 8    return ServerResponse.ok().contentType(APPLICATION_JSON).body(messageMap("public"));
 9  }
10
11  private Map<String, String> messageMap(String type) {
12    return Map.of("message", String.format("Hello, world! This is a %s endpoint", type));
13  }
14
15  public @Bean RouterFunction<ServerResponse> genericRoutes() {
16    return route()
17        .GET(PUBLIC_ENDPOINT_URL, this::publicEndpoint)
18        .build();
19  }
20}

WebMvc.fn With Spring 5.2, a new functional way of writing controllers has been introduced (called WebMvc.fn). WebMvc.fn introduces the following key concepts.

• HandlerFunction which accepts a ServerRequest and provides a ServerResponse. A ServerRequest object encapsulates all kinds of requests, including path variables, request body, etc, which were traditionally parsed using annotations. A ServerResponse is analogous to a response wrapped in a ResponseEntity.
• RouterFunction which configures the endpoints and their content-type. Traditionally, this was handled using annotations; now it's done through functions. After defining the routes, the request is sent to a handler function which provides the expected response.

Launch the application and send the request to the endpoint.

1$ http :8080/jwt/public
2HTTP/1.1 200 
3# other headers
4{
5  "message": "Hello, world! This is a public endpoint"
6}

Enable User registration with Spring Security

Spring Security's AuthenticationManager works with a UserDetails object to handle the authentication. For a custom user, say CustomUser, we'll have to provide a corresponding UserDetails object. This can be done by

• defining a CustomUser and CustomUserRepository
• extending UserDetailsService interface and overriding its loadUserByUsername method to return the details for a CustomUser, and
• adding this service to the AuthenticationManager through a configuration.

In our case, we're going to save the CustomUser in an in-memory H2 database. You can use other databases (such as Postgres or MongoDB) to do the same. You can even integrate UserDetailsService with solutions like LDAP, OIDC, etc., if needed.

Add spring-boot-starter-data-jdbc, h2 and spring-boot-starter-security in the pom.xml.

 1<?xml version="1.0" encoding="UTF-8"?>
 2<project xmlns="http://maven.apache.org/POM/4.0.0"
 3  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
 4  xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
 5  <modelVersion>4.0.0</modelVersion>
 6
 7  <parent>
 8    <groupId>org.springframework.boot</groupId>
 9    <artifactId>spring-boot-starter-parent</artifactId>
10    <version>2.3.5.RELEASE</version>
11    <relativePath/> <!-- lookup parent from repository -->
12  </parent>
13
14  <groupId>dev.mflash.guides</groupId>
15  <artifactId>spring-security-jwt-auth</artifactId>
16  <version>0.0.1-SNAPSHOT</version>
17
18  <properties>
19    <java.version>15</java.version>
20  </properties>
21
22  <dependencies>
23    <dependency>
24      <groupId>org.springframework.boot</groupId>
25      <artifactId>spring-boot-starter-web</artifactId>
26    </dependency>
27
28    <dependency>
29      <groupId>org.springframework.boot</groupId>
30      <artifactId>spring-boot-starter-data-jdbc</artifactId>
31    </dependency>
32    <dependency>
33      <groupId>com.h2database</groupId>
34      <artifactId>h2</artifactId>
35      <scope>runtime</scope>
36    </dependency>
37
38    <dependency>
39      <groupId>org.springframework.boot</groupId>
40      <artifactId>spring-boot-starter-security</artifactId>
41    </dependency>
42
43    <dependency>
44      <groupId>org.springframework.boot</groupId>
45      <artifactId>spring-boot-starter-test</artifactId>
46      <scope>test</scope>
47      <exclusions>
48        <exclusion>
49          <groupId>org.junit.vintage</groupId>
50          <artifactId>junit-vintage-engine</artifactId>
51        </exclusion>
52      </exclusions>
53    </dependency>
54    <dependency>
55      <groupId>org.springframework.security</groupId>
56      <artifactId>spring-security-test</artifactId>
57      <scope>test</scope>
58    </dependency>
59  </dependencies>
60
61  <build>
62    <plugins>
63      <plugin>
64        <groupId>org.springframework.boot</groupId>
65        <artifactId>spring-boot-maven-plugin</artifactId>
66      </plugin>
67    </plugins>
68  </build>
69
70</project>

Create an API to save CustomUser

Since we would need a table to save the CustomUser objects, let's create a schema.sql file to initialize it.

 1-- src/main/resources/schema.sql
 2
 3DROP TABLE IF EXISTS custom_user;
 4
 5CREATE TABLE custom_user (
 6	id INT AUTO_INCREMENT PRIMARY KEY,
 7	email VARCHAR(250) NOT NULL,
 8	name VARCHAR(250) NOT NULL,
 9	password VARCHAR(250) NOT NULL
10);

Spring provides multiple ways to initialize a database schema through scripts available on the classpath. Check out the docs for more details.

In this case, Spring will read the schema.sql file and execute the statements specified in it whenever the application is launched.

Define an entity corresponding to this table.

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUser.java
 2
 3public class CustomUser {
 4
 5  private @Id int id;
 6  private String email;
 7  private String name;
 8  private String password;
 9
10  // getters, setters, etc.
11}

Define a repository to save and fetch the user. For this application, we'll treat the email as the username of a CustomUser.

1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUserRepository.java
2
3public interface CustomUserRepository extends CrudRepository<CustomUser, Long> {
4
5  Optional<CustomUser> findByEmail(String email);
6}

To let a user register on the application, expose an endpoint to create a new CustomUser.

 1// src/main/java/dev/mflash/guides/jwtauth/controller/UserRegistrationController.java
 2
 3public @Controller class UserRegistrationController {
 4
 5  public static final String REGISTRATION_URL = "/user/register";
 6
 7  private final CustomUserRepository repository;
 8  private final PasswordEncoder passwordEncoder;
 9
10  public UserRegistrationController(CustomUserRepository repository, PasswordEncoder passwordEncoder) {
11    this.repository = repository;
12    this.passwordEncoder = passwordEncoder;
13  }
14
15  private ServerResponse register(ServerRequest request) throws ServletException, IOException {
16    final CustomUser newUser = request.body(CustomUser.class);
17    newUser.setPassword(passwordEncoder.encode(newUser.getPassword()));
18    repository.save(newUser);
19    return ServerResponse.ok().contentType(APPLICATION_JSON)
20        .body(Map.of("message", String.format("Registration successful for %s", newUser.getName())));
21  }
22
23  public @Bean RouterFunction<ServerResponse> registrationRoutes() {
24    return route()
25        .POST(REGISTRATION_URL, this::register)
26        .build();
27  }
28}

Note that we're encoding the plaintext password sent by the user before saving it into the database. PasswordEncoder is not provided by default; we'll have to inject it through a configuration.

Integrate the user management with Spring Security

Implement the UserDetailsService which provides loadUserByUsername method to convert CustomUser for Spring Security by specifying that the email is the username field.

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUserDetailsService.java
 2
 3public @Service class CustomUserDetailsService implements UserDetailsService {
 4
 5  private static final String PLACEHOLDER = UUID.randomUUID().toString();
 6  private static final User DEFAULT_USER = new User(PLACEHOLDER, PLACEHOLDER, List.of());
 7  private final CustomUserRepository repository;
 8
 9  public CustomUserDetailsService(CustomUserRepository repository) {
10    this.repository = repository;
11  }
12
13  public @Override UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
14    return repository.findByEmail(email)
15        .map(CustomUserConverter::toUser)
16        .orElse(DEFAULT_USER);
17  }
18}

CustomUserConverter is a utility class that provides methods to convert CustomUser into other objects.

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUserConverter.java
 2
 3public class CustomUserConverter {
 4
 5  public static User toUser(CustomUser user) {
 6    return new User(user.getEmail(), user.getPassword(), List.of());
 7  }
 8
 9  public static UsernamePasswordAuthenticationToken toAuthenticationToken(CustomUser user) {
10    return new UsernamePasswordAuthenticationToken(user.getEmail(), user.getPassword(), List.of());
11  }
12}

Now, we can inject CustomUserDetailsService into Spring Security's AuthenticationManager to complete the integration of CustomUser.

 1// src/main/java/dev/mflash/guides/jwtauth/security/SecurityConfiguration.java
 2
 3@EnableWebSecurity
 4public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 5
 6  private final CustomUserDetailsService userDetailsService;
 7
 8  public SecurityConfiguration(CustomUserDetailsService userDetailsService) {
 9    this.userDetailsService = userDetailsService;
10  }
11
12  public @Bean PasswordEncoder passwordEncoder() {
13    return PasswordEncoderFactories.createDelegatingPasswordEncoder();
14  }
15
16  protected @Override void configure(AuthenticationManagerBuilder auth) throws Exception {
17    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
18  }
19}

About PasswordEncoder If you're starting afresh, you can choose a PasswordEncoder of your choosing, say BCryptPasswordEncoder, and things will work fine. However, there are chances that your application is using multiple encoders to store the passwords. A typical password record may look like this (a prefix enclosed in braces followed by the actual hash): {bcrypt}$2a$10$LYB29GePiC3/ieDvmqCfL.Y6GEk9vEoZVZR2/EQ9nacnY43aQ4LO6

The createDelegatingPasswordEncoder comes to rescue here. It figures out the correct password encoding algorithm by reading the prefix and performs the corresponding encoding and decoding operations.

Note that the same PasswordEncoder is used by UserRegistrationController to encode the password of a new user.

Add Authentication and Authorization filters

To work with JWT, add the following dependencies in pom.xml.

 1<!-- Rest of the POM file -->
 2
 3  <dependencies>
 4    <dependency>
 5      <groupId>io.jsonwebtoken</groupId>
 6      <artifactId>jjwt-api</artifactId>
 7      <version>0.11.2</version>
 8    </dependency>
 9    <dependency>
10      <groupId>io.jsonwebtoken</groupId>
11      <artifactId>jjwt-impl</artifactId>
12      <version>0.11.2</version>
13      <scope>runtime</scope>
14    </dependency>
15    <dependency>
16      <groupId>io.jsonwebtoken</groupId>
17      <artifactId>jjwt-jackson</artifactId>
18      <version>0.11.2</version>
19      <scope>runtime</scope>
20    </dependency>
21  </dependencies>

Create a TokenManager class that'll generate and parse the JWT tokens.

 1// src/main/java/dev/mflash/guides/jwtauth/security/TokenManager.java
 2
 3public class TokenManager {
 4
 5  private static final SecretKey SECRET_KEY = Keys.secretKeyFor(SignatureAlgorithm.HS512);
 6  public static final String TOKEN_PREFIX = "Bearer ";
 7  private static final int TOKEN_EXPIRY_DURATION = 10; // in days
 8
 9  public static String generateToken(String subject) {
10    return Jwts.builder()
11        .setSubject(subject)
12        .setExpiration(Date.from(ZonedDateTime.now().plusDays(TOKEN_EXPIRY_DURATION).toInstant()))
13        .signWith(SECRET_KEY)
14        .compact();
15  }
16
17  public static String parseToken(String token) {
18    return Jwts.parserBuilder()
19        .setSigningKey(SECRET_KEY)
20        .build()
21        .parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
22        .getBody()
23        .getSubject();
24  }
25}

SECRET_KEY is a randomly-generated key using the HS512 algorithm (there are other algorithms, as well). This key is used for signing the tokens by generateToken method and subsequently to read them by parseToken method. We've also set the tokens to expire after 10 days (through TOKEN_EXPIRY_DURATION constant).

Now, define an AuthenticationFilter to verify the correct user.

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomAuthenticationFilter.java
 2
 3public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
 4
 5  public static final String AUTH_HEADER_KEY = "Authorization";
 6
 7  private final AuthenticationManager authenticationManager;
 8
 9  public CustomAuthenticationFilter(AuthenticationManager authenticationManager) {
10    this.authenticationManager = authenticationManager;
11  }
12
13  public @Override Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
14      throws AuthenticationException {
15    try {
16      var user = new ObjectMapper().readValue(request.getInputStream(), CustomUser.class);
17      return authenticationManager.authenticate(CustomUserConverter.toAuthenticationToken(user));
18    } catch (IOException e) {
19      throw new AuthenticationCredentialsNotFoundException("Failed to resolve authentication credentials", e);
20    }
21  }
22
23  protected @Override void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
24      FilterChain chain, Authentication authResult) throws IOException, ServletException {
25    response.addHeader(AUTH_HEADER_KEY,
26        TOKEN_PREFIX + generateToken(((User) authResult.getPrincipal()).getUsername()));
27  }
28}

Here,

• the attemptAuthentication method extracts the user from the request and tries to authenticate them with the help of AuthenticationManager.
• On successful authentication, a token is generated by TokenManager and attached to the header of the response (see successfulAuthentication method). This token will be used for subsequent requests and will be checked every time a request arrives.

On successful verification of the token, access to the application will be enabled with the help of the doFilterInternal method of the CustomAuthorizationFilter.

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomAuthorizationFilter.java
 2
 3public class CustomAuthorizationFilter extends BasicAuthenticationFilter {
 4
 5  public CustomAuthorizationFilter(AuthenticationManager authenticationManager) {
 6    super(authenticationManager);
 7  }
 8
 9  protected @Override void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
10      throws IOException, ServletException {
11
12    String header = request.getHeader(AUTH_HEADER_KEY);
13
14    if (Objects.isNull(header) || !header.startsWith(TOKEN_PREFIX)) {
15      chain.doFilter(request, response);
16      return;
17    }
18
19    UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
20    SecurityContextHolder.getContext().setAuthentication(authentication);
21    chain.doFilter(request, response);
22  }
23
24  private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
25    String header = request.getHeader(AUTH_HEADER_KEY);
26
27    if (Objects.nonNull(header) && header.startsWith(TOKEN_PREFIX)) {
28      try {
29        String username = parseToken(header);
30        return new UsernamePasswordAuthenticationToken(username, null, List.of());
31      } catch (ExpiredJwtException e) {
32        throw new AccessDeniedException("Expired token");
33      } catch (UnsupportedJwtException | MalformedJwtException e) {
34        throw new AccessDeniedException("Unsupported token");
35      } catch (Exception e) {
36        throw new AccessDeniedException("User authorization not resolved");
37      }
38    } else {
39      throw new AccessDeniedException("Authorization token not found");
40    }
41  }
42}

Here, the doFilterInternal method extracts the Authorization header, fetches the authentication status, and updates the SecurityContext. If the authentication fails, the request to the application is denied by the filter.

We need to register these filters and specify which endpoints are protected and which are accessible publicly in the SecurityConfiguration.

 1// src/main/java/dev/mflash/guides/jwtauth/security/SecurityConfiguration.java
 2
 3@EnableWebSecurity
 4public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 5
 6  private final CustomUserDetailsService userDetailsService;
 7
 8  public SecurityConfiguration(CustomUserDetailsService userDetailsService) {
 9    this.userDetailsService = userDetailsService;
10  }
11
12  protected @Override void configure(HttpSecurity http) throws Exception {
13    http.cors().and()
14        .csrf().disable()
15        .authorizeRequests()
16        .antMatchers(PUBLIC_ENDPOINT_URL).permitAll()
17        .antMatchers(POST, REGISTRATION_URL).permitAll()
18        .anyRequest().authenticated().and()
19        .addFilter(new CustomAuthenticationFilter(authenticationManager()))
20        .addFilter(new CustomAuthorizationFilter(authenticationManager()))
21        .sessionManagement().sessionCreationPolicy(STATELESS);
22  }
23
24  public @Bean PasswordEncoder passwordEncoder() {
25    return PasswordEncoderFactories.createDelegatingPasswordEncoder();
26  }
27
28  protected @Override void configure(AuthenticationManagerBuilder auth) throws Exception {
29    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
30  }
31
32  public @Bean CorsConfigurationSource corsConfigurationSource() {
33    final var source = new UrlBasedCorsConfigurationSource();
34    source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
35    return source;
36  }
37}

Here, we've

• allowed the user registration endpoint and an endpoint from GenericController to be accessible publicly, and restricted all other URLs to be accessible only after authentication.
• disabled the session management of Spring Security by setting the SessionCreationPolicy to be STATELESS since JWT authentication is stateless.

Let's create a sample endpoint in GenericController that is secured with this implementation.

 1// src/main/java/dev/mflash/guides/jwtauth/controller/GenericController.java
 2
 3public @Controller class GenericController {
 4
 5  public static final String PUBLIC_ENDPOINT_URL = "/jwt/public";
 6  public static final String PRIVATE_ENDPOINT_URL = "/jwt/private";
 7
 8  private ServerResponse publicEndpoint(ServerRequest request) {
 9    return ServerResponse.ok().contentType(APPLICATION_JSON).body(messageMap("public"));
10  }
11
12  private ServerResponse privateEndpoint(ServerRequest request) {
13    return ServerResponse.ok().contentType(APPLICATION_JSON).body(messageMap("private"));
14  }
15
16  private Map<String, String> messageMap(String type) {
17    return Map.of("message", String.format("Hello, world! This is a %s endpoint", type));
18  }
19
20  public @Bean RouterFunction<ServerResponse> genericRoutes() {
21    return route()
22        .GET(PUBLIC_ENDPOINT_URL, this::publicEndpoint)
23        .GET(PRIVATE_ENDPOINT_URL, this::privateEndpoint)
24        .build();
25  }
26}

Testing the application

Launch the application, and try to hit the http://localhost:8080/jwt/private endpoint.

 1$ http :8080/jwt/private
 2HTTP/1.1 403
 3# other headers
 4{
 5    "error": "Forbidden",
 6    "message": "",
 7    "path": "/jwt/private",
 8    "status": 403,
 9    "timestamp": "2020-11-05T11:32:30.771+00:00"
10}

The response 403 Forbidden is expected, since this endpoint is no longer accessible publicly. Now, register as a new user.

1$ http POST :8080/user/register name='Arya Antrix' email=arya.antrix@example.com password=pa55word
2HTTP/1.1 200
3# other headers
4{
5    "message": "Registration successful for Arya Antrix"
6}

and login with this user.

1$ http POST :8080/login email=arya.antrix@example.com password=pa55word
2HTTP/1.1 200
3Authorization: Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhcnlhLmFudHJpeEBleGFtcGxlLmNvbSIsImV4cCI6MTYwNTQ0NjUyNn0.lxeHhzdaDxa_PEF3zzhIsft6M3qexjJA2CyrPzAFrAZOP7zgP1slec5w41v08R_9LC7Bnbb7loIwNGn5GlVohg
4# other headers

You'll receive a response 200 OK with an Authorization header that contains a Bearer token. Use this token and hit the http://localhost:8080/jwt/private endpoint, again. This time, you'll get a successful response.

1$ http :8080/jwt/private 'Authorization:Bearer eyJhbGciOiJIUzUxMiJ9.eyJzdWIiOiJhcnlhLmFudHJpeEBleGFtcGxlLmNvbSIsImV4cCI6MTYwNTQ0NjUyNn0.lxeHhzdaDxa_PEF3zzhIsft6M3qexjJA2CyrPzAFrAZOP7zgP1slec5w41v08R_9LC7Bnbb7loIwNGn5GlVohg'
2HTTP/1.1 200
3# other headers
4{
5    "message": "Hello, world! This is a private endpoint"
6}

You can use the above scenarios to write some unit tests (using Spring's MockMvc and AssertJ assertions).

 1// src/test/java/dev/mflash/guides/jwtauth/controller/GenericControllerTest.java
 2
 3@SpringBootTest
 4@AutoConfigureMockMvc
 5@ExtendWith(SpringExtension.class)
 6class GenericControllerTest {
 7
 8  private @Autowired MockMvc mvc;
 9
10  @Test
11  @DisplayName("Should be able to access public endpoint without auth")
12  void shouldBeAbleToAccessPublicEndpointWithoutAuth() throws Exception {
13    MockHttpServletResponse response = mvc.perform(get(PUBLIC_ENDPOINT_URL))
14        .andExpect(status().isOk())
15        .andReturn().getResponse();
16
17    assertThat(response.getContentAsString()).isNotEmpty();
18  }
19
20  @Test
21  @DisplayName("Should get forbidden on private endpoint without auth")
22  void shouldGetForbiddenOnPrivateEndpointWithoutAuth() throws Exception {
23    mvc.perform(get(PRIVATE_ENDPOINT_URL))
24        .andExpect(status().isForbidden())
25        .andReturn();
26  }
27
28  @Test
29  @DisplayName("Should be able to access private endpoint with auth")
30  @WithMockUser(username = "jwtUser")
31  void shouldBeAbleToAccessPrivateEndpointWithAuth() throws Exception {
32    MockHttpServletResponse response = mvc.perform(get(PRIVATE_ENDPOINT_URL))
33        .andExpect(status().isOk())
34        .andReturn().getResponse();
35
36    assertThat(response.getContentAsString()).isNotEmpty();
37  }
38}

Here,

• the first test verifies that the public endpoint is accessible without any authentication
• the second test verifies that the application returns a proper error status (403 Forbidden) when the private endpoint receives a request without any authentication, and
• the final test verifies that once a user has been authenticated successfully, they're able to access the private endpoint.

References

Source Code — spring-security-jwt-auth

Related

• Introduction to JSON Web Tokens
• Verify Access Tokens for Custom APIs
• Database Initialization