Securing Spring Boot APIs with JWT Authentication

 1// src/main/java/dev/mflash/guides/jwtauth/controller/GenericController.java
 2
 3public @Controller class GenericController {
 4
 5  public static final String PUBLIC_ENDPOINT_URL = "/jwt/public";
 6
 7  private ServerResponse publicEndpoint(ServerRequest request) {
 8    return ServerResponse.ok().contentType(APPLICATION_JSON).body(messageMap("public"));
 9  }
10
11  private Map<String, String> messageMap(String type) {
12    return Map.of("message", String.format("Hello, world! This is a %s endpoint", type));
13  }
14
15  public @Bean RouterFunction<ServerResponse> genericRoutes() {
16    return route()
17        .GET(PUBLIC_ENDPOINT_URL, this::publicEndpoint)
18        .build();
19  }
20}

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUser.java
 2
 3public class CustomUser {
 4
 5  private @Id int id;
 6  private String email;
 7  private String name;
 8  private String password;
 9
10  // getters, setters, etc.
11}

1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUserRepository.java
2
3public interface CustomUserRepository extends CrudRepository<CustomUser, Long> {
4
5  Optional<CustomUser> findByEmail(String email);
6}

 1// src/main/java/dev/mflash/guides/jwtauth/controller/UserRegistrationController.java
 2
 3public @Controller class UserRegistrationController {
 4
 5  public static final String REGISTRATION_URL = "/user/register";
 6
 7  private final CustomUserRepository repository;
 8  private final PasswordEncoder passwordEncoder;
 9
10  public UserRegistrationController(CustomUserRepository repository, PasswordEncoder passwordEncoder) {
11    this.repository = repository;
12    this.passwordEncoder = passwordEncoder;
13  }
14
15  private ServerResponse register(ServerRequest request) throws ServletException, IOException {
16    final CustomUser newUser = request.body(CustomUser.class);
17    newUser.setPassword(passwordEncoder.encode(newUser.getPassword()));
18    repository.save(newUser);
19    return ServerResponse.ok().contentType(APPLICATION_JSON)
20        .body(Map.of("message", String.format("Registration successful for %s", newUser.getName())));
21  }
22
23  public @Bean RouterFunction<ServerResponse> registrationRoutes() {
24    return route()
25        .POST(REGISTRATION_URL, this::register)
26        .build();
27  }
28}

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUserDetailsService.java
 2
 3public @Service class CustomUserDetailsService implements UserDetailsService {
 4
 5  private static final String PLACEHOLDER = UUID.randomUUID().toString();
 6  private static final User DEFAULT_USER = new User(PLACEHOLDER, PLACEHOLDER, List.of());
 7  private final CustomUserRepository repository;
 8
 9  public CustomUserDetailsService(CustomUserRepository repository) {
10    this.repository = repository;
11  }
12
13  public @Override UserDetails loadUserByUsername(String email) throws UsernameNotFoundException {
14    return repository.findByEmail(email)
15        .map(CustomUserConverter::toUser)
16        .orElse(DEFAULT_USER);
17  }
18}

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomUserConverter.java
 2
 3public class CustomUserConverter {
 4
 5  public static User toUser(CustomUser user) {
 6    return new User(user.getEmail(), user.getPassword(), List.of());
 7  }
 8
 9  public static UsernamePasswordAuthenticationToken toAuthenticationToken(CustomUser user) {
10    return new UsernamePasswordAuthenticationToken(user.getEmail(), user.getPassword(), List.of());
11  }
12}

 1// src/main/java/dev/mflash/guides/jwtauth/security/SecurityConfiguration.java
 2
 3@EnableWebSecurity
 4public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 5
 6  private final CustomUserDetailsService userDetailsService;
 7
 8  public SecurityConfiguration(CustomUserDetailsService userDetailsService) {
 9    this.userDetailsService = userDetailsService;
10  }
11
12  public @Bean PasswordEncoder passwordEncoder() {
13    return PasswordEncoderFactories.createDelegatingPasswordEncoder();
14  }
15
16  protected @Override void configure(AuthenticationManagerBuilder auth) throws Exception {
17    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
18  }
19}

 1// src/main/java/dev/mflash/guides/jwtauth/security/TokenManager.java
 2
 3public class TokenManager {
 4
 5  private static final SecretKey SECRET_KEY = Keys.secretKeyFor(SignatureAlgorithm.HS512);
 6  public static final String TOKEN_PREFIX = "Bearer ";
 7  private static final int TOKEN_EXPIRY_DURATION = 10; // in days
 8
 9  public static String generateToken(String subject) {
10    return Jwts.builder()
11        .setSubject(subject)
12        .setExpiration(Date.from(ZonedDateTime.now().plusDays(TOKEN_EXPIRY_DURATION).toInstant()))
13        .signWith(SECRET_KEY)
14        .compact();
15  }
16
17  public static String parseToken(String token) {
18    return Jwts.parserBuilder()
19        .setSigningKey(SECRET_KEY)
20        .build()
21        .parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
22        .getBody()
23        .getSubject();
24  }
25}

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomAuthenticationFilter.java
 2
 3public class CustomAuthenticationFilter extends UsernamePasswordAuthenticationFilter {
 4
 5  public static final String AUTH_HEADER_KEY = "Authorization";
 6
 7  private final AuthenticationManager authenticationManager;
 8
 9  public CustomAuthenticationFilter(AuthenticationManager authenticationManager) {
10    this.authenticationManager = authenticationManager;
11  }
12
13  public @Override Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
14      throws AuthenticationException {
15    try {
16      var user = new ObjectMapper().readValue(request.getInputStream(), CustomUser.class);
17      return authenticationManager.authenticate(CustomUserConverter.toAuthenticationToken(user));
18    } catch (IOException e) {
19      throw new AuthenticationCredentialsNotFoundException("Failed to resolve authentication credentials", e);
20    }
21  }
22
23  protected @Override void successfulAuthentication(HttpServletRequest request, HttpServletResponse response,
24      FilterChain chain, Authentication authResult) throws IOException, ServletException {
25    response.addHeader(AUTH_HEADER_KEY,
26        TOKEN_PREFIX + generateToken(((User) authResult.getPrincipal()).getUsername()));
27  }
28}

 1// src/main/java/dev/mflash/guides/jwtauth/security/CustomAuthorizationFilter.java
 2
 3public class CustomAuthorizationFilter extends BasicAuthenticationFilter {
 4
 5  public CustomAuthorizationFilter(AuthenticationManager authenticationManager) {
 6    super(authenticationManager);
 7  }
 8
 9  protected @Override void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
10      throws IOException, ServletException {
11
12    String header = request.getHeader(AUTH_HEADER_KEY);
13
14    if (Objects.isNull(header) || !header.startsWith(TOKEN_PREFIX)) {
15      chain.doFilter(request, response);
16      return;
17    }
18
19    UsernamePasswordAuthenticationToken authentication = getAuthentication(request);
20    SecurityContextHolder.getContext().setAuthentication(authentication);
21    chain.doFilter(request, response);
22  }
23
24  private UsernamePasswordAuthenticationToken getAuthentication(HttpServletRequest request) {
25    String header = request.getHeader(AUTH_HEADER_KEY);
26
27    if (Objects.nonNull(header) && header.startsWith(TOKEN_PREFIX)) {
28      try {
29        String username = parseToken(header);
30        return new UsernamePasswordAuthenticationToken(username, null, List.of());
31      } catch (ExpiredJwtException e) {
32        throw new AccessDeniedException("Expired token");
33      } catch (UnsupportedJwtException | MalformedJwtException e) {
34        throw new AccessDeniedException("Unsupported token");
35      } catch (Exception e) {
36        throw new AccessDeniedException("User authorization not resolved");
37      }
38    } else {
39      throw new AccessDeniedException("Authorization token not found");
40    }
41  }
42}

 1// src/main/java/dev/mflash/guides/jwtauth/security/SecurityConfiguration.java
 2
 3@EnableWebSecurity
 4public class SecurityConfiguration extends WebSecurityConfigurerAdapter {
 5
 6  private final CustomUserDetailsService userDetailsService;
 7
 8  public SecurityConfiguration(CustomUserDetailsService userDetailsService) {
 9    this.userDetailsService = userDetailsService;
10  }
11
12  protected @Override void configure(HttpSecurity http) throws Exception {
13    http.cors().and()
14        .csrf().disable()
15        .authorizeRequests()
16        .antMatchers(PUBLIC_ENDPOINT_URL).permitAll()
17        .antMatchers(POST, REGISTRATION_URL).permitAll()
18        .anyRequest().authenticated().and()
19        .addFilter(new CustomAuthenticationFilter(authenticationManager()))
20        .addFilter(new CustomAuthorizationFilter(authenticationManager()))
21        .sessionManagement().sessionCreationPolicy(STATELESS);
22  }
23
24  public @Bean PasswordEncoder passwordEncoder() {
25    return PasswordEncoderFactories.createDelegatingPasswordEncoder();
26  }
27
28  protected @Override void configure(AuthenticationManagerBuilder auth) throws Exception {
29    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
30  }
31
32  public @Bean CorsConfigurationSource corsConfigurationSource() {
33    final var source = new UrlBasedCorsConfigurationSource();
34    source.registerCorsConfiguration("/**", new CorsConfiguration().applyPermitDefaultValues());
35    return source;
36  }
37}

 1// src/main/java/dev/mflash/guides/jwtauth/controller/GenericController.java
 2
 3public @Controller class GenericController {
 4
 5  public static final String PUBLIC_ENDPOINT_URL = "/jwt/public";
 6  public static final String PRIVATE_ENDPOINT_URL = "/jwt/private";
 7
 8  private ServerResponse publicEndpoint(ServerRequest request) {
 9    return ServerResponse.ok().contentType(APPLICATION_JSON).body(messageMap("public"));
10  }
11
12  private ServerResponse privateEndpoint(ServerRequest request) {
13    return ServerResponse.ok().contentType(APPLICATION_JSON).body(messageMap("private"));
14  }
15
16  private Map<String, String> messageMap(String type) {
17    return Map.of("message", String.format("Hello, world! This is a %s endpoint", type));
18  }
19
20  public @Bean RouterFunction<ServerResponse> genericRoutes() {
21    return route()
22        .GET(PUBLIC_ENDPOINT_URL, this::publicEndpoint)
23        .GET(PRIVATE_ENDPOINT_URL, this::privateEndpoint)
24        .build();
25  }
26}

 1// src/test/java/dev/mflash/guides/jwtauth/controller/GenericControllerTest.java
 2
 3@SpringBootTest
 4@AutoConfigureMockMvc
 5@ExtendWith(SpringExtension.class)
 6class GenericControllerTest {
 7
 8  private @Autowired MockMvc mvc;
 9
10  @Test
11  @DisplayName("Should be able to access public endpoint without auth")
12  void shouldBeAbleToAccessPublicEndpointWithoutAuth() throws Exception {
13    MockHttpServletResponse response = mvc.perform(get(PUBLIC_ENDPOINT_URL))
14        .andExpect(status().isOk())
15        .andReturn().getResponse();
16
17    assertThat(response.getContentAsString()).isNotEmpty();
18  }
19
20  @Test
21  @DisplayName("Should get forbidden on private endpoint without auth")
22  void shouldGetForbiddenOnPrivateEndpointWithoutAuth() throws Exception {
23    mvc.perform(get(PRIVATE_ENDPOINT_URL))
24        .andExpect(status().isForbidden())
25        .andReturn();
26  }
27
28  @Test
29  @DisplayName("Should be able to access private endpoint with auth")
30  @WithMockUser(username = "jwtUser")
31  void shouldBeAbleToAccessPrivateEndpointWithAuth() throws Exception {
32    MockHttpServletResponse response = mvc.perform(get(PRIVATE_ENDPOINT_URL))
33        .andExpect(status().isOk())
34        .andReturn().getResponse();
35
36    assertThat(response.getContentAsString()).isNotEmpty();
37  }
38}