Springboot 3 with JWT Authentication & Authorization in 2025

Explore how json web token enables stateless authentication between client and server by generating a short-lived token with a secret, embedding user data, and authorizing access.

Learn how JSON Web Token enables secure, stateless authentication and authorization between client and server, and how header, payload, and signature parts combine with base64 encoding to form the token.

Explore the complete jwt workflow in a Spring Boot 3 app, from the authentication filter to the jwt service, user validation, and authorization.

Install JDK 17 using Adoptme, pick the Windows 64 MSI, install IntelliJ Community Edition, and set up Postman to test APIs.

Generate a starter Spring Boot 3.3.5 project on start.spring.io with Maven, Java 17, and dependencies like Spring Web, Spring Security for JWT authentication, Lombok, and Spring Data JPA.

Explore the IntelliJ editor setup for Spring Boot 3 by importing the project, selecting JDK 17, and adjusting the editor font size to 18, including theme preferences.

Add three jwt dependencies to the pom.xml (jwt api, jwt impl, jackson) from io.jsonwebtoken, refresh maven, ensure java 17 in the project structure, and adjust IntelliJ font if desired.

Create the project structure by adding packages and an enum for user roles, such as admin, user, and moderator, to configure JWT-based authorization for role-specific activities.

Create the role entity with Spring Data JPA, map the roles table with an auto-generated id, and use Lombok for getters and setters.

Create a user entity with Lombok and map a many-to-many relationship to roles via the users_to_role join table, detailing fields and front-end date input handling.

Configure spring boot profiles by creating profile-specific properties files like application-local.properties and application-prod.properties, and enable them via spring active profiles to run the app with local or production settings.

Configure the local profile to use a file-based H2 database, enable the H2 console, and apply ddl auto; use environment variables for the JWT secret and expiration.

Create a role repository interface using Spring Data JPA to perform CRUD operations and define a custom query to find a role by name, with enum values stored as strings.

Create a user repository interface in Springboot 3 to interact with the users table, including custom queries to find by email and check existence by email, paving the service layer.

Map the user entity and its roles to spring security by implementing userdetailsimpl, including extra fields like phone, nationality, date of birth, and gender, and building authorities for jwt authentication.

Develop user service logic to load users by email from repository, save new users with encoded passwords, and build user details for authentication.

Create and manage JWT tokens in Spring Boot by generating access tokens with subject and claims, validating tokens, extracting claims, and supporting bearer authentication for secure user interactions.

Implement a JWT authentication filter that intercepts requests, extracts and validates the bearer token from the authorization header, and sets the user in the security context for protected endpoints.

Implement a security config bean to connect jwt with Spring Security, configure password encoder and authentication provider, enable web and method security, and define the security filter chain.

Implement a dedicated exception handling class and a JWT authentication entry point to capture, log, and forward security errors, then wire this error handler into the security configuration.

Configure a security filter chain in Springboot 3, disable CSRF, enable exception handling, enforce stateless sessions, and apply a JWT filter before the username-password authentication filter for protected URLs.

Create a cors configuration class to enable cross-origin requests and prevent cors issues by allowing all origins and all http methods for any url.

Create a signup request dto with validation annotations for email, first name, last name, and goals; import spring validation and add the dependency to pom.xml to enable validation.

Create login request dto with email and password and a jwt response dto including token, user id, token type, first name, email, roles, and a message response dto.

Create an auth controller in spring boot 3, integrate a JWT service to generate and validate tokens, and set up default roles including user, admin, moderator for signup and registration.

Explore the auth controller, including authentication manager, user and role repositories, password encoding, and JWT issuance, plus registration flow with email checks and default roles.

Create a startup command using a command line runner to seed the database with admin, moderator, and user roles, ensuring roles exist before saving in a Spring Boot application.

Enable spring.main.allow-circular-references to resolve a circular dependency in a spring boot app, bootstrap with admin and moderator roles, create tables, and test sign in and sign up endpoints.

Practice testing a Spring Boot app with Postman, creating a user via a no-auth endpoint, exploring sign-up and sign-in flows, and debugging 401 unauthorized on whitelisted endpoints.

Update security config: disable CSRF, define public URL patterns, enforce stateless JWT authentication, and test role-based access with tokens (admin, user, moderator) in Spring Boot 3.

Create a test controller for authentication and authorization, configure role-based access for api v1 endpoints (all, user, moderator, admin), enforce authentication, and run the app to test.

Test api endpoint security by applying pre-authorized rules to admin, moderator, and user roles, using jwt authentication to access endpoints, and observe public content, 403 errors, and role-based access.

Learn how to retrieve the currently logged-in user via a simple util that reads authentication from the security context, enabling easy access to user details in Spring Boot with JWT.

Define a business exception and error dto, update the controller to return 201 with a new response entity, and prepare a centralized error handler for the backend.

Define a global exception handler to centralize error handling in Spring Boot 3. Replace error models with error dto and return a list of field validation errors and business exceptions.

Map the login response to the correct fields in the right order: JWT token, id, first name, last name, email, and role, and implement constructors for streamlined error handling.