NEW: Spring Boot 3 Securing Your Application with JWT Token

Create a new Spring Boot 3 project via Spring Initializr with Maven, Java 17, jar packaging, and add Web, Security, Spring Data JPA, PostgreSQL driver, and Lombok.

Configure a PostgreSQL data source for the application by installing the driver, setting host and port, testing the connection, and creating a JWT security database with the public schema.

Establish a Spring Boot database connection by converting properties to YAML, configuring the data source URL and credentials, and enabling PostgreSQL dialect, show SQL, and schema creation.

Create user class with id, first name, last name, email, and password, using Lombok data, builder, no-args and all-args constructors, and annotate it as an entity for authentication and authorization.

Transform the user class into a Jakarta Persistence entity by applying @Entity and @Table, mark a primary key with @Id and @GeneratedValue, and name the table underscore user.

Extend your user model by implementing the spring security UserDetails interface, define a Role enum for user roles, and return authorities with SimpleGrantedAuthority to enable authentication and authorization.

Define a user repository by extending JPA repository interface, using user as the entity and integer as the id, and add a find by email method since email is unique.

Create a JWT authentication filter by extending once per request filter to intercept HTTP requests. Register it as a spring component and use @RequiredArgsConstructor for constructor creation.

Implement a JWT authentication check in the filter by reading the authorization header, ensuring it starts with Bearer and space, then extracting the token via substring starting at position seven.

Extract username from the JWT using a dedicated JWT service, then verify the user against the database via the user details service in Spring Security.

Add JWT API, jjwt, and JWT Jackson dependencies to the pom.xml, using version 0.11.5, then reload the maven project so IntelliJ downloads them. Then proceed to implement the JWT service.

Understand how a json web token uses a header, payload, and signature to convey registered, public, and private claims such as issuer, subject, and expiration.

Develop routines to extract all claims and a single claim from a JWT using io.jsonwebtoken. Build the signer with the signing key, decode the token, and read the body claims.

Implement the signing key for a JWT by decoding a base64 secret, selecting an HMAC SHA key, and configuring a 256-bit secret to securely sign and verify tokens.

Implement a generic extract claim method that takes a token and a claim resolver function to extract a single claim from all token claims.

Learn to extract the username from a JWT by reading the subject claim, which should be the user name or email, and preview implementing expiration checks and token generation.

Generate a jwt token by building with extra claims and user details, set the subject, issued at, expiration, sign with hs256, and compact the token.

Implement a boolean isTokenValid(token, userDetails) in the jwt service to verify the token's username matches user details and ensure the token is not expired by extracting expiration via extractExpiration.

Validate the JWT by extracting the user email, check authentication via the security context holder, then load the user from the database with a custom user details service if needed.

Implement a user details service bean in the application config, loading users by email via the user repository and throwing a username not found exception when missing, enabling JWT authentication.

Validate the JWT token, create a username password authentication token from the user details, update the SecurityContextHolder, set web authentication details, and forward the request through the filter chain.

Configure a security configuration class and a security filter chain bean to secure http requests, whitelist endpoints, enforce stateless sessions, and place a JWT filter before the username-password filter.

Define an authentication provider bean using the DAO authentication provider, wiring the user details service and a password encoder, then expose a BCryptPasswordEncoder bean for secure password handling.

Create the authentication manager bean using authentication configuration to expose an authentication manager that authenticates users by username and password, leveraging Spring Security's default implementation.

Create an authentication controller in the auth package with two endpoints, register and authenticate, handling register requests (first name, last name, email, password) and authentication requests, returning an authentication response.

Create an authentication response class that returns a simple string token to the user, using a data annotation, a builder, and all-args and no-args constructors.

Create a register request class in the same package with fields first name, last name, email, and password, using the same annotations as the authentication response.

Create an authentication request object in the same package, including annotations, to carry the email and password for the register and authenticate request.

Create and inject an authentication service in the auth package to implement register and authenticate methods, returning an authentication response via a response entity.

Implement the register method to create a user from the registration request, encode the password, save the user to the database, and return a JWT token in the authentication response.

Use the authentication manager to authenticate a user with email and password via a username password authentication token, then generate and return an authentication token.

Update the security configuration to whitelist and authorize all methods in the authentication controller, aligning with the design that this controller handles only authentication logic and nothing else.

Create and secure a new demo controller in a Spring Boot 3 app, add a simple endpoint that returns a hello message, and test the changes.

Start the application, verify the logs, and test the secured endpoint with postman. Register a user to obtain a jwt token and access the secured endpoint with a bearer token.