NEW: Spring Boot 3 Securing Your Application with JWT Token

Name: NEW: Spring Boot 3 Securing Your Application with JWT Token
Rating: 4.3 (51 reviews)

Spring Boot 3 + Spring Security 6 - JWT Authentication and Authorisation [NEW] [2023]

Created byBouali Ali

Last updated 1/2023

English

What you'll learn

Implement user authentication and authorization using Spring Security
Encrypt user passwords using BCrypt
Implement role-based authorization with Spring Security
Use JSON Web Tokens (JWT) to provide a secure, stateless method of authentication
ntegrate JWT into a Spring Boot application

Course content

6 sections • 36 lectures • 1h 58m total length

How JWT based security works5:32
Explore how JWT based security works in spring boot 3, detailing the authentication filter flow: validate or reject tokens, fetch user details, update the security context, and dispatch requests.
Source code0:02

Create a new Spring boot 3.0 project1:54
Create a new Spring Boot 3 project via Spring Initializr with Maven, Java 17, jar packaging, and add Web, Security, Spring Data JPA, PostgreSQL driver, and Lombok.
Add a new datasource3:01
Configure a PostgreSQL data source for the application by installing the driver, setting host and port, testing the connection, and creating a JWT security database with the public schema.
Establish connection to the database4:43
Establish a Spring Boot database connection by converting properties to YAML, configuring the data source URL and credentials, and enabling PostgreSQL dialect, show SQL, and schema creation.

Create the JWT authentication filter5:08
Checking the JWT token3:28
Create the JWT Service3:24
Add the JJWT dependencies2:03
What is a JWT toekn3:06
Extract claims from the JWT2:11
Implement the SignIn key method4:44
Implement the signing key for a JWT by decoding a base64 secret, selecting an HMAC SHA key, and configuring a 256-bit secret to securely sign and verify tokens.
Extract a single claim from JWT1:44
Extract the username from the token1:00
Learn to extract the username from a JWT by reading the subject claim, which should be the user name or email, and preview implementing expiration checks and token generation.
Generate the JWT token5:22
Check if the token is valid3:05
Check the user existence in the database (JwtAuthFilter)3:46
Implement the user details service4:24
Implement a user details service bean in the application config, loading users by email via the user repository and throwing a username not found exception when missing, enabling JWT authentication.
Update the SecuritContextHolder and finalise the filter4:14
Validate the JWT token, create a username password authentication token from the user details, update the SecurityContextHolder, set web authentication details, and forward the request through the filter chain.
Add the security configuration8:53
Create the authentication provider bean3:50
Create the authentication manager bean1:33
Create the authentication manager bean using authentication configuration to expose an authentication manager that authenticates users by username and password, leveraging Spring Security's default implementation.

Create the authentication controller2:40
Create the authentication response0:52
Create an authentication response class that returns a simple string token to the user, using a data annotation, a builder, and all-args and no-args constructors.
Create the register request object1:03
Create the authentication request object0:31
Create the authentication service2:15
Implement the register method3:45
Implement the register method to create a user from the registration request, encode the password, save the user to the database, and return a JWT token in the authentication response.
Implement the authenticate method2:45
Use the authentication manager to authenticate a user with email and password via a username password authentication token, then generate and return an authentication token.
Update the security configuration whitelist1:12
Create a demo controller1:15

Requirements

Java Knowledge

Description

Are you looking to secure your Spring Boot applications and keep them safe from unauthorized access? Look no further! Our course, "Spring Security with JWT: Protect Your Applications from Unauthorized Access," is the perfect solution for you.

In this course, you'll learn everything you need to know about using Spring Security and JSON Web Tokens (JWT) to secure your applications. We'll start by teaching you the basics of Spring Security and how it can be used to authenticate and authorize users in your application. From there, you'll learn how to implement JWT to provide a secure, stateless method of authentication.

With our step-by-step instructions and hands-on exercises, you'll gain the knowledge and skills you need to confidently secure your Spring Boot applications. Plus, with lifetime access to the course materials, you can revisit the lessons anytime you need a refresher.

Don't let unauthorized access threaten the security of your applications. Enroll in "Spring Security with JWT: Protect Your Applications from Unauthorized Access" today and take the first step towards safeguarding your valuable assets.

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is digitally signed using JSON Web Signature (JWS).

A JWT consists of three parts: a header, a payload, and a signature.

The header typically consists of two parts: the type of the token, which is JWT, and the signing algorithm being used, such as HMAC SHA256 or RSA.
The second part of the token is the payload, which contains the claims. Claims are statements about an entity (typically, the user) and additional data. There are three types of claims: registered, public, and private claims. Registered claims are a set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims. Some of the registered claims are:

iss (issuer) claim identifies the principal that issued the JWT.
sub (subject) claim identifies the subject of the JWT.
aud (audience) claim identifies the recipients that the JWT is intended for.
exp (expiration time) claim identifies the expiration time on or after which the JWT MUST NOT be accepted for processing.

Public claims are claims that are defined in the IANA JSON Web Token Registry or are public by nature. Private claims are custom claims created to share information between parties that agree on using them.

The third part of the token is the signature, which is used to verify that the sender of the JWT is who it claims to be and to ensure that the message wasn't changed along the way.

To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that. For example if you want to use the HMAC SHA256 algorithm, the signature will be created in the following way:

HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)

The final JWT will be three base64-URL strings separated by dots, which can be easily passed in HTML and HTTP environments, while being more compact when compared to XML-based standards such as SAML.

Who this course is for:

Students
Beginners
Mid level

NEW: Spring Boot 3 Securing Your Application with JWT Token

What you'll learn

Explore related topics

Course content

Introduction2 lectures • 6min

Bootstrap the application3 lectures • 10min

Create an application User4 lectures • 19min

Implementing the JWT authentication filter17 lectures • 1hr 2min

Implement the authentication controller9 lectures • 16min

Test the application1 lecture • 7min

Requirements

Description

Who this course is for: