Spring Security with JSON Web Token and Refresh Token

Create domain models by defining user and role entities, mapping a many-to-many relationship with eager fetching, and applying JPA and Lombok annotations for streamlined persistence.

Create domain model repositories for user and role by defining interfaces that extend the repository and add find by username and find by name methods.

Define a user service interface and its spring service implementation to manage users and roles, including save user, get users, save role, and add role to user.

Add logs to track saving a user, saving a role, and fetching users to monitor service calls, then inject the service into the controller and apply mass scale configuration.

Inject a user service into a Spring controller and expose /api/users to return all users with a response entity. Configure MySQL database and application properties for the api and logs.

implement api resource part 2 by adding endpoints to save users and save roles, and an endpoint to add roles to users, using request bodies and response entities.

Initialize the database with users and roles via a Spring Boot command line runner and user service, then assign roles to users and verify data in the browser.

Configure Spring Security to authenticate users with your own user details service and manage authorization by roles, using a password encoder and a security config class.

Implement a custom authentication filter to process login credentials, authenticate with the authentication manager, and return an access and refresh token on success while enabling stateless sessions and disabling csrf.

Generate and sign an access token and a refresh token after successful login using a Java JWT library, populating claims from the authenticated user and returning tokens in the response.

Encode user passwords with a password encoder before saving, then test login to receive an access token and a refresh token in json.

Verify and parse bearer tokens to grant access by intercepting requests with an authorization filter, extract user roles from the JWT, and set the security context.

Handle authorization filter exceptions by logging the error and returning a 403 with a JSON error to the client.

implement a refresh token flow in spring security with JWT, validating refresh tokens and issuing new access tokens through a dedicated endpoint, while handling bearer authorization and token expiry.