Use JWT & Springboot-3 for API Authentication Authorization

Create a starter spring boot 3.3.5 project on start.spring.io with maven and java 17; include web, security, h2, mysql, lombok, and spring data jpa, then import into IntelliJ.

Add JWT API, JWT impl, and Jackson all dependencies from IO JSON Web token to pom.xml, then refresh and build; ensure Java 17 and adjust IntelliJ editor theme and font.

Create a roles enum and constants in a package for a JWT-based API, defining admin, user, and moderator roles to configure role-based access to activities.

Create the role entity with Spring Data JPA, mapping a roles table and an auto generated id, using Lombok for getters/setters and a role enum.

Create a user entity with Lombok annotations, map a many-to-many relationship to roles via a join table, and define common user fields and timestamps for a secure API.

Configure multi-profile settings in a Spring Boot 3 API by defining application properties for local and production profiles, using application-local.properties and application-prod.properties to manage environment-specific configuration.

Activate local profile and configure an h2 database, enabling h2 console access, using a file-based generic service one db with the SC user and no password, and ddl to auto.

Create a role repository interface with Spring Data JPA to enable CRUD operations and custom queries by role name, supporting JWT-based API authentication and authorization.

Create a user repository interface to interact with the user entity and its users table, implementing custom queries to find a user by email and check email existence.

Map the user entity and its roles to spring security authorities with a user details impl, including fields like phone, nationality, date of birth, and gender.

Develop and integrate a simple user service that encodes passwords, saves new users, and loads users by email through the repository, building user details for authentication.

Explore a Spring Boot JWT service that generates access tokens with claims, a subject, and expiration, then validates tokens and extracts usernames for bearer authentication.

Implement a JWT authentication filter that validates bearer tokens, loads user details from the database, and sets the security context for protected endpoints, linking the JWT service with Spring Security.

Configure a security config bean to integrate JWT with Spring Security, define password encoder, authentication provider, and authentication manager, enable web and method security, and establish the security filter chain.

Create a dedicated exception handling class as an authentication entry point to capture, log, and forward security errors to the servlet response within the security config for JWT and springboot-3.

Configure the security filter chain by using http security to disable CSRF, enable exception handling, and enforce stateless sessions with URL-based authentication rules and a JWT filter.

Configure a cors setup in a spring boot application to allow any origin and http method for any url, preventing cross-origin resource sharing issues when called from a browser.

Create a signup request DTO with validation annotations and a login flow integration, add spring validation dependency to pom.xml, and implement getters, setters, and constructors for the registration controller.

Create login request dto with email and password; define JWT response dto returning token, user id, and token type. Add a message response dto for errors or success messages.

Implement signup and registration in the auth controller using JWT to issue tokens, configure roles (admin, user, moderator), and integrate with Spring Boot 3 for secure API authentication and authorization.

Explain the authentication controller flow: login with the authentication manager, set the security context, and issue a JWT, then register users by validating emails, encoding passwords, and assigning roles.

Seed admin, moderator, and user roles on application startup by implementing a CommandLineRunner in the startup class; place the auth controller in the controller package.

Enable spring.main.allow-circular-references in the root properties to resolve a circular dependency, then restart the app to create roles and test the auth endpoints.

Test the application with postman by posting to api/v1/no auth to create a user, then sign up with first name, last name, email, and password, expecting default user role.

Update security config to allow specific URL patterns without authentication, disable CSRF, and enable stateless sessions. Test JWT-based access with admin, user, and moderator roles in Spring Boot 3.3.

Create a test controller for API v1 with a get mapping that allows all roles, then restrict access to user, moderator, and admin via security config and test the app.

Test different roles with api endpoints security using JWT authentication and authorization; validate access with bearer tokens and pre authorized rules for admin, moderator, and user roles.

Learn to retrieve the currently logged-in user via a util that reads authentication from the security context, using JWT with Spring Boot 3 and Spring Security 6.

Define a business exception and an error dto to standardize API errors, configure the controller to return 201 with a custom message, and plan a centralized error handler.

Define a global custom exception handler that replaces error models with error DTOs, handles field validation and business exceptions, logs messages, and returns structured errors.