Discuss how would you secure a Spring Boot application using JSON Web Token (JWT)

Question

Accepted Answer

JWT (JSON Web Token) is a stateless authentication mechanism used to secure Spring Boot applications. After successful login, the server generates a signed token containing user information and roles. The client sends this token with every subsequent request, and Spring Security validates it before granting access to protected resources.

Key Points:
• JWT enables stateless authentication, eliminating the need for server-side sessions.
• The token contains user identity and authorization details such as roles and permissions.
• Spring Security validates the token for every request before allowing access to secured endpoints.

Example:
Consider an e-commerce application:

1. User submits username and password.
2. Spring Security authenticates the user.
3. The server generates a JWT token.
4. The client stores the token.
5. The client sends the token in the Authorization header for every request.
6. Spring Security validates the token and authorizes the request.

Authentication Flow:

Client Login Request
        ↓
Spring Security Authentication
        ↓
JWT Token Generation
        ↓
Client Stores Token
        ↓
Client Sends Token in Request Header
        ↓
JWT Validation Filter
        ↓
Access Granted or Denied

Code Example:

Authorization Header:

Authorization: Bearer eyJhbGciOiJIUzI1NiJ9...

JWT Filter Example:

http
    .csrf(csrf -> csrf.disable())
    .authorizeHttpRequests(auth -> auth
        .requestMatchers("/auth/**")
        .permitAll()
        .anyRequest()
        .authenticated())
    .sessionManagement(session ->
```
        session.sessionCreationPolicy(
            SessionCreationPolicy.STATELESS));
```
JWT Structure:

```
Header
Payload
Signature
```
Example Payload:

{
   "sub": "john",
   "roles": ["USER"],
   "exp": 1712345678
}

Header:
• Contains token type and signing algorithm.

Payload:
• Contains user information and claims.

Signature:
• Ensures token integrity and prevents tampering.

Common Components Used:

• AuthenticationManager
• UserDetailsService
• JwtTokenProvider
• OncePerRequestFilter
• SecurityFilterChain

Security Best Practices:

• Use strong signing algorithms such as HS256 or RS256.
• Set token expiration times.
• Use refresh tokens for long sessions.
• Store secrets securely using environment variables or secret managers.
• Always use HTTPS to protect tokens during transmission.

Advantages:

• Stateless and scalable.
• Reduces database lookups for every request.
• Suitable for microservices architectures.
• Works well with REST APIs and mobile applications.

Limitations:

• Revoking tokens before expiration can be difficult.
• Large payloads increase token size.
• Sensitive information should never be stored in the payload.

Real-World Example:

In a microservices architecture:

• API Gateway validates the JWT.
• User Service issues the token.
• Downstream services trust the validated token.

This avoids repeated authentication checks across multiple services.

Interview Tip:
A concise interview answer is: To secure a Spring Boot application using JWT, I authenticate the user using Spring Security and generate a signed token after successful login. The client sends this token in the Authorization header with each request, and a JWT filter validates the token before allowing access to protected resources. This approach provides stateless, scalable, and secure authentication for modern applications.