How can JWT (JSON Web Token) be integrated into Spring Boot for API security?

Question

Accepted Answer

Integrating JWT into Spring Boot means replacing session-based login with a stateless flow where a signed token, generated at login, is sent on every subsequent request and validated by a custom filter before Spring Security grants access.

Key Points:
• Add spring-boot-starter-security plus a JWT library such as jjwt or Nimbus JOSE+JWT.
• A login endpoint authenticates credentials and issues a signed JWT containing the user's identity and roles.
• A custom OncePerRequestFilter extracts the token from the Authorization header, validates its signature and expiration, and populates the SecurityContext.
• Because the token is self-contained, the server doesn't need to store session state, which suits horizontally scaled REST APIs.
• Token expiration and refresh strategies must be handled explicitly since JWTs can't be revoked server-side by default.

Example:
After a successful login to /api/login, the client stores the returned JWT and sends it as Authorization: Bearer  on every subsequent API call, which the filter verifies before letting the request reach the controller.

Code Example:

```
public class JwtAuthFilter extends OncePerRequestFilter {

@Override
    protected void doFilterInternal(HttpServletRequest request,
                                     HttpServletResponse response,
                                     FilterChain chain) throws ServletException, IOException {
        String header = request.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            String token = header.substring(7);
            if (jwtService.isValid(token)) {
                Authentication auth = jwtService.getAuthentication(token);
                SecurityContextHolder.getContext().setAuthentication(auth);
            }
        }
        chain.doFilter(request, response);
    }
}
```

Interview Tip:
A concise interview answer is:

"I integrate JWT by adding a login endpoint that issues a signed token, then writing a custom filter that extracts the token from the Authorization header, validates its signature and expiration, and sets the SecurityContext for the request. This keeps the API stateless since no session needs to be stored server-side."