JWT Authentication
JWT (JSON Web Token) TOKEN-BASED authentication hai — traditional session-based auth se DIFFERENT, jaha SERVER HAR user ki session state STORE karta hai. JWT STATELESS hai — server KUCH STORE nahi karta, HAR request mein CLIENT token bhejta hai (Authorization header mein), server sirf TOKEN ki SIGNATURE verify karta hai.
JWT ke TEEN parts hain (dots se separated) — HEADER (algorithm info), PAYLOAD (claims — userID, roles, expiry time; BASE64-encoded, NOT encrypted), SIGNATURE (server ke SECRET KEY se generate, tampering DETECT karne ke liye). Stateless nature ki wajah se, JWT MULTIPLE SERVERS ke beech SCALE karna bahut AASAN banaता hai.
// Login par, JWT GENERATE karna:
public String generateToken(User user) {
return Jwts.builder()
.setSubject(user.getUsername())
.claim("role", user.getRole())
.setExpiration(new Date(System.currentTimeMillis() + 86400000))
.signWith(SignatureAlgorithm.HS256, secretKey)
.compact();
}
// HAR request par, filter mein VERIFY karna:
@Component
public class JwtAuthFilter extends OncePerRequestFilter {
protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
throws ServletException, IOException {
String token = req.getHeader("Authorization");
if (token != null && jwtUtil.isValid(token)) {
// SecurityContext mein authentication SET karo
}
chain.doFilter(req, res);
}
}- JWT = stateless, token-based authentication
- Teen parts: header, payload (Base64, NOT encrypted), signature
- Session-based auth se ZYAADA scalable — server kuch STORE nahi karta
JWT (JSON Web Token) TEEN PARTS ka hota hai, dots (.) se separated — HEADER (algorithm info), PAYLOAD (claims — user ID, roles, expiry), SIGNATURE (verify karта hai token TAMPER nahi hua). Payload BASE64-ENCODED hai, ENCRYPTED NAHI — koi bhi ise DECODE karके PADH sakta hai (isliye SENSITIVE data payload mein mat daalo).
Traditional session-based auth mein, SERVER ko HAR user ki session STORE karni padti hai (memory/database mein) — SCALING mushkil hai (multiple servers ke beech session share karni padti hai). JWT STATELESS hai — server KUCH bhi STORE nahi karta, HAR request mein client TOKEN bhejta hai, server sirf SIGNATURE VERIFY karta hai. Isse HORIZONTAL SCALING bahut AASAN ho jaati hai.
// JWT filter — HAR request par token verify karta hai:
@Component
public class JwtAuthFilter extends OncePerRequestFilter {
protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain) {
String token = extractToken(req);
if (token != null && jwtUtil.validateToken(token)) {
// authentication set karo SecurityContext mein
}
chain.doFilter(req, res);
}
}