JWT Authentication in Spring Boot
Spring Boot mein, JWT-BASED AUTHENTICATION SETUP karne ka MODERN, RECOMMENDED APPROACH — spring-boot-starter-oauth2-resource-server dependency, jo BUILT-IN, WELL-TESTED JWT VALIDATION LOGIC PROVIDE karta hai. Ye MANUALLY CUSTOM JwtAuthFilter LIKHNE se, KAAFI ZYAADA RELIABLE aur MAINTAINABLE APPROACH hai.
ISSUER-URI (AUTH SERVER ka URL, jaise Auth0, Keycloak, ya APNA CUSTOM AUTH SERVER) SET karте hi, Spring Boot AUTOMATICALLY, PUBLIC KEYS FETCH karke, TOKENS ki SIGNATURE VALIDATE karता hai — MANUAL KEY MANAGEMENT ki zaroorat NAHI.
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>
# application.properties:
spring.security.oauth2.resourceserver.jwt.issuer-uri=https://my-auth-server.com
@Configuration
@EnableWebSecurity
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated())
.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
return http.build();
}
}
// Custom claims extract karna:
@GetMapping("/profile")
public String getProfile(@AuthenticationPrincipal Jwt jwt) {
String role = jwt.getClaimAsString("role");
return "Role: " + role;
}- starter-oauth2-resource-server = BUILT-IN, RELIABLE JWT validation
- issuer-uri set karте hi, PUBLIC KEYS AUTOMATICALLY fetch, MANUAL key management NAHI
- @AuthenticationPrincipal Jwt = incoming token ke CUSTOM claims access karne ka tareeka
Spring Boot mein, JWT-based AUTHENTICATION SETUP karne ka MODERN, RECOMMENDED APPROACH hai — spring-boot-starter-oauth2-resource-server dependency, JO BUILT-IN JWT VALIDATION LOGIC PROVIDE karta hai, MANUALLY CUSTOM FILTER LIKHNE ke bajaye.
spring.security.oauth2.resourceserver.jwt.issuer-uri=https://my-auth-server.com
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()));
return http.build();
}JWT ke ANDAR, CUSTOM CLAIMS (jaise "role", "tenant-id") EMBED ho sakte hain — Spring Security's Jwt OBJECT se, IN CLAIMS ko EXTRACT karके, APPLICATION LOGIC mein USE kiya ja sakta hai.
@GetMapping("/profile")
public String getProfile(@AuthenticationPrincipal Jwt jwt) {
String role = jwt.getClaimAsString("role");
return "User role: " + role;
}