https://github.com/grantjforrester/spring-security-jwt
A lightweight module for Spring Security that provides HTTP request authentication by JSON Web Token (JWT).
https://github.com/grantjforrester/spring-security-jwt
jwt security spring
Last synced: about 1 month ago
JSON representation
A lightweight module for Spring Security that provides HTTP request authentication by JSON Web Token (JWT).
- Host: GitHub
- URL: https://github.com/grantjforrester/spring-security-jwt
- Owner: grantjforrester
- License: apache-2.0
- Created: 2019-06-27T20:48:34.000Z (almost 7 years ago)
- Default Branch: master
- Last Pushed: 2021-05-12T00:28:25.000Z (about 5 years ago)
- Last Synced: 2025-08-10T19:31:55.572Z (11 months ago)
- Topics: jwt, security, spring
- Language: Java
- Homepage:
- Size: 38.1 KB
- Stars: 0
- Watchers: 1
- Forks: 0
- Open Issues: 2
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# spring-security-jwt
A lightweight module for Spring Security that provides HTTP request authentication by JSON Web Token (JWT).
When configured all incoming requests to the Spring application are intercepted and must have a valid JWT to be
authenticated, otherwise a response with status code 401 is returned.
A JWT is valid if:
- it is well-formed
- any "nbf" claim has elapsed
- any "exp" claim has not elapsed
- has the correct signature based on a provided key.
## The Spring Security Context
On successful authentication the `JWTAuthenticationManager` builds a
[`PreAuthenticatedAuthenticationToken`](https://docs.spring.io/spring-security/site/docs/4.2.12.RELEASE/apidocs/org/springframework/security/web/authentication/preauth/PreAuthenticatedAuthenticationToken.html)
which is set in the current Spring SecurityContext.
The token is populated from the JWT as follows:
- claim `sub` is set as the `principal`
- claim `roles` (an array of strings) is set as the collection of `authorities`
- the JWT itself is set as the `credentials`
> If you want to use Spring's [method security](https://docs.spring.io/spring-security/site/docs/5.1.5.RELEASE/reference/htmlsingle/#ns-method-security)
> then I recommend each string in your `roles` claim has the prefix `ROLE_`.
>
> Example
> ```
> {
> ...,
> "roles" : ["ROLE_AddUser", "ROLE_DeleteUser"],
> ...
> }
> ```
## JWT Signature Checking
To verify a JWT signature a key must be provided. Two methods of providing a key are supported:
### From Shared Secret
The key is built from a shared secret usually passed in as a configuration value. See class `FromSharedSecret`.
### From KeySet By Kid Claim
Each JWT must specify a "kid" claim in the header. This value is used to locate a key in the configured
JWKS key set. See class `FromKeySetByKidClaim`.
## Usage
In your Spring application configure Spring Security as follows:
```java
@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Value("${keystore.filename}")
private Resource keystore;
@Autowired
private ApplicationContext context;
/*
* Create an authentication filter that looks for a JWT in an "Authorization" header with
* the authentication scheme "Bearer". Use the given JWTAuthenticationManager to
* authenticate the JWT.
*/
@Bean
Filter authenticationFilter(JWTAuthenticationManager jwtAuthenticationManager) {
JWTAuthenticationFilter filter = new JWTAuthenticationFilter();
filter.setJwtProvider(new HeaderJWTProvider("Authorization", "Bearer"));
filter.setAuthenticationManager(jwtAuthenticationManager);
filter.setAuthenticationDetailsSource(new WebAuthenticationDetailsSource());
return filter;
}
/*
* Create a JWTAuthenticationManager bean responsible for verifying the JWT and setting
* up the SecurityContext.
*/
@Bean
JWTAuthenticationManager jwtAuthenticationManager() throws Exception {
FromKeySetByKidClaim keySelector = new FromKeySetByKidClaim(JWKSet.load(keystore.getInputStream()));
return new NimbusJWTAuthenticationManager(keySelector);
}
/*
* Intercept incoming requests with the JWTAuthenticationFilter. If authentication fails
* return response with status code 401.
*/
@Override
protected void configure(HttpSecurity http) throws Exception {
Filter authenticationFilter = (Filter) context.getBean("authenticationFilter");
http.addFilterBefore(authenticationFilter, BasicAuthenticationFilter.class)
.authorizeRequests().anyRequest().authenticated()
.and().sessionManagement().sessionCreationPolicy(STATELESS)
.and().exceptionHandling().authenticationEntryPoint(
new StatusCode401AuthenticationEntrypoint()
);
}
}
```