Securing Your Spring Boot Applications with OAuth2 and JWT: A Comprehensive Guide

Introduction ……………………………………….1
Getting Started with Spring Boot OAuth2 JWT ……………..2
1. Understanding OAuth2 and JWT ………………..3
2. Setting Up the Development Environment ………..4
Configuring Security in Spring Boot ………………..5
1. Adding Security Dependencies ………………….6
2. Creating RSA Key Pairs …………………………7
3. Implementing SecurityConfig ………………….8
Generating and Decoding JWT Tokens …………………..10
1. Understanding JWT Structure ………………..11
2. Implementing JWT Encoder and Decoder ……….12
3. Handling Authentication ……………………13
Testing the Implementation ……………………….14
1. Running the Application …………………..15
2. Verifying JWT Generation ……………………16
Conclusion ………………………………………18
Additional Resources …………………..19

—

Introduction

Securing web applications is paramount in today’s digital landscape, where threats are ever-evolving, and data breaches can have severe consequences. Spring Boot, a widely-used Java framework, offers robust security features that streamline the process of building secure applications. Among these features, OAuth2 and JWT (JSON Web Tokens) stand out for their effectiveness in managing authentication and authorization.

This guide delves into configuring OAuth2 with JWT in a Spring Boot application. We will explore setting up security configurations, generating RSA key pairs for token signing, implementing JWT encoders and decoders, and ensuring a stateless RESTful API. Whether you’re a beginner or an experienced developer, this comprehensive guide will equip you with the knowledge to secure your Spring Boot applications effectively.

Pros of Using OAuth2 and JWT:

Scalability: Supports large-scale applications with multiple clients.
Statelessness: JWT tokens eliminate the need for server-side sessions.
Flexibility: Facilitates integration with various identity providers.

Cons:

Complexity: Initial setup can be intricate for newcomers.
Token Management: Proper handling of token expiration and revocation is essential.

Feature	OAuth2	JWT
Purpose	Authorization framework	Token standard for secure data transmission
State Management	Stateless	Stateless
Use Case	Delegated access	Secure information exchange

Understanding when and where to implement these technologies is crucial. OAuth2 is ideal for scenarios requiring delegated access, such as granting third-party applications limited access to user resources. JWT, on the other hand, is perfect for securely transmitting information between parties as a JSON object.

—

Chapter 1: Getting Started with Spring Boot OAuth2 JWT

1.1 Understanding OAuth2 and JWT

OAuth2 is an authorization framework that allows applications to obtain limited access to user accounts on an HTTP service. It delegates user authentication to the service that hosts the user account and authorizes third-party applications to access the user account.

JWT (JSON Web Tokens) are compact, URL-safe tokens that represent claims securely transferred between two parties. Each JWT consists of three parts: Header, Payload, and Signature.

Advantages of JWT:

Compactness: Suitable for use in URLs, headers, and cookies.
Self-Contained: Contains all the necessary information about the user.
Security: Signed using a secret or a public/private key pair.

1.2 Setting Up the Development Environment

To begin, ensure you have the following installed:

Java Development Kit (JDK) 11 or higher
Maven: For project management and build automation.
Spring Boot: Utilize Spring Initializr or your preferred method to set up the project.
OpenSSL: Required for generating RSA key pairs.

Installing OpenSSL on Windows:

Using Windows Subsystem for Linux (WSL):
- Install Ubuntu from the Microsoft Store.
- Open the Ubuntu terminal and execute OpenSSL commands.
Direct Installation:
- Download OpenSSL binaries from the official website.
- Add OpenSSL to your system’s PATH environment variable.

—

Chapter 2: Configuring Security in Spring Boot

2.1 Adding Security Dependencies

Begin by adding the necessary dependencies to your pom.xml:


&lt;dependencies&gt;
    &lt;!-- Spring Security --&gt;
    &lt;dependency&gt;
        &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
        &lt;artifactId&gt;spring-boot-starter-security&lt;/artifactId&gt;
    &lt;/dependency&gt;
    &lt;!-- OAuth2 Resource Server --&gt;
    &lt;dependency&gt;
        &lt;groupId&gt;org.springframework.boot&lt;/groupId&gt;
        &lt;artifactId&gt;spring-boot-starter-oauth2-resource-server&lt;/artifactId&gt;
    &lt;/dependency&gt;
    &lt;!-- JWT Support --&gt;
    &lt;dependency&gt;
        &lt;groupId&gt;org.springframework.security&lt;/groupId&gt;
        &lt;artifactId&gt;spring-security-oauth2-jose&lt;/artifactId&gt;
    &lt;/dependency&gt;
&lt;/dependencies&gt;

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

</dependency>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>

</dependency>

<groupId>org.springframework.security</groupId>

<artifactId>spring-security-oauth2-jose</artifactId>

</dependency>

</dependencies>

These dependencies facilitate the implementation of OAuth2 resource server capabilities and JWT support in your Spring Boot application.

2.2 Creating RSA Key Pairs

RSA (Rivest–Shamir–Adleman) is an asymmetric cryptographic algorithm widely used for secure data transmission. We will use RSA keys to sign and verify JWT tokens.

Generating RSA Keys Using OpenSSL:

Generate a Private Key:

Java

openssl genrsa -out keypair.pem 2048

1
2
3

openssl genrsa -out keypair.pem 2048
Extract the Public Key:

Java

openssl rsa -in keypair.pem -pubout -out public.pem

1
2
3

openssl rsa -in keypair.pem -pubout -out public.pem
Convert to PKCS8 Format:

Java

openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in keypair.pem -out private.pem

1
2
3

openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in keypair.pem -out private.pem

The generated private.pem and public.pem files will be stored in the src/main/resources/certs/ directory of your project.

commands.txt Content:


openssl genrsa -out keypair.pem 2048
openssl rsa -in keypair.pem -pubout -out public.pem
openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in keypair.pem -out private.pem

openssl genrsa -out keypair.pem 2048

openssl rsa -in keypair.pem -pubout -out public.pem

openssl pkcs8 -topk8 -inform PEM -outform PEM -nocrypt -in keypair.pem -out private.pem

2.3 Implementing SecurityConfig

Create a security configuration class to define how your application handles security aspects.


package org.studyeasy.SpringRestdemo.security;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.studyeasy.SpringRestdemo.config.RsaKeyProperties;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.oauth2.jwt.*;
import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration
public class SecurityConfig {

    private final RsaKeyProperties rsaKeys;

    public SecurityConfig(RsaKeyProperties rsaKeys) {
        this.rsaKeys = rsaKeys;
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf().disable()
            .authorizeRequests(auth -> auth
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 -> oauth2
                .jwt(jwt -> jwt
                    .decoder(jwtDecoder())
                    .encoder(jwtEncoder())
                )
            )
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        return http.build();
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withPublicKey(rsaKeys.publicKey()).build();
    }

    @Bean
    public JwtEncoder jwtEncoder() {
        JWK jwk = new RSAKey.Builder(rsaKeys.publicKey()).privateKey(rsaKeys.privateKey()).build();
        JWKSource<SecurityContext> jwks = new ImmutableJWKSet<>(new JWKSet(jwk));
        return new NimbusJwtEncoder(jwks);
    }
}

package org.studyeasy.SpringRestdemo.security;

import org.springframework.context.annotation.Bean;

import org.springframework.context.annotation.Configuration;

import org.studyeasy.SpringRestdemo.config.RsaKeyProperties;

import org.springframework.security.config.annotation.web.builders.HttpSecurity;

import org.springframework.security.web.SecurityFilterChain;

import org.springframework.security.oauth2.jwt.*;

import org.springframework.security.config.http.SessionCreationPolicy;

@Configuration

public class SecurityConfig {

private final RsaKeyProperties rsaKeys;

public SecurityConfig(RsaKeyProperties rsaKeys) {

this.rsaKeys = rsaKeys;

}

@Bean

public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {

http

.csrf().disable()

.authorizeRequests(auth -> auth

.anyRequest().authenticated()

)

.oauth2ResourceServer(oauth2 -> oauth2

.jwt(jwt -> jwt

.decoder(jwtDecoder())

.encoder(jwtEncoder())

)

.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);

return http.build();

}

@Bean

public JwtDecoder jwtDecoder() {

return NimbusJwtDecoder.withPublicKey(rsaKeys.publicKey()).build();

}

@Bean

public JwtEncoder jwtEncoder() {

JWK jwk = new RSAKey.Builder(rsaKeys.publicKey()).privateKey(rsaKeys.privateKey()).build();

JWKSource<SecurityContext> jwks = new ImmutableJWKSet<>(new JWKSet(jwk));

return new NimbusJwtEncoder(jwks);

}

Explanation:

SecurityFilterChain: Defines the security filter chain, disabling CSRF, requiring authentication for all requests, and setting the session policy to stateless.
JwtDecoder: Utilizes the public key to decode incoming JWT tokens.
JwtEncoder: Uses both the public and private keys to encode JWT tokens.

—

Chapter 3: Generating and Decoding JWT Tokens

3.1 Understanding JWT Structure

A JWT consists of three parts:

Header: Specifies the signing algorithm and token type.
Payload: Contains the claims or statements about an entity (typically, the user) and additional data.
Signature: Ensures that the token hasn’t been altered.

Example JWT:


eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.
eyJzdWIiOiJ1c2VyMTIzIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNjAxMjM0NTY3fQ.
QmFzZTY0U2lnbmF0dXJl

eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.

eyJzdWIiOiJ1c2VyMTIzIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNjAxMjM0NTY3fQ.

QmFzZTY0U2lnbmF0dXJl

3.2 Implementing JWT Encoder and Decoder

RsaKeyProperties.java:


package org.studyeasy.SpringRestdemo.config;

import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.stereotype.Component;

@Component
@ConfigurationProperties(prefix = "rsa")
public class RsaKeyProperties {
    private RSAPublicKey publicKey;
    private RSAPrivateKey privateKey;

    // Getters and Setters

    public RSAPublicKey getPublicKey() {
        return publicKey;
    }

    public void setPublicKey(RSAPublicKey publicKey) {
        this.publicKey = publicKey;
    }

    public RSAPrivateKey getPrivateKey() {
        return privateKey;
    }

    public void setPrivateKey(RSAPrivateKey privateKey) {
        this.privateKey = privateKey;
    }
}

package org.studyeasy.SpringRestdemo.config;

import java.security.interfaces.RSAPrivateKey;

import java.security.interfaces.RSAPublicKey;

import org.springframework.boot.context.properties.ConfigurationProperties;

import org.springframework.stereotype.Component;

@Component

@ConfigurationProperties(prefix = "rsa")

public class RsaKeyProperties {

private RSAPublicKey publicKey;

private RSAPrivateKey privateKey;

// Getters and Setters

public RSAPublicKey getPublicKey() {

return publicKey;

}

public void setPublicKey(RSAPublicKey publicKey) {

this.publicKey = publicKey;

}

public RSAPrivateKey getPrivateKey() {

return privateKey;

}

public void setPrivateKey(RSAPrivateKey privateKey) {

this.privateKey = privateKey;

}

application.properties:


rsa.public-key=classpath:certs/public.pem
rsa.private-key=classpath:certs/private.pem

rsa.public-key=classpath:certs/public.pem

rsa.private-key=classpath:certs/private.pem

Explanation:

RsaKeyProperties: Binds the RSA public and private keys specified in application.properties to Java objects.
JWT Encoder and Decoder: Configured in SecurityConfig.java using the RSA keys.

3.3 Handling Authentication

To manage authentication, you need to override the default authentication manager provided by Spring Security.

SecurityConfig.java (Updated):


@Bean
public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
    return config.getAuthenticationManager();
}

@Bean

public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {

return config.getAuthenticationManager();

}

This bean allows you to inject the AuthenticationManager where needed, facilitating user authentication processes.

—

Chapter 4: Testing the Implementation

4.1 Running the Application

To run the Spring Boot application:

Navigate to the Project Directory:

Java

cd S02L03 - Spring Boot OAuth2 JWT getting started

1
2
3

cd S02L03 - Spring Boot OAuth2 JWT getting started
Execute the Maven Wrapper:

Java

./mvnw spring-boot:run

1
2
3

./mvnw spring-boot:run

Expected Output:


2023-10-10 10:00:00.000  INFO 12345 --- [           main] o.s.boot.SpringApplication               : Starting Spring Boot application...
2023-10-10 10:00:05.000  INFO 12345 --- [           main] o.s.b.w.embedded.tomcat.TomcatWebServer  : Tomcat started on port(s): 8080 (http) with context path ''
2023-10-10 10:00:05.000  INFO 12345 --- [           main] o.s.b.a.e.web.EndpointLinksResolver      : Exposing 1 endpoint(s) beneath base path '/actuator'

2023-10-10 10:00:00.000 INFO 12345 --- [ main] o.s.boot.SpringApplication : Starting Spring Boot application...

2023-10-10 10:00:05.000 INFO 12345 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8080 (http) with context path ''

2023-10-10 10:00:05.000 INFO 12345 --- [ main] o.s.b.a.e.web.EndpointLinksResolver : Exposing 1 endpoint(s) beneath base path '/actuator'

4.2 Verifying JWT Generation

Upon running the application, attempt to access a secured endpoint. Since the application is configured to require authentication for all requests, accessing an endpoint without a valid JWT will result in an unauthorized error.

Sample Request:


GET http://localhost:8080/account

GET http://localhost:8080/account

Expected Response:


{
    "error": "Unauthorized",
    "message": "Full authentication is required to access this resource",
    "status": 401,
    "timestamp": "2023-10-10T10:05:00Z"
}

{

"error": "Unauthorized",

"message": "Full authentication is required to access this resource",

"status": 401,

"timestamp": "2023-10-10T10:05:00Z"

}

To obtain a valid JWT, implement an authentication controller that authenticates the user and issues a token.

AccountController.java:


package org.studyeasy.SpringRestdemo.controller;

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/auth")
public class AccountController {

    private final AuthenticationManager authManager;
    private final JwtEncoder jwtEncoder;

    public AccountController(AuthenticationManager authManager, JwtEncoder jwtEncoder) {
        this.authManager = authManager;
        this.jwtEncoder = jwtEncoder;
    }

    @PostMapping("/login")
    public String login(@RequestBody AuthRequest authRequest) {
        Authentication authentication = authManager.authenticate(
            new UsernamePasswordAuthenticationToken(
                authRequest.getUsername(),
                authRequest.getPassword()
            )
        );

        return jwtEncoder.encode(JwtClaimsSet.builder()
            .subject(authentication.getName())
            .issuedAt(Instant.now())
            .expiresAt(Instant.now().plusSeconds(3600))
            .build()
        ).getTokenValue();
    }
}

package org.studyeasy.SpringRestdemo.controller;

import org.springframework.security.authentication.AuthenticationManager;

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;

import org.springframework.security.core.Authentication;

import org.springframework.web.bind.annotation.*;

@RestController

@RequestMapping("/auth")

public class AccountController {

private final AuthenticationManager authManager;

private final JwtEncoder jwtEncoder;

public AccountController(AuthenticationManager authManager, JwtEncoder jwtEncoder) {

this.authManager = authManager;

this.jwtEncoder = jwtEncoder;

}

@PostMapping("/login")

public String login(@RequestBody AuthRequest authRequest) {

Authentication authentication = authManager.authenticate(

new UsernamePasswordAuthenticationToken(

authRequest.getUsername(),

authRequest.getPassword()

)

);

return jwtEncoder.encode(JwtClaimsSet.builder()

.subject(authentication.getName())

.issuedAt(Instant.now())

.expiresAt(Instant.now().plusSeconds(3600))

.build()

).getTokenValue();

}

AuthRequest.java:


package org.studyeasy.SpringRestdemo.controller;

public class AuthRequest {
    private String username;
    private String password;

    // Getters and Setters
}

package org.studyeasy.SpringRestdemo.controller;

public class AuthRequest {

private String username;

private String password;

// Getters and Setters

}

Workflow:

User Authentication: The user sends a POST request to /auth/login with their credentials.
Token Issuance: Upon successful authentication, the server issues a JWT.
Access Protected Resources: The user includes the JWT in the Authorization header as a Bearer token to access secured endpoints.

Sample Login Request:


POST http://localhost:8080/auth/login
Content-Type: application/json

{
    "username": "user123",
    "password": "password"
}

POST http://localhost:8080/auth/login

Content-Type: application/json

{

"username": "user123",

"password": "password"

}

Sample Response:


"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."

Accessing Protected Endpoint with JWT:


GET http://localhost:8080/account
Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

GET http://localhost:8080/account

Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...

Expected Successful Response:


{
    "accountId": "12345",
    "balance": 1000.00,
    "currency": "USD"
}

{

"accountId": "12345",

"balance": 1000.00,

"currency": "USD"

}

—

Chapter 5: Conclusion

Securing your Spring Boot applications is crucial in safeguarding data and ensuring trusted interactions between clients and servers. By implementing OAuth2 with JWT, you establish a robust authentication and authorization mechanism that is both scalable and secure.

In this guide, we covered:

Setting Up OAuth2 and JWT: Integrated OAuth2 as the authorization framework and utilized JWT for token-based authentication.
Generating RSA Key Pairs: Created RSA keys essential for signing and verifying JWT tokens, enhancing security.
Configuring Spring Security: Defined security configurations to manage authentication, authorization, and session management.
Implementing JWT Encoder and Decoder: Ensured seamless token generation and validation through custom encoders and decoders.
Testing the Application: Verified the security setup by authenticating users and accessing protected resources using JWT tokens.

By following these steps, you can enhance the security posture of your Spring Boot applications, providing users with a safe and reliable experience.

SEO Optimized Keywords: Spring Boot security, OAuth2 JWT integration, Spring Security configuration, JWT token generation, RSA key pair Spring Boot, secure RESTful APIs, Spring Boot OAuth2 tutorial, JSON Web Tokens Spring, stateless authentication Spring, Spring Boot authentication

—

Additional Resources

—

Note: This article is AI generated.

S02L03 – Spring Boot OAuth2 JWT getting started

Securing Your Spring Boot Applications with OAuth2 and JWT: A Comprehensive Guide

Table of Contents

Introduction

Chapter 1: Getting Started with Spring Boot OAuth2 JWT

1.1 Understanding OAuth2 and JWT

1.2 Setting Up the Development Environment

Chapter 2: Configuring Security in Spring Boot

2.1 Adding Security Dependencies

2.2 Creating RSA Key Pairs

2.3 Implementing SecurityConfig

Chapter 3: Generating and Decoding JWT Tokens

3.1 Understanding JWT Structure

3.2 Implementing JWT Encoder and Decoder

3.3 Handling Authentication

Chapter 4: Testing the Implementation

4.1 Running the Application

4.2 Verifying JWT Generation

Chapter 5: Conclusion

Additional Resources