minte9
LearnRemember   SPRING





App

Web Spring application with token auth, jjwt dependency. 
 
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt</artifactId>
        <version>0.9.1</version>
    </dependency>
    <dependency>
        <groupId>jakarta.xml.bind</groupId>
        <artifactId>jakarta.xml.bind-api</artifactId>
    </dependency>
<dependencies>

 
package com.minte9.jwt;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class App {

    public static void main(String[] args) {
        SpringApplication.run(App.class, args);
    }
}

Controller

REST controller that implements the auth with username/password. 
 
/**
 * REST Controller
 * 
 * In real-life applciations will have three servers: our API, 
 * authentication sever, authorization server. As demo, we can implement 
 * all three functionalities in a single application.
 * 
 * With Jwts builder() we create the JWT token with: user's name, authorities, 
 * issued and expiration dates, and signature.
 * 
 * In Spring Security, GrantedAuthority is an interface that represents 
 * a granted authority or permission (ROLE_USER, ROLE_ADMIN, etc) 
 */
package com.minte9.jwt;

import java.util.Date;
import java.util.List;
import java.util.stream.Collectors;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.core.env.Environment;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;

@RestController
public class AppRestController {

    @ Autowired
    private Environment env;

    @RequestMapping("/hello")
    public String hello() {
        return "Hello World! \n";
    }

    @PostMapping("/token")
    public User genToken(
            @RequestParam("user") String username, 
            @RequestParam("password") String pwd) {
        
        User user = new User();    
        user.setUser(username);
        String envUser = env.getProperty("spring.security.user.name");
        String envPass = env.getProperty("spring.security.user.password");

        if(username.equals(envUser) && pwd.equals(envPass)) { // Look Here
            String token = getJWTToken(username);
            user.setToken(token);
        }

        return user;
    }

    private String getJWTToken(String username) {
        String secretKey = "myTokenSecretKey";
        List<GrantedAuthority> grantedAuthorities = AuthorityUtils
            .commaSeparatedStringToAuthorityList("ROLE_USER");
        
        String token = Jwts
            .builder()
            .setId("minte9JWT")
            .setSubject(username)
            .claim("authorities", grantedAuthorities.stream()
                    .map(GrantedAuthority::getAuthority)
                    .collect(Collectors.toList()))
            .setIssuedAt(new Date(System.currentTimeMillis()))
            .setExpiration(new Date(System.currentTimeMillis() + 600000))
            .signWith(SignatureAlgorithm.HS512, secretKey.getBytes())
            .compact();

        return "Bearer " + token;
    }
}

Config

Calls to /user are allowed, but all other calls require authentication. 
 
/**
 * JWT Authorization Security Configuration
 * 
 * Extend WebSecurityConfigurerAdapter class to provide 
 * custom security configuration.
 * 
 * Add JWT authorization filter after UsernamePasswordAuthenticationFilter.
 * Allow unauthenticated access to /token POST requests.
 * Require authentication for all other requests.
 */

package com.minte9.jwt;

import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.*;
import org.springframework.security.web.authentication.*;

@EnableWebSecurity
@Configuration
class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .addFilterAfter(
                new JWTAuthorizationFilter(), 
                UsernamePasswordAuthenticationFilter.class // Look Here
            )
            .authorizeRequests()
            .antMatchers(HttpMethod.POST, "/token").permitAll()
            .anyRequest().authenticated();
    }
}

Authorization

Implement the autorization process with JWTAuthorizationFilter class. 
 
/**
 * JWT Authorization
 * 
 * JSON Web Token is an open source standard for creating access tokens 
 * that allow us to secure communications between client and server.
 * 
 * Token authentication is more secure than session authentication 
 * because a token cannot be tampered with.
 */

package com.minte9.jwt;

import java.io.IOException;
import java.util.List;
import java.util.stream.Collectors;
import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.*;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.OncePerRequestFilter;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.ExpiredJwtException;
import io.jsonwebtoken.JwtParser;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.MalformedJwtException;
import io.jsonwebtoken.UnsupportedJwtException;

public class JWTAuthorizationFilter extends OncePerRequestFilter {

    private final String HEADER = "Authorization";
    private final String PREFIX = "Bearer ";
    private final String SECRET = "myTokenSecretKey";

    /**
     * Intercept HTTP requests and performs JWT token authentication. 
     * 
     * If the token is valid, it sets up Spring authentication by setting 
     * the security context with the authenticated user's information. 
     * 
     * If the token is invalid, it clears the authentication context. 
     * If an exception occurs during validation, it returns a 403
     */
    @Override
    protected void doFilterInternal(
            HttpServletRequest request, 
            HttpServletResponse response, 
            FilterChain chain) 
                throws ServletException, IOException {
        try {
            if (checkJWTToken(request, response)) {
                Claims claims = validateToken(request);
                if (claims.get("authorities") != null) {
                    setUpSpringAuthentication(claims);
                } else {
                    SecurityContextHolder.clearContext();
                }
            }else {
                SecurityContextHolder.clearContext();
            }
            chain.doFilter(request, response);
        } catch (ExpiredJwtException | 
                     UnsupportedJwtException | MalformedJwtException e) {
            response.setStatus(HttpServletResponse.SC_FORBIDDEN);
            response = (HttpServletResponse) response;
            response.sendError(HttpServletResponse.SC_FORBIDDEN, e.getMessage());
            return;
        }
    }    

    /**
     * Extract the JWT token from the HTTP request header and parses it 
     * to retrieve the token's claims. 
     * 
     * It returns the token's claims after validating the token's signature
     * using the application's secret key.
     */
    private Claims validateToken(HttpServletRequest request) {
        String jwtToken = request.getHeader(HEADER).replace(PREFIX, "");
        JwtParser jwtParser = Jwts.parser();

        jwtParser.setSigningKey(SECRET.getBytes());
        return jwtParser.parseClaimsJws(jwtToken).getBody();
    }

    /**
     * Set up Spring authentication instance with the authenticated 
     * user's details and setting it in the security context.
     */
    private void setUpSpringAuthentication(Claims claims) {
        @SuppressWarnings("unchecked")
        List<String> authorities = (List<String>) claims.get("authorities");

        UsernamePasswordAuthenticationToken auth = 
            new UsernamePasswordAuthenticationToken(
                claims.getSubject(), null, authorities.stream()
                    .map(SimpleGrantedAuthority::new)
                    .collect(Collectors.toList()
            )
        );
        SecurityContextHolder.getContext().setAuthentication(auth);

    }

    /**
     * Checks if the Authorization header of the HTTP request contains 
     * a JWT token with the correct Bearer prefix.
     */
    private boolean checkJWTToken(
            HttpServletRequest request, 
            HttpServletResponse res) {
        String authenticationHeader = request.getHeader(HEADER);
        if ( authenticationHeader == null ||
            !authenticationHeader.startsWith(PREFIX))
            return false;
        return true;
    }

}

Token

The client uses token to access the protected resources. 
 
curl http://localhost:8080/hello
    # Access denied

URL='http://localhost:8080/token?user=myuser&password=mypass'
RESPONSE=$(curl -s -X POST -H "Content-Type: application/json" $URL)
TOKEN=$(echo $RESPONSE | jq -r '.token')
echo $TOKEN
    # Bearer eyJhbGciOiJIUzUxMiJ9.eyJqdGkiOiJzb2Z0dG...

curl -H "Authorization: Bearer $TOKEN" http://localhost:8080/hello
    # Hello World




References: