OAuth2 is responsible for authorization, and JWT is used to transmit information securely. The four roles of OAuth2 include resource owner, client, authentication server and resource server. The common process is the authorization code mode. After the user logs in, the client uses the code to exchange it for the token, and then uses the token to access the resources. JWT includes three parts: header, load and signature. The microservice confirms identity and resolves permission information by verifying the signature. Spring Boot integration uses the OAuth2 Resource Server module to configure issuer-uri and jwk-set-uri, and customizes permission parser extraction authorities. Notes include setting the token expiration time reasonably, refreshing the token with secure storage, correctly configuring CORS, and avoiding storing sensitive data in JWT.
OAuth2 and JWT are two core technologies that ensure the security of Java microservices. Simply put, OAuth2 provides an authorization mechanism, while JWT is used to securely transmit user information. They work together to enable flexible, scalable authentication and access control.

1. Basic roles and processes of OAuth2
In the microservice architecture, OAuth2 is mainly used to handle user authorization, and the four common roles include:
- Resource Owner : Usually a user.
- Client : The application that initiates the request, such as a front-end application or a mobile terminal.
- Authorization Server : Responsible for issuing tokens.
- Resource Server : A protected service, such as a Java microservice.
The most common process is Authorization Code Flow , which is suitable for applications with backends. The process is roughly as follows:

- User attempts to access protected resources
- Redirected to the authentication server to log in and authorize
- Get the authorization code (code)
- The client exchanges access tokens for authentication server using code
- Use access token to access the resource server
The core of this process is to "replace the token with code", which avoids direct exposure of the token.
2. The role of JWT in microservices
JWT (JSON Web Token) is a lightweight data exchange format that is often used for authentication. It contains three parts:

- Header: Instructions signature algorithm, etc.
- Payload: contains user information (such as username, permissions, etc.)
- Signature: Ensure that the data has not been tampered with
In Java microservices, the usual practice is:
- Authorization server generates a signature JWT
- Verify the signature validity of the JWT when the microservice receives a request
- Dissolve user information to determine whether you have permission to access
The advantages are obvious: stateless, suitable for distributed systems; disadvantages also exist, such as the inability to undo the token as easily as a session.
3. How to integrate OAuth2 JWT in Spring Boot
Spring Security provides good support for OAuth2 and JWT, and here is a common practice:
Using Spring Security OAuth2 Resource Server
If you already have an authentication server (such as Keycloak or self-built Spring Authorization Server), each Java microservice only needs to be used as a Resource Server to verify the token.
Key configuration steps include:
- Add dependencies:
spring-boot-starter-oauth2-resource-server
- Configure issuer-uri and jwk-set-uri in
application.yml
- Turn on method-level permission control (such as
@EnableMethodSecurity
)
spring: security: oauth2: resource-server: jwt: jwk-set-uri: https://your-auth-server/.well-known/jwks.json
This way, Spring automatically downloads the public key and verifies that the JWT carried by each request is legal.
Custom permission resolution (optional)
You can extract permission information in JWT by implementing JwtAuthenticationConverter
, for example:
JwtAuthenticationConverter jwtConverter = new JwtAuthenticationConverter(); jwtConverter.setJwtGrantedAuthoritiesConverter(jwt -> { List<String> authorities = jwt.getClaimAsStringList("authorities"); return authorities.stream() .map(SimpleGrantedAuthority::new) .collect(Collectors.toList()); });
Then set it into the Security configuration.
4. Frequently Asked Questions and Precautions
- The expiration time of tokens should not be too long : generally set to between a few minutes and a few hours to avoid long-term effectiveness after leakage.
- Refreshing a token requires careful handling : Refreshing a token should be stored more securely (such as HttpOnly Cookies) and limit its usage.
- Cross-domain requests require CORS : especially in front-end and back-end separation architecture, pay attention to cross-domain issues in the authentication process.
- Don't put sensitive information in JWT : Although signatures can prevent tampering, the content itself is plain-text-visible.
Basically that's it. By mastering the OAuth2 process and how to use JWT, the Java microservice security system can lay a solid foundation.
The above is the detailed content of Securing Java Microservices with OAuth2 and JWT. For more information, please follow other related articles on the PHP Chinese website!

Hot AI Tools

Undress AI Tool
Undress images for free

Undresser.AI Undress
AI-powered app for creating realistic nude photos

AI Clothes Remover
Online AI tool for removing clothes from photos.

Clothoff.io
AI clothes remover

Video Face Swap
Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Article

Hot Tools

Notepad++7.3.1
Easy-to-use and free code editor

SublimeText3 Chinese version
Chinese version, very easy to use

Zend Studio 13.0.1
Powerful PHP integrated development environment

Dreamweaver CS6
Visual web development tools

SublimeText3 Mac version
God-level code editing software (SublimeText3)

Hot Topics

Enums in Java are special classes that represent fixed number of constant values. 1. Use the enum keyword definition; 2. Each enum value is a public static final instance of the enum type; 3. It can include fields, constructors and methods to add behavior to each constant; 4. It can be used in switch statements, supports direct comparison, and provides built-in methods such as name(), ordinal(), values() and valueOf(); 5. Enumeration can improve the type safety, readability and flexibility of the code, and is suitable for limited collection scenarios such as status codes, colors or week.

Interface Isolation Principle (ISP) requires that clients not rely on unused interfaces. The core is to replace large and complete interfaces with multiple small and refined interfaces. Violations of this principle include: an unimplemented exception was thrown when the class implements an interface, a large number of invalid methods are implemented, and irrelevant functions are forcibly classified into the same interface. Application methods include: dividing interfaces according to common methods, using split interfaces according to clients, and using combinations instead of multi-interface implementations if necessary. For example, split the Machine interfaces containing printing, scanning, and fax methods into Printer, Scanner, and FaxMachine. Rules can be relaxed appropriately when using all methods on small projects or all clients.

Java supports asynchronous programming including the use of CompletableFuture, responsive streams (such as ProjectReactor), and virtual threads in Java19. 1.CompletableFuture improves code readability and maintenance through chain calls, and supports task orchestration and exception handling; 2. ProjectReactor provides Mono and Flux types to implement responsive programming, with backpressure mechanism and rich operators; 3. Virtual threads reduce concurrency costs, are suitable for I/O-intensive tasks, and are lighter and easier to expand than traditional platform threads. Each method has applicable scenarios, and appropriate tools should be selected according to your needs and mixed models should be avoided to maintain simplicity

There are three main differences between Callable and Runnable in Java. First, the callable method can return the result, suitable for tasks that need to return values, such as Callable; while the run() method of Runnable has no return value, suitable for tasks that do not need to return, such as logging. Second, Callable allows to throw checked exceptions to facilitate error transmission; while Runnable must handle exceptions internally. Third, Runnable can be directly passed to Thread or ExecutorService, while Callable can only be submitted to ExecutorService and returns the Future object to

In Java, enums are suitable for representing fixed constant sets. Best practices include: 1. Use enum to represent fixed state or options to improve type safety and readability; 2. Add properties and methods to enums to enhance flexibility, such as defining fields, constructors, helper methods, etc.; 3. Use EnumMap and EnumSet to improve performance and type safety because they are more efficient based on arrays; 4. Avoid abuse of enums, such as dynamic values, frequent changes or complex logic scenarios, which should be replaced by other methods. Correct use of enum can improve code quality and reduce errors, but you need to pay attention to its applicable boundaries.

JavaNIO is a new IOAPI introduced by Java 1.4. 1) is aimed at buffers and channels, 2) contains Buffer, Channel and Selector core components, 3) supports non-blocking mode, and 4) handles concurrent connections more efficiently than traditional IO. Its advantages are reflected in: 1) Non-blocking IO reduces thread overhead, 2) Buffer improves data transmission efficiency, 3) Selector realizes multiplexing, and 4) Memory mapping speeds up file reading and writing. Note when using: 1) The flip/clear operation of the Buffer is easy to be confused, 2) Incomplete data needs to be processed manually without blocking, 3) Selector registration must be canceled in time, 4) NIO is not suitable for all scenarios.

Java's class loading mechanism is implemented through ClassLoader, and its core workflow is divided into three stages: loading, linking and initialization. During the loading phase, ClassLoader dynamically reads the bytecode of the class and creates Class objects; links include verifying the correctness of the class, allocating memory to static variables, and parsing symbol references; initialization performs static code blocks and static variable assignments. Class loading adopts the parent delegation model, and prioritizes the parent class loader to find classes, and try Bootstrap, Extension, and ApplicationClassLoader in turn to ensure that the core class library is safe and avoids duplicate loading. Developers can customize ClassLoader, such as URLClassL

Javaprovidesmultiplesynchronizationtoolsforthreadsafety.1.synchronizedblocksensuremutualexclusionbylockingmethodsorspecificcodesections.2.ReentrantLockoffersadvancedcontrol,includingtryLockandfairnesspolicies.3.Conditionvariablesallowthreadstowaitfor
