Add Spring Security and JWT dependencies in pom.xml to enable security and token handling. 2. Create a JwtRequestFilter to intercept requests, extract and validate JWT tokens, and set authentication in the security context. 3. Configure SecurityConfig to disable CSRF, permit public access to /authenticate and /register, require authentication for all other endpoints, set session creation to STATELESS, and add the JWT filter before the default authentication filter. 4. Implement an authentication endpoint that validates user credentials and returns a JWT upon successful login. 5. Follow best practices such as using HTTPS, avoiding localStorage for JWT storage, setting short token expiration times with refresh tokens, using BCrypt for password encoding, and validating input to prevent attacks. Your API is now secured with stateless authentication using JWT and Spring Security, ensuring robust protection against common threats.

Securing a Java REST API with Spring Security isn't just a nice-to-have—it's essential. Unlike traditional web apps that rely on sessions and HTML forms, REST APIs are stateless and typically use token-based authentication like JWT (JSON Web Tokens). Here’s how to do it right using Spring Security.

1. Set Up Spring Security Dependencies

Start by adding the necessary dependencies in your pom.xml (for Maven):

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>

Spring Security will automatically protect all endpoints once added. You’ll need to configure it to allow public access to login/register routes and secure the rest.

2. Configure Stateless Authentication with JWT

REST APIs should be stateless—meaning no server-side session storage. JWTs are perfect for this.

Key Components:

• JwtUtil Class: Generates and validates tokens.
• JwtRequestFilter: Intercepts incoming requests, checks for JWT, and sets authentication.
• UserDetailsService: Loads user-specific data.
• PasswordEncoder: Safely hashes passwords.

Example JwtRequestFilter:

@Component
public class JwtRequestFilter extends OncePerRequestFilter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtUtil jwtUtil;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        final String authorizationHeader = request.getHeader("Authorization");

        String username = null;
        String jwt = null;

        if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
            jwt = authorizationHeader.substring(7);
            username = jwtUtil.extractUsername(jwt);
        }

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);

            if (jwtUtil.validateToken(jwt, userDetails)) {
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        chain.doFilter(request, response);
    }
}

This filter runs on every request, extracts the token, validates it, and sets the authenticated user in the security context.

3. Configure Spring Security (SecurityConfig)

Create a SecurityConfig class to customize security behavior:

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtRequestFilter jwtRequestFilter;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/authenticate", "/register").permitAll()
                .anyRequest().authenticated()
            )
            .sessionManagement(sess -> sess.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

What This Does:

• Disables CSRF (safe for stateless APIs).
• Permits public access to /authenticate and /register.
• Requires authentication for all other endpoints.
• Sets session creation to STATELESS.
• Adds the JWT filter before the default authentication filter.

4. Implement Authentication Endpoint

Create a controller to generate tokens upon login:

@PostMapping("/authenticate")
public ResponseEntity<?> createAuthenticationToken(@RequestBody AuthenticationRequest request) {
    try {
        authenticationManager.authenticate(
            new UsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword())
        );
    } catch (BadCredentialsException e) {
        throw new ExceptionResponse("Invalid credentials", HttpStatus.UNAUTHORIZED);
    }

    final String jwt = jwtUtil.generateToken(request.getUsername());
    return ResponseEntity.ok(new AuthenticationResponse(jwt));
}

The AuthenticationRequest holds username and password; AuthenticationResponse returns the JWT.

5. Best Practices & Common Pitfalls

• Never store JWTs in localStorage (XSS risk). Prefer HttpOnly cookies if possible, or use secure storage with proper XSS protection.
• Always use HTTPS in production.
• Set reasonable token expiration times (e.g., 15–30 minutes) and implement refresh tokens.
• Use strong password encoding (BCrypt is good).
• Validate input rigorously to prevent injection attacks.
• Avoid exposing sensitive user data in JWT claims.

Final Notes

Spring Security is powerful but complex. With REST APIs, the key is embracing statelessness and using JWT correctly. Once you set up the filter chain, token handling, and proper endpoint security, you’ve got a solid foundation.

Use @PreAuthorize for method-level security (e.g., @PreAuthorize("hasRole('ADMIN')")), and consider OAuth2 if you need social login or third-party access.

Basically: secure the endpoints, validate tokens on every request, keep no session, and never trust the client.

That’s it—your API is now significantly safer.

The above is the detailed content of Securing a Java REST API with Spring Security. For more information, please follow other related articles on the PHP Chinese website!