Use Spring Security and JWT to implement secure authentication and authorization of REST API in Java, suitable for stateless and scalable architectures such as microservices, mobile applications and single-page applications; 2. First add Spring Boot Web, Spring Security and JJW dependencies in pom.xml; 3. Create User and LoginRequest model classes for user information and login requests; 4. Write JwtUtil tool class to generate, parse and verify JWT, note that the key should be configured through environment variables rather than hard coded; 5. Configure SecurityConfig class to disable CSRF, set stateless session policies, release the authentication interface, and register JWT filters; 6. Implement the JwtRequestFilter filter to extract and verify JWT from the Authorization header, and set the authentication context if it is valid; 7. Create an AuthController to provide an /authenticate login interface, and return the JWT token after verifying the credentials; 8. Define protected API endpoints such as /secured, which can only be accessed if the request carries a valid Bearer Token; 9. Best practices include using HTTPS, secure storage tokens, setting a short expiration time and coordinating with refresh tokens, prioritizing the use of RS256 algorithm, verifying token declarations, and limiting the frequency of login interfaces to prevent brute-force cracking. By placing the API properly and following security specifications, this solution ensures the statelessness, security and high scalability of the API.

Securing REST APIs in Java using Spring Security and JWT is a common requirement for modern web applications, especially when building stateless, scalable backends. Here's a practical guide to implementing secure authentication and authorization with Spring Security and JSON Web Tokens (JWT).

Why Use Spring Security JWT?

Spring Security provides a powerful and customized framework for handling authentication and authorization in Java applications. When combined with JWT, it enables stateless authentication , meaning the server doesn't need to store session data. Instead, each request includes a signed token that proves the user's identity.

This is ideal for:

• Microservices architectures
• Mobile and single-page applications (SPAs)
• APIs that need to scale horizontally

Step 1: Set Up Dependencies

Add the required dependencies in your pom.xml (for Maven):

 <dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-api</artifactId>
        <version>0.11.5</version>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-impl</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
    <dependency>
        <groupId>io.jsonwebtoken</groupId>
        <artifactId>jjwt-jackson</artifactId>
        <version>0.11.5</version>
        <scope>runtime</scope>
    </dependency>
</dependencies>

Step 2: Create User Model and Authentication Request

Define a simple user model and login DTO:

 public class User {
    private String username;
    private String password;
    // constructors, getters, setters
}

 public class LoginRequest {
    private String username;
    private String password;
    // getters and setters
}

Step 3: Generate and Validate JWT

Create a utility class to generate and parse tokens:

 @Component
public class JwtUtil {

    private String SECRET_KEY = "your-secret-key"; // Use environment variable or keystore in production

    public String generateToken(UserDetails userDetails) {
        return Jwts.builder()
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() 1000 * 60 * 60 * 10)) // 10 hours
                .signWith(SignatureAlgorithm.HS256, SECRET_KEY)
                .compact();
    }

    public Boolean validateToken(String token, UserDetails userDetails) {
        final String username = extractUsername(token);
        return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }

    public String extractUsername(String token) {
        return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody().getSubject();
    }

    private Boolean isTokenExpired(String token) {
        return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody().getExpiration().before(new Date());
    }
}

? Security Tip : Never hardcode the secret key. Use @Value("${jwt.secret}") with environment variables or a secure key management system.

Step 4: Configure Spring Security

Create a security configuration class:

 @Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtRequestFilter jwtRequestFilter;

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public AuthenticationManager authenticationManager(AuthenticationConfiguration config) throws Exception {
        return config.getAuthenticationManager();
    }

    @Bean
    protected SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/authenticate").permitAll()
                .anyRequest().authenticated()
            )
            .sessionManagement(sess -> sess.sessionCreationPolicy(SessionCreationPolicy.STATELESS));

        http.addFilterBefore(jwtRequestFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

Step 5: Implement JWT Filter

Create a filter to intercept incoming requests and validate the JWT:

 @Component
public class JwtRequestFilter extends OncePerRequestFilter {

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtUtil jwtUtil;

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
            throws ServletException, IOException {

        final String authorizationHeader = request.getHeader("Authorization");

        String username = null;
        String jwt = null;

        if (authorizationHeader != null && authorizationHeader.startsWith("Bearer ")) {
            jwt = authorizationHeader.substring(7);
            username = jwtUtil.extractUsername(jwt);
        }

        if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {
            UserDetails userDetails = this.userDetailsService.loadUserByUsername(username);

            if (jwtUtil.validateToken(jwt, userDetails)) {
                UsernamePasswordAuthenticationToken authToken = new UsernamePasswordAuthenticationToken(
                        userDetails, null, userDetails.getAuthorities());
                authToken.setDetails(new WebAuthenticationDetailsSource().buildDetails(request));
                SecurityContextHolder.getContext().setAuthentication(authToken);
            }
        }
        chain.doFilter(request, response);
    }
}

Step 6: Create Authentication Endpoint

Expose an endpoint to generate a token upon login:

 @RestController
public class AuthController {

    @Autowired
    private AuthenticationManager authenticationManager;

    @Autowired
    private UserDetailsService userDetailsService;

    @Autowired
    private JwtUtil jwtUtil;

    @PostMapping("/authenticate")
    public ResponseEntity<?> createAuthenticationToken(@RequestBody LoginRequest loginRequest) throws Exception {
        try {
            authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(loginRequest.getUsername(), loginRequest.getPassword())
            );
        } catch (BadCredentialsException e) {
            throw new Exception("Incorrect username or password", e);
        }

        final UserDetails userDetails = userDetailsService.loadUserByUsername(loginRequest.getUsername());
        final String jwt = jwtUtil.generateToken(userDetails);

        return ResponseEntity.ok(new JwtResponse(jwt));
    }
}

And the response DTO:

 public class JwtResponse {
    private String token;

    public JwtResponse(String token) {
        this.token = token;
    }

    // getter
}

Step 7: Test the Secured API

Now, any endpoint other than /authenticate requires a valid JWT:

 @RestController
public class DemoController {

    @GetMapping("/secured")
    public String securedEndpoint() {
        return "Hello, you're authenticated!";
    }
}

To access /secured , include the header:

 Authorization: Bearer <your-jwt-token>

Best Practices & Security Tips

• ? Use HTTPS in production
• ? Store JWTs securely on the client (avoid localStorage if possible; prefer httpOnly cookies for web apps)
• ? Set short expiration times and implement refresh tokens
• ? Use strong secrets or RSA keys (RS256 instead of HS256 for better key separation)
• ? Validate issuer, audience, and claims in production
• ? Rate-limit authentication endpoints to prevent brute force attacks

Conclusion

Spring Security with JWT gives you a robust foundation for securing REST APIs in Java. While the setup involves several components—filters, token generation, and configuration—the pattern is reusable and fits well with modern application architectures.

With proper key management and token handling, this approach keeps your APIs secure, stateless, and scalable.

Basically just wire up the filter, protect your endpoints, and validate tokens on each request — and you're good to go.

The above is the detailed content of Securing REST APIs in Java with Spring Security and JWT. For more information, please follow other related articles on the PHP Chinese website!