Spring Security JWT: How to secure your Spring Boot REST APIs with JSON Web Tokens

In this tutorial, you are going to learn how to secure your Spring Boot REST APIs using JSON Web Tokens (JWT) with Spring Security.

🔗Resources & Links mentioned in this video:

👋🏻Connect with me:

[GiftNestah]

Just what I needed after struggling with an issue whereby a single user's token expiry invalidates all other users' valid tokens leading to error 403 even for authenticated users. Thanks a lot for this 💯💯

[ParnianAndIlian]

Hi Dan, This is the tutorial that was missing in 2022. Thanks a lot. I was struggling with those outdated tutorials and dependencies to make a working solution. this saved me lots of time. Looking forward to your next videos.

[Learn_with_cosmos]

I am a nodejs and Golang API. I found this tutorial very help for my current work using Spring-boot.
One thing about Spring-boot is that, when you use Spring-Boot with higher version some errors like this shows up:
This error occurs in the NimbusJwtDecoder.validateJwt method of the class. The NimbusJwtDecoder class is used to decode JSON Web Tokens (JWTs) and is part of the Spring Security OAuth 2.0 framework.

[rajmohanparayil]

Wow. Learned a lot of very relevant security implementation in a very smooth and clean fashion and in such a short time.

[kasimgul]

Thank you for this, Dan. I would love to see a follow up video for implementing "Refresh Token" on top of this :) I know people will love it.

[AleksandarT]

Great video! Really helpful to get people started with latest Spring Security stuff and JWT! Few questions/comments though:
1. It would be good if you can extend the github repo and add a branch which shows the symmetric key approach - i guess it would be easy for the Decoder as u mentioned, but would like to see how to change the Encoder
2. Maybe to make it more realistic instead of HttpBasic - it would be good to have a UserNamePassword Authentication where the user calls an endpoint with username/password as body and the token generation happens based on that
3. Building on top of 2), it would be great if this gets connected to a database where hashing + salting is used as this can be used as a starter for real projects
4. Having roles in the example/video would be great

Looking forward to your next video Dan!

[luisferdev]

thank you Dan, this video help me a lot to understand how to generate JWT in Spring. the only one site where I found the explanation with the new version of spring security and works. regards from Colombia

[kozi-corner]

Thank you so much..I was just working on a project and had a lot of difficulties understanding JWT, I opened youtube and I found your video. How lucky I am!

[voiceofeverything]

Great video. This is like the only one guide about this topic that is quite easy to follow and does not break your spirit (I have tried to follow like 2 different videos just to realize half way into 3 hour videos that implementation was changed/got deprecated and I wasted my time).

[marekj]

Very good video, if anybody haven't mentioned yet, it would be good to replace inMemory user with UserDetailsService on data base. Additionally securing rest api with roles. Video would be a bit longer than 1hours, but woud cover topic from A to Z

[brethagen]

Straight to the point, no fluff. Looks looks like a bare-minimum implementation.

[kaatlev]

These videos are so concise and easy to follow, appreciate you.

[petrophilip]

This is a great tutorial. You have a way of explaining complex topics in simple terms.
I have subbed to your channel.

[bobgner]

Thank you for making this tutorial. As you mentioned in the beginning there are so many more complicated ways of doing out there because the are not using what is built in to Spring Security. I unfortunately had used one of those more complicated ways so now I'm going to use what I learned in your tutorial to simplify my project code!

[fabricio.entringer]

Hello @Dan, it's amazing! Great video. Please keep producing videos regarding Spring Security, I think it's a black hole in the Spring modules. A lot of specific concepts and it deserves good videos with good explanations like yours. Congratulation and thanks for sharing the content.

[SchefenBaba]

Thanks a lot for this tutorial. I have been stuck in other tutorials for hours.

[alexgutjahr]

I'm guilty of rolling up my custom solution, pulling in a third party library. Thanks for this video, Dan! Gotta refactor a bit!

[neerajagrawal]

Great information. I think a simple video will also be helpful which explains how to protect API using Okta or Keycloak since in most situations you don’t write authorization server yourself.

[SD-gwvm]

Thanks for sharing this. I used your example to solve a problem I was working on and it worked. You are a lifesaver

[mrkostya]

finally, an informative tutorial that ACTUALLY uses BUILTIN jwt tools, and not some filters and JwtUtility classes to secure an app