SPRING SECURITY 6 with JWT Authentication: Secure Your App in MINUTES!

In this video I will show how to use Spring Security 6 with JWT Authentication to Secure Your App in MINUTES. I will do it using the Web Filters to handle both JWT requests and credentials requests.

Content:
* Added the Spring Security 6 dependency and a JWT library
* Created a JWT Web Filter to handle the JWT in the HTTP Authorization header to authenticate the requests
* Created a Username and Password Web Filter to handle the login with credentials from the user
* Created a provider to create and validate the JWT
* Created the Spring Security 6 configuration to protect some routes and add the filters.

[michaelalozano]

Straight to the point and well explained. Great job!

[joanjanku]

Very useful video. Thank you. Short, concise, very well explained, simple and quite useful.

[ІО-АндрійЛисак]

Great explanation of the Spring Security authentication. Helped a lot, thank you

[jacup]

It was a nice tutorial, but I keep seeing the same mistake over and over from multiple people. Amigoscode did the same thing as you did. The whole point of using JWT token is that you do NOT check against your database. That is literally the most important advantage in comparison to cookie / sessionID. You should have all the relevant information within token itself.
The only exception to this rule is if you actually want to create or modify resource in your application and you need to make sure that the user still exists in the DB. And even in that case, that logic should be part of the controller/service that handles creation/modification of the resource. But if you just want to make sure your user is valid, the token should be all you need. If it is not, then you should reconsider whether the JWT token authentication is the best approach for your use case.
But otherwise great tutorial. Thanks for that :)

[paolofrancescosciammarella]

Thanks Sergio!
Great explanation and very simple code flow!
Very useful!

[szopsop]

Awesome work! This code is so easy to read. Great stuff. Thank you!

[marouaniAymen]

Thanks for the video, I think there is a missing point which is that the REST API communication is in clear HTTP, using HTTPS will protect our login object sent in the request body.

[CeratiGilmour]

Tendrás un ejemplo con el algoritmo RS256 (llaves publicas y privadas)?

[abndev.]

Thanks sound good, but looks like "Hello world".
What about improving it?

How?

1-hour expiration is too long, what if we want
1> around 10 minutes expiration time (5, 7, 10, 15)
2> each time authenticated user invokes any authenticated page - his expiration time should be renewed by this now() moment
3> next request should use new (updated) JWT.

[Fernando-mgrx]

So for credit cards or any sensitive data which would be the way to send it to the backend?

[Jux]

Why write this by hand, doesn't Spring Security provide this out of the box?
Creating custom filters and jwt tokens, etc

[Lars]

Hi man..how do you invalidate the jwt token anyway?

[AhmedZahranDEV]

does we need another endpoint for refresh token ?

[federicoo]

Tenes otro canal en español o solo este?