How To Build Your Own JWT Authentication With Spring WebFlux And Spring Security

Показать описание

Hey, fam! In this tutorial, I'll demo how to use Spring Boot, Spring WebFlux, *and* Spring Security to build a custom authentication based on JSON Web Tokens (JWT).
Users can sign in using a username and password, and the application will exchange those for a JWT, which can be used to make authenticated requests.

🍃 Grab the code

⚡ Danger Zone ⚡
This code disables some sensitive defaults in Spring Security. Don't just blindly copy the code as is! Make sure you know what you are doing and understand the implications.
Also, if you spot any mistakes or you see me saying the wrong things, call me out for it in the comments!

🙌 *Get in Touch*

🎙 *Gear & Links*

_I may earn a small commission for purchases made through the links above at no additional cost to you._

🍿 *Subscribe*
Want to see more tech tutorials? Subscribe now!

Alex Gutjahr

Рекомендации по теме

Комментарии

Like somebody would said: "Work like a charm" -Thank you a lot Alex!

felipeserrano

Thanks Alex, really educative and well presented content, helped me a lot

jirivrba

Your /login implementation is great♥👍. Whats your opinion about handle /login in different way??. It goes to Manager (to validate username & password) and then going to Provider (to forming jwt). So no need to define /login in controller. That is how I am doing right now but not sure it is good or bad implementation. Because AFAIK in non-webflux security, there is no controller /login needed. So I think it should have same flow with non-webflux.

ridhopratama

Thank you for the amazing job. I also want to see you coding spring webflux security using graphql and explaining how to react when the jwt token expires. Thank you.

ismaild.

@Alex - This is useful to get started. It would be helpful you had covered Oauth2 – Authorization Server, Oauth2 – Resource Server and Oauth2 protected REST resources seperately. If this is too much of asking then ignore :)

guruprashanth_k

Hi Alex.

Thank you so much for such a clear example.

I have some trouble with your code example. When an exception happens while a token is analyzed I receive a 401 HTTP error with the header "WWW-Authorization=Basic realm ...". How can I cause to it to send me the www-autorization=bearer?

borispliss