Let’s Implement Basic JWT Based Authentication in Spring boot
Tags: springboot, java, jwt
Published: 2021-03-10 20:44:57



Step by step guild how to implement JWT Based Authentication, Part 1

![Photo by [NeONBRAND](https://unsplash.com/@neonbrand?utm_source=medium&utm_medium=referral) on [Unsplash](https://unsplash.com?utm_source=medium&utm_medium=referral)](https://cdn-images-1.medium.com/max/10368/0*pOceOpb3NpKDJbxw)

JWT based authentication is very useful when we have web and mobile clients and a backend server, which provides a good alternative to session-based authentication. I did not find a good tutorial on this topic, so I decided to make one.

## Theory

{% medium https://medium.com/@sherryhsu/session-vs-token-based-authentication-11a6c5ac45e4 %}

## Video Tutorial

I found this awesome tutorial for implementing basic JWT based authentication for noobs like me.
{% youtube X80nJ5T7YpE %}
In this tutorial, we will implement basic JWT based authentication, with the mock user and no database, to understand the concept. We will extend it later to integrate database and full signup, login functionalities.

If you just want to check out the code, checkout the Github [branch](https://github.com/webtutsplus/spring-auth-jwt/tree/nilmadhab/basic-jwt-user-hardcode).

Features we will develop

 1. JWT util file to create and validate JWT token

 2. A controller to generate JWT token

 3. User will be hardcoded

 4. No password encoder

**Youtube Demo**

I have created a short video of 7 min, to explain all the component, if you do not have time to watch the full 40 min Javabrains video, or you already know about JWT auth, but do not know how to implement it in spring.
{% youtube p2rqiOd7MHM %}
## Step 1

Create a Spring project with the following dependency in pom.xml
{% gist https://gist.github.com/nilmadhab/4a60c775a8b130590dcf8f12ffcca83c.js %}
## Step 2

Create a custom MyUserDetailsService service, which extend UserDetailsService of security.core package and override the loadUserByUsername by hardcoding an user, for the sake of simplicity.

We will store and retrieve user from the [database ](https://medium.com/hackernoon/top-5-sql-and-database-courses-to-learn-online-48424533ac61)in a later tutorial.
{% gist https://gist.github.com/nilmadhab/c8625d5cbf0d8bb84683a3915ce840bb.js %}
## Step 3

Create a SecurityConfigurer file and enable EnableWebSecurity annotation

Things to note

 1. We did not use any password encoder in this tutorial. We will use **BCrypt encoding** in next tutorial

 2. Antmatcher means except the ‘/authenticate’ endpoint, all other apis will be authenticated

 3. We are using a stateless session creation policy, i.e every api will be authenticated.

 4. we are providing our implementation of Userdetail service to [Spring ](https://medium.com/javarevisited/10-best-spring-framework-books-for-java-developers-360284c37036)AuthenticationManagerBuilder
{% gist https://gist.github.com/nilmadhab/2530d2cf4bacb29adc3bc59a905e4738.js %}
## Step 4

Create the JWT util file to validate and create tokens. Check out the video (forward to 10:00) above to know more about each function.
{% gist https://gist.github.com/nilmadhab/652b0166ff265273dc2f8c8067971a8d.js %}
## Step 5

Create a [filter chain](https://javarevisited.blogspot.com/2021/02/spring-security-interview-questions-answers-java.html#axzz6lIcZ8tnd) to extract the JWT token from Authorization header, validate the token, and set the authentication in a [security contex](https://javarevisited.blogspot.com/2018/02/what-is-securitycontext-and-SecurityContextHolder-Spring-security.html)t.
{% gist https://gist.github.com/nilmadhab/25b84fd2c85fa2941e0d917dfc0ed702.js %}
## Step 6

Create the [controller ](https://javarevisited.blogspot.com/2017/11/difference-between-component-service.html)to test the authentication
{% gist https://gist.github.com/nilmadhab/4b9f889e86e7365028b93a1fd9aaa31f.js %}
![Authenticate](https://cdn-images-1.medium.com/max/4364/1*hWYLUs4-Ghupnu_wUiTcng.png)

![Access an API with JWT token](https://cdn-images-1.medium.com/max/3868/1*e1ifRdOGNsb8Jhaa9V-hpw.png)

In the next tutorial, we will hook this with real users in the [MySQL database](https://medium.com/javarevisited/top-5-courses-to-learn-mysql-in-2020-4ffada70656f) and implement signup/login functionality.

Thanks for reading :)