Spring Security JWT Authentication + PostgreSQL – RestAPIs SpringBoot + Spring MVC + Spring JPA
Tags: springboot, springjpa, springmvc, postgres
Published: 2021-04-22 16:30:54

https://grokonez.com/spring-framework/spring-boot/spring-security-jwt-authentication-postgresql-restapis-springboot-spring-mvc-spring-jpa

Spring Security JWT Authentication + PostgreSQL – RestAPIs SpringBoot + Spring MVC + Spring JPA

JSON Web Token defines a compact and self-contained way for securely transmitting information as a JSON object. In the tutorial, we show how to build a SpringBoot Security RestAPIs with JSON Web Token (JWT).

Related posts:
- <a href="https://grokonez.com/spring-framework/spring-security/use-spring-security-jdbc-authentication-postgresql-spring-boot">Spring Security – JDBC Authentication – SpringBoot + PostgreSQL + Bootstrap</a>
- <a href="https://grokonez.com/sql/sql-tutorial-mysql-many-to-many-relationship">SQL Tutorial – MySQL Many-to-Many Relationship</a>
- <a href="https://grokonez.com/spring-framework/spring-data/spring-jpa-many-to-many">Spring JPA Hibernate Many to Many – SpringBoot + PostgreSQL</a>

<div class="jsa-attract-box">
<a href="https://grokonez.com/spring-framework/spring-boot/spring-boot-spring-security-jwt-authentication-architecture-tutorial">Spring Security – JWT Authentication Architecture | Spring Boot</a>
</div>

<!--more-->
<h2>Technologies</h2>
- Spring Boot
- jjwt - 0.9.0
- Spring Security
- Spring JPA
- PostgreSQL
<h2>JSON Web Token</h2>
JSON Web Token (JWT) defines a compact and self-contained way for securely transmitting information between parties as a JSON object. 

Scenarios where JSON Web Tokens are useful:
<ul>
<li><strong>Authorization</strong>: the most common scenario for using JWT. Single Sign On is a feature that widely uses JWT</li>
<li><strong>Information Exchange</strong>: Because JWTs can be signed, JSON Web Tokens are a good way of securely transmitting information between parties.</li>
</ul>

JSON Web Tokens consist of 3 parts:
<ul>
<li>Header</li>
<li>Payload</li>
<li>Signature</li>
</ul>

-> <code>JWT</code> looks like <code>Header-Base64-String.Payload-Base64-String.Signature-Base64-String</code>

<strong>Header</strong>	consists of two parts: 
<ul>
<li>token type.</li>
<li>hashing algorithm.</li>
</ul>

-> Example: 

<pre><code class="language-javascript">{
  "alg": "HS256",
  "typ": "JWT"
}</code></pre>

<strong>Payload</strong> contains the claims. Claims are statements about an entity and additional information. 
There are 3 types of claims ->

<ul>
<li><code>Registered claims</code> -> These are a set of predefined claims: <code>iss</code> (issuer), <code>exp</code> (expiration time), <code>sub</code> (subject)</li>
<li><code>Public claims</code></li>
<li><code>Private claims</code></li>
</ul>

Example ->

<pre><code class="language-javascript">{
  "sub": "thomasgkz",
  "iat": 1537603195,
  "exp": 1537689595
}</code></pre>

<strong>Signature</strong> -> To create the signature part you have to take the encoded header, the encoded payload, a secret, the algorithm specified in the header, and sign that.

Example ->

<pre><code class="language-javascript">
HMACSHA512(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  your-256-bit-secret
)
</code></pre>

Combine all together, we get 3 Base64-URL strings separated by dots,

-> Example:

https://grokonez.com/spring-framework/spring-boot/spring-security-jwt-authentication-postgresql-restapis-springboot-spring-mvc-spring-jpa

Spring Security JWT Authentication + PostgreSQL – RestAPIs SpringBoot + Spring MVC + Spring JPA