✨ feat(auth): add JWT authentication filter and utilities ( JWT authentication #12 )

[rlevidev]

JWT Authentication Implementation

Overview

This document describes the JWT (JSON Web Token) authentication system implemented for the Spring Boot blog application.

Features

• ✅ Stateless authentication with JWT tokens
• ✅ User roles and authorization
• ✅ Automatic token validation
• ✅ Spring Security integration

Configuration

application.properties

# JWT Configuration
jwt.secret=your-secret-key-here
jwt.expiration=86400000

Dependencies (pom.xml)

<!-- Spring Security -->
<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-core</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<!-- JWT (JJWT) -->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

API Endpoints

Public Endpoints

• POST /login - User authentication
• POST /users/register - User registration

Protected Endpoints

• GET /users/{username} - Requires authentication
• GET /users/all - Requires authentication
• All other endpoints require valid JWT token

Security Components

JwtAuthenticationFilter

• Validates JWT tokens on each request
• Sets authentication context for Spring Security
• Handles token expiration and invalidation

JwtUtils

• Generates signed JWT tokens
• Validates token signatures and expiration
• Extracts user information from tokens

SecurityConfig

• Configures Spring Security for stateless JWT auth
• Defines public vs protected endpoints
• Integrates JWT filter into security chain

UserPrincipal

• Implements Spring Security's UserDetails
• Contains user credentials and authorities
• Created from Firestore User objects

Token Structure

{
  "sub": "username",
  "roles": ["ROLE_USER"],
  "iat": 1638360000,
  "exp": 1638446400
}

Error Handling

Invalid Token

{
  "status": 401,
  "message": "Invalid JWT token"
}

Expired Token

{
  "status": 401,
  "message": "JWT token is expired"
}

Missing Token

{
  "status": 403,
  "message": "Access denied"
}

Best Practices

1. Token Storage: Store tokens securely (localStorage, secure cookies)
2. Token Refresh: Implement refresh token logic for long sessions
3. HTTPS Only: Always use HTTPS in production
4. Token Expiration: Set reasonable expiration times
5. Secret Key: Use strong, environment-specific secrets

Troubleshooting

Common Issues

• 403 Forbidden: Check if token is valid and not expired
• 401 Unauthorized: Verify token format and signature
• Compilation Errors: Ensure all dependencies are included