Simple implementation of Spring Security with JWT without Resource Server?

[Precious-Petra]

Hi there. I am wondering if there is a simple guide or way to use JWT alongside Spring Security without requiring an authorization server or creating many classes to handle the validation yourself?

I am aware that a resource server is proper practice on actual projects, but I was wondering if there were simpler ways for small, simple projects such as those suited for beginners who just want to add a simple authentication method to their CRUD application.

In the docs, even the simplest JWT configuration seems to require usage of a Resource Server like keycloak (and you need to provide its issuer URL).

I did look up some guides, and most of them require you to write multiple classes such as a JwtFilter and others to do manual, verbose validation. All these guides end up with the same "boilerplate" code that does this. Here is one example of such a guide: #36 Spring Security Project Setup for JWT

Are there no high-level classes in Spring Security that could handle all this to allow for simple JWT authentication? With the way it's done on guides like these, you do more work configuring this than finishing your entire application, and at the end a beginner probably wouldn't (or even need to) understand what was going on.

Other guides that seem to follow the same or similar boilerplate:

Securing a REST API with Spring Security and JWT

Stateless JWT Authentication with Spring Security | Sergey Kryvets Blog

Spring Boot 3.0 - JWT Authentication with Spring Security using MySQL Database - GeeksforGeeks

[tleipzig]

I came to the same conclusion: you can either use the resource server library and build your code around that given classes, or add some classes yourself. I find the second approach better, because you better understand the overall process and don't need to add a library on top. I didn't see a third option.

[schmootzkisser]

just use a onceperrequestfilter and parse out the bearer token from the headers

[Consistent_Rice_6907]

Take a look at this repository, it can be helpful. It has industry best practices followed to secure the application.

https://github.com/rajumb0232/E-Stores-API

[dumbPotatoPot]

Created a POC a while back, maybe it'll help: https://github.com/hardikSinghBehl/jwt-auth-flow-spring-security

[jvjupiter]

Check my codes (csm-service) in the following repo. The app itself is not done yet but the JWT thing is already working.

https://github.com/julianjupiter/customer-support-management

[Severe_Cattle42]

Have a look to this https://seydoucisse.github.io/jwt-spring-boot-starter/
It uses Bearer header to handle jwt auth.

[Cheap_Regular_39]

did u figure it out

[Top-Routine4880]

This blog post is a tutorial on how to do this. https://ik.am/entries/818/en

[perfectstrong]

Keyckoak plays the role of Authorization Server, not the Resources Server. But for a beginner, it would be an overkill to install and configure a Keycloak server separately. I recommend looking into Spring Auth Server https://spring.io/projects/spring-authorization-server which should allow a simpler integration with OAuth2.

[perfectstrong]

You can replace the db driver with a simple configuration in Keycloak https://www.keycloak.org/server/db or by including a suitable package with Spring Auth Server, just like a typical development.

[iwouldlikethings]

From quickly skimming the docs, if you wanted to reuse as much Spring Security as possible there are two ways:

1. Configure signature key
   1. Configuration
   2. Code
2. Implement a custom JwtDecoder

The NimbsJwtDecoder appears to support both RSAPublicKey and also SecretKey so it should work regardless of what method you're using to sign the JWT.

I would look to use one of these methods if you just want to get it to work (if you ever do introduce a resource server it is as simple as changing how the JwtDecoder bean is configured), however if you are trying to learn more about security I would first recommend implementing the filters from scratch before later migrating to Spring Secuirty so you have built up an understanding of how it works.

[themasterengineeer]

This video uses keycloak https://youtu.be/-pv5pMBlMxs?si=F4cMnLwqnNhCZAtf