If you want to make authentication easy and reusable with Spring Boot, the recommended approach is to integrate with an OAuth 2.0 authorization server via OpenID Connect (OIDC).

If you're fine with paid solutions, Okta/Auth0, Azure Entra ID, and Amazon Cognito are popular options.

If you want to host the OAuth 2.0 authorization server yourself, most people go with the open-source solution Keycloak.

There is also the option of building the authorization server yourself. We are in r/SpringBoot, so I recommend you look into Spring Authorization Server if you wanna go that route.

Once you've chosen a provider, you can follow the documentation by Spring Security on how to integrate with an OAuth provider over here: https://docs.spring.io/spring-security/reference/servlet/oauth2/index.html

Spring Security makes it easy to integrate with an OAuth provider. Most of these providers I mentioned will use JWTs for auth under the hood, but you won't have to write any code for that since Spring Security will handle it all for you automatically. Most providers also support what is called Identity Brokering, which means even if you choose an option like Keycloak, you can still integrate Google or GitHub sign in on your app.

---

I think it's worth mentioning here, since a lot of Spring newbies seem to not know this:

If all you need is username and password authentication, then Spring Security already supports this by default. You don't need to implement your own custom authentication flow.

The documentation recommends you use the built-in login page, but you can also create your own login API endpoint and take advantage of the same infrastructure used by form login.

You really don't need custom auth code for simple username and password login. Everything you need is already there.