JWT Authentication in Spring Boot

Authorization: Bearer <JWT_TOKEN>

// 1. JWT Utility Class
import io.jsonwebtoken.*;
import java.util.Date;

class JwtUtil {

  private String SECRET = "mysecretkey";

  public String generateToken(String username) {
    return Jwts.builder()
      .setSubject(username)
      .setIssuedAt(new Date())
      .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60))
      .signWith(SignatureAlgorithm.HS256, SECRET)
      .compact();
  }

  public String extractUsername(String token) {
    return Jwts.parser()
      .setSigningKey(SECRET)
      .parseClaimsJws(token)
      .getBody()
      .getSubject();
  }
}

// 2. Authentication Controller
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/auth")
class AuthController {

  private JwtUtil jwtUtil = new JwtUtil();

  @PostMapping("/login")
  public String login(@RequestParam String username) {
    return jwtUtil.generateToken(username);
  }
}

// 3. Secured Controller
@RestController
class UserController {

  @GetMapping("/api/data")
  public String secureData(@RequestHeader("Authorization") String token) {
    return "Access granted with JWT Token";
  }
}

// Output:
// POST /auth/login -> returns JWT token
// GET /api/data -> requires Bearer token

• 1 JSON Web Token for secure communication.
• 2 Stateless authentication mechanism.
• 3 Contains encoded user information.
• 4 Used in REST APIs.

• 1 Header – algorithm and token type.
• 2 Payload – user data and claims.
• 3 Signature – verifies integrity.

• 1 User logs in.
• 2 Server generates JWT.
• 3 Client stores token.
• 4 Token sent in each request.

• 1 Stateless authentication.
• 2 Scalable for microservices.
• 3 No session storage required.
• 4 Secure API communication.

• 1 Used in modern REST APIs.
• 2 Used in microservices authentication.
• 3 Used in mobile backend systems.
• 4 Used in single-page applications (SPA).
• 5 SaaS products use JWT Authentication in Spring Boot in services, dashboards, background jobs, and API workflows.
• 6 ERP and banking systems apply JWT Authentication in Spring Boot with validation, logging, review, and rollback plans.
• 7 E-commerce and healthcare platforms use JWT Authentication in Spring Boot carefully because reliability and data correctness matter.

• 1 A Java program first evaluates the surrounding context, then applies the JWT Authentication in Spring Boot rules to the current data.
• 2 The important mental model is input, transformation, result, and failure path.
• 3 In production, the same flow usually sits inside a larger layer such as a controller, service, repository, job, or UI component.

• 1 Choose the simplest implementation first, then measure real workloads.
• 2 Watch for repeated work inside loops, unnecessary allocations, and slow I/O in hot paths.
• 3 Prefer clear data structures and stable APIs before micro-optimizing syntax.

• 1 Treat external input as untrusted until it is validated.
• 2 Avoid hardcoded secrets and never print sensitive values in examples or logs.
• 3 Use established libraries for authentication, encryption, parsing, and database access.

• 1 Storing JWT in insecure places.
• 2 Using long-lived tokens without expiry.
• 3 Hardcoding secret keys.
• 4 Not validating token signature.
• 5 Skipping the small working example before adding framework code.
• 6 Ignoring null, empty, duplicate, and boundary inputs.
• 7 Mixing business logic, input handling, and output formatting in one place.
• 8 Using broad error handling that hides the real failure.
• 9 Forgetting to test the behavior after refactoring.
• 10 Adding clever code that future maintainers will struggle to read.

• 1 Use strong secret keys.
• 2 Set token expiration time.
• 3 Use HTTPS always.
• 4 Store tokens securely on client side.
• 5 Start with clear requirements and one minimal working example.
• 6 Use meaningful names that explain business intent.
• 7 Keep examples small enough to debug line by line.
• 8 Validate input at every trust boundary.
• 9 Handle errors explicitly and preserve useful context.
• 10 Prefer simple control flow over deeply nested logic.
• 11 Separate domain logic from I/O and framework code.
• 12 Write tests for normal, boundary, and failure cases.
• 13 Review security assumptions before production use.
• 14 Measure performance before optimizing.
• 15 Document non-obvious decisions close to the code or in project notes.
• 16 Use official documentation when behavior is version-specific.
• 17 Keep dependencies current and remove unused code.
• 18 Avoid hardcoded secrets, credentials, and environment-specific paths.
• 19 Log operational events without exposing sensitive data.
• 20 Design examples so learners can safely modify and rerun them.

• 1 Beginner: rewrite the example with different names and values.
• 2 Intermediate: add validation and handle one expected failure case.
• 3 Advanced: place JWT Authentication in Spring Boot inside a small service-style design with tests.

• 1 Build a small Java console feature that demonstrates JWT Authentication in Spring Boot.
• 2 Accept input, process it with the concept, print a clear result, and handle invalid input.
• 3 Add a README note explaining the design choice and two edge cases you tested.

• 1 If the program does not compile, check spelling, imports, braces, and file/class names first.
• 2 If output is unexpected, print intermediate values and verify each branch of the logic.
• 3 If the design feels complex, reduce it to the smallest working example and add pieces back one at a time.

• 1 Practice JWT Authentication in Spring Boot with a second example from a business domain such as inventory, payroll, banking, or e-commerce.
• 2 Review related Java topics that cover data flow, error handling, testing, and clean design.
• 3 Compare your solution with official documentation and simplify anything you cannot explain clearly.