How to secure REST with Spring Security

The auth filter (TokenAuthenticationFilter.java)

TokenAuthenticationFilter is liable for checking the requests that occur into the secured URLs. The get the job done is performed in Listing 4.

Listing 4. The filter logic

@Override
  public Authentication attemptAuthentication(closing HttpServletRequest ask for,
                                              closing HttpServletResponse response) 
    closing String param = ofNullable(ask for.getHeader(AUTHORIZATION)).orElse(ask for.getParameter("t"))
    closing String token = ofNullable(param).map(price -> removeStart(price, "Bearer"))
      .map(String::trim).orElseThrow(() -> new BadCredentialsException("No Token Observed!"))
    closing Authentication auth = new UsernamePasswordAuthenticationToken(token, token)
    return getAuthenticationManager().authenticate(auth)
  
  @Override
  secured void successfulAuthentication(closing HttpServletRequest ask for,
        closing HttpServletResponse response, closing FilterChain chain,
        closing Authentication authResult) throws IOException, ServletException 
      tremendous.successfulAuthentication(ask for, response, chain, authResult)
      chain.doFilter(ask for, response)
  

Mainly, the filter pulls the token (the just one despatched by the front-stop JS) out of the authorization header. If it’s not there, an exception is elevated. If it’s there, it is handed off to the authentication manager, where it will sooner or later be taken care of by the TokenAuthenticationProvider you just saw in SecurityConfig.

Checking the token (TokenAuthenticationProvider.java)

TokenAuthenticationProvider is in cost of recovering the person based mostly on the auth token. It has just a single process that delegates its get the job done to UserAuthenticationService, as viewed in Listing 5.

Listing 5. TokenAuthenticationProvider.retrieveUser()

@Autowired
UserAuthenticationService auth
//...
@Override
  secured UserDetails retrieveUser(closing String username, closing UsernamePasswordAuthenticationToken authentication) 
    closing Object token = authentication.getCredentials()
    return Optional.ofNullable(token).map(String::valueOf).flatMap(auth::findByToken)
      .orElseThrow(() -> new UsernameNotFoundException("Couldn't obtain person: " + token))
  

If the person is null, an exception is elevated.

UserAuthenticationService.java and TokenAuthenticationService.java

TokenAuthenticationService is the implementation that will be automobile-wired into TokenAuthenticationProvider. It provides the findByToken process utilised to retrieve the person.

TokenAuthenticationService is also where the log-in circulation arrives collectively with the authentication circulation. It offers the login() process utilised by the UserController. Both procedures are viewed in Listing 6.

Listing 6. TokenAuthenticationService procedures

@Autowired
  TokenService tokenService
  @Autowired
  UserService users
  @Override
  public Optional login(closing String username, closing String password) 
    return users
      .findByUsername(username)
      .filter(person -> Objects.equals(password, person.getPassword()))
      .map(person -> tokenService.newToken(ImmutableMap.of("username", username)))
  
  @Override
  public Optional findByToken(closing String token) 
    Technique.out.println("$$$$$$$$$$$$$$$$$$$$ token: " + token)
    return Optional
      .of(tokenService.confirm(token))
      .map(map -> map.get("username"))
      .flatMap(users::findByUsername)
  

Both procedures — findByToken and login — rely on TokenService and UserService. findByToken normally takes a token, then works by using tokenService to confirm its validity. If the token is great, findByToken works by using UserService to get the actual person item.

login does the reverse: It normally takes a person title, grabs the person with userService, verifies that the password matches, then works by using tokenService to create the token.

TokenService.java and JWTTokenService.java

JWTTokenService is the area where the actual JWT token is taken care of. It depends on the JJWT library to do the get the job done, as viewed in Listing seven.

Listing seven. JWTTokenService

JWTTokenService() 
    tremendous()
    this.issuer = requireNonNull("infoworld")
    this.secretKey = BASE64.encode("www.infoworld.com")
  
  public String newToken(closing Map attributes) 
    closing DateTime now = DateTime.now()
    closing Promises claims = Jwts.claims().setIssuer(issuer).setIssuedAt(now.toDate())
    claims.putAll(attributes)
    return Jwts.builder().setClaims(claims).signWith(HS256, secretKey).compressWith(COMPRESSION_CODEC)
      .compact()
  
  @Override
  public Map confirm(closing String token) 
    closing JwtParser parser = Jwts.parser().requireIssuer(issuer).setClock(this).setSigningKey(secretKey)
    return parseClaims(() -> parser.parseClaimsJws(token).getBody())
  
  personal static Map parseClaims(closing Supplier toClaims) 
    test 
      closing Promises claims = toClaims.get()
      closing ImmutableMap.Builder builder = ImmutableMap.builder()
      for (closing Map.Entry e: claims.entrySet()) 
        builder.place(e.getKey(), String.valueOf(e.getValue()))
      
      return builder.establish()
     catch (closing IllegalArgumentException 

The JJWT library will make it quite quick to create, parse, and confirm JWT tokens. The newToken() process works by using Jwts.claims() to set a few of regular claims (issuer and issuedAt) and any other claims handed in as arguments. In the scenario of log-ins, this will have the person title. That suggests the person title is obtainable to deserialize later in the auth approach. At this level, the application could also add other claims like roles or explicit permission types.