spring-boot-security-jwt

Stateless JWT authentication and authorization patterns for Spring Boot 3.5.x applications, built on Spring Security 6.x and the JJWT 0.12.6 library. The skill walks through the full authentication flow: adding dependencies (the security starter, OAuth2 resource server, and the three JJWT artifacts), configuring JWT properties in application.yml, implementing a JwtService that generates access and refresh tokens and validates them, and building a JwtAuthenticationFilter that extends OncePerRequestFilter to pull a token from the Authorization: Bearer header or an HttpOnly cookie and populate the SecurityContext. A SecurityFilterChain bean wires stateless session management, permitted paths, an authentication provider, and the JWT filter registered before UsernamePasswordAuthenticationFilter. Authentication endpoints for /register, /authenticate, /refresh, and /logout return access and refresh tokens, optionally as cookies. Beyond the basics it covers refresh token rotation and revocation or blacklisting for logout, Bearer versus cookie strategies, and integration with Spring Data JPA and OAuth2 providers for social login with Google or GitHub. Authorization is enforced at the method level with @EnableMethodSecurity and @PreAuthorize expressions supporting role checks (hasRole), permission checks (hasAuthority), domain-object checks (hasPermission), and Spring bean checks. Configuration guidance emphasizes security: the signing secret must be at least 256 bits and never hardcoded, cookies should be HttpOnly and secure in production, and the issuer is validated on every token. Recommended lifetimes are 15 minutes for access tokens and 7 days for refresh tokens, expressed in milliseconds. Use it when securing a REST API or SPA backend with token-based authentication, setting up RBAC or permission-based access control, or adding OAuth2 login. Reference files supply the complete JwtService, the cookie-based filter variant, CORS and logout configuration, full property listings, and Maven and Gradle dependency snippets.