spring-boot-security-jwt

Add spring-boot-starter-security and the JJWT 0.12.6 artifacts, create a JwtService for token generation and validation, build a JwtAuthenticationFilter extending OncePerRequestFilter, and register it in a SecurityFilterChain bean with stateless session management.

Store refresh tokens in the database with user_id, expiry_date, and revoked flags. On each /refresh call, verify the stored token, revoke it, and issue a new access and refresh token pair so old tokens cannot be reused.

Use HttpOnly cookies for browser clients to protect against XSS token theft, and the Authorization Bearer header for mobile or API clients. In production, set Secure and SameSite=Lax or Strict attributes on cookies.

No, WebSecurityConfigurerAdapter was removed in Spring Security 6.x. You must define SecurityFilterChain beans with the lambda DSL and replace @EnableGlobalMethodSecurity with @EnableMethodSecurity.

Use @SpringBootTest with @AutoConfigureMockMvc and spring-security-test. Verify unauthorized requests return 401, and use @WithMockUser(roles = "ADMIN") to simulate authenticated users with specific roles for authorized endpoint tests.

JWT claims are signed but not encrypted, so never store passwords or PII in them. Keep access token lifetimes short (5-15 minutes), use minimum 256-bit signing keys from environment variables, and validate exp, iss, and aud claims on every request.