Spring Security 7.1 JWT authentication on Spring Boot 4.1

Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/

- login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end
- HS256 and RS256 variants (RS256 publishes a real JWKS endpoint)
- the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison
- 11 documentation chapters under docs/, interlinked with the code
- docs/output/ is real captured output, regenerated by scripts/run-all.sh
- 13 passing tests pinning the 401-vs-403 contract and the CSRF failure

Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.

docs/output/expiry-and-clock-skew.txt

@@ -0,0 +1,40 @@
+==========================================================================
+ jwt-auth-demo - token expiry and the 60-second clock skew
+ profiles: hs256,shortlived   (access-token-ttl = 2s)
+==========================================================================
+
+--------------------------------------------------------------------------
+# T+0s  - fresh token
+
+HTTP 200
+{
+    "name": "alice",
+    "authorities": [
+        "FACTOR_BEARER",
+        "ROLE_USER",
+        "SCOPE_profile:read"
+
+
+--------------------------------------------------------------------------
+# T+5s  - exp has passed, but JwtTimestampValidator allows 60s of clock skew
+#         by default, so the token is STILL accepted. This surprises people
+#         who write a test that sleeps past exp and expects a 401.
+
+HTTP 200
+{
+    "name": "alice",
+    "authorities": [
+        "FACTOR_BEARER",
+        "ROLE_USER",
+        "SCOPE_profile:read"
+
+
+--------------------------------------------------------------------------
+# T+65s - past exp + the 60s skew window. Now it is refused.
+
+HTTP 401
+WWW-Authenticate: Bearer realm="jwt-auth-demo", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Jwt expired at 2026-08-22T06:16:50Z", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:8080/.well-known/oauth-protected-resource"
+
+
+--------------------------------------------------------------------------
+# end