Spring Security 7.1 JWT authentication on Spring Boot 4.1

Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/

- login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end
- HS256 and RS256 variants (RS256 publishes a real JWKS endpoint)
- the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison
- 11 documentation chapters under docs/, interlinked with the code
- docs/output/ is real captured output, regenerated by scripts/run-all.sh
- 13 passing tests pinning the 401-vs-403 contract and the CSRF failure

Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.

scripts/csrf-demo.sh

@@ -0,0 +1,36 @@
+#!/usr/bin/env bash
+# Reproduces the "permitAll() endpoint still returns 403" failure.
+# Requires: --spring.profiles.active=hs256,csrfon
+set -u
+BASE="${1:-http://localhost:8080}"
+show() {
+  local out
+  out=$(curl -sS -D /tmp/.h -o /tmp/.b -w '%{http_code}' "$@")
+  printf 'HTTP %s\n' "$out"
+  grep -iE '^(www-authenticate|content-type):' /tmp/.h | sed 's/\r$//'
+  [ -s /tmp/.b ] && { python3 -m json.tool < /tmp/.b 2>/dev/null || cat /tmp/.b; echo; }
+}
+hr(){ printf '\n%s\n' "--------------------------------------------------------------------------"; }
+
+echo "=========================================================================="
+echo " jwt-auth-demo - CSRF vs permitAll()"
+echo " app started with: --spring.profiles.active=hs256,csrfon"
+echo "=========================================================================="
+
+hr; echo "# A. The login endpoint is permitAll(). POST it anyway."
+echo "#    403 - and nothing in the authorization rules explains why."
+echo
+show -X POST "$BASE/api/auth/login" -H 'Content-Type: application/json' \
+     -d '{"username":"alice","password":"alice-password"}'
+
+hr; echo "# B. GET on the same permitAll() path family works. Only unsafe methods break."
+echo
+show "$BASE/api/public/ping"
+
+hr; echo "# C. The filter chain, with CsrfFilter present. Count the positions:"
+echo "#    CsrfFilter is 5th, AuthorizationFilter is last. The request never"
+echo "#    reaches the filter that knows about permitAll()."
+echo
+show "$BASE/api/public/filters"
+
+hr; echo "# end"