asmhatre
4a8dab6739
Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/ - login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end - HS256 and RS256 variants (RS256 publishes a real JWKS endpoint) - the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison - 11 documentation chapters under docs/, interlinked with the code - docs/output/ is real captured output, regenerated by scripts/run-all.sh - 13 passing tests pinning the 401-vs-403 contract and the CSRF failure Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.
41 lines
1.4 KiB
Plaintext
41 lines
1.4 KiB
Plaintext
==========================================================================
|
|
jwt-auth-demo - token expiry and the 60-second clock skew
|
|
profiles: hs256,shortlived (access-token-ttl = 2s)
|
|
==========================================================================
|
|
|
|
--------------------------------------------------------------------------
|
|
# T+0s - fresh token
|
|
|
|
HTTP 200
|
|
{
|
|
"name": "alice",
|
|
"authorities": [
|
|
"FACTOR_BEARER",
|
|
"ROLE_USER",
|
|
"SCOPE_profile:read"
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# T+5s - exp has passed, but JwtTimestampValidator allows 60s of clock skew
|
|
# by default, so the token is STILL accepted. This surprises people
|
|
# who write a test that sleeps past exp and expects a 401.
|
|
|
|
HTTP 200
|
|
{
|
|
"name": "alice",
|
|
"authorities": [
|
|
"FACTOR_BEARER",
|
|
"ROLE_USER",
|
|
"SCOPE_profile:read"
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# T+65s - past exp + the 60s skew window. Now it is refused.
|
|
|
|
HTTP 401
|
|
WWW-Authenticate: Bearer realm="jwt-auth-demo", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Jwt expired at 2026-08-22T06:16:50Z", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:8080/.well-known/oauth-protected-resource"
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# end
|