asmhatre
4a8dab6739
Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/ - login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end - HS256 and RS256 variants (RS256 publishes a real JWKS endpoint) - the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison - 11 documentation chapters under docs/, interlinked with the code - docs/output/ is real captured output, regenerated by scripts/run-all.sh - 13 passing tests pinning the 401-vs-403 contract and the CSRF failure Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.
64 lines
2.0 KiB
Plaintext
64 lines
2.0 KiB
Plaintext
==========================================================================
|
|
jwt-auth-demo - built-in resource server
|
|
profiles: hs256,resourceserver
|
|
==========================================================================
|
|
|
|
--------------------------------------------------------------------------
|
|
# 1. The filter chain. Note BearerTokenAuthenticationFilter in place of our
|
|
# hand-written JwtAuthenticationFilter - same slot, framework-owned.
|
|
|
|
HTTP 200
|
|
[
|
|
{
|
|
"matchesThisRequest": true,
|
|
"filters": [
|
|
"DisableEncodeUrlFilter",
|
|
"WebAsyncManagerIntegrationFilter",
|
|
"SecurityContextHolderFilter",
|
|
"HeaderWriterFilter",
|
|
"LogoutFilter",
|
|
"OAuth2ProtectedResourceMetadataFilter",
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# 2. Access token -> 200.
|
|
|
|
HTTP 200
|
|
{
|
|
"name": "alice",
|
|
"authorities": [
|
|
"FACTOR_BEARER",
|
|
"ROLE_USER",
|
|
"SCOPE_profile:read"
|
|
],
|
|
"authenticationType": "JwtAuthenticationToken",
|
|
"jti": "5dc2e769-9413-44e4-9bcb-6ab9fe1f6b2e",
|
|
"issuer": "https://jwt-auth-demo.ankurm.com",
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# 3. Non-admin on an admin route -> 403 insufficient_scope.
|
|
|
|
HTTP 403
|
|
WWW-Authenticate: Bearer error="insufficient_scope", error_description="The request requires higher privileges than provided by the access token.", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"
|
|
|
|
--------------------------------------------------------------------------
|
|
# 4. REFRESH token presented as an access token.
|
|
# This is the line to watch when comparing the two runs.
|
|
|
|
HTTP 200
|
|
{
|
|
"name": "alice",
|
|
"authorities": [
|
|
"FACTOR_BEARER"
|
|
],
|
|
"authenticationType": "JwtAuthenticationToken",
|
|
"jti": "8e069702-70a3-4029-89e8-d03c8b3e01ce",
|
|
"issuer": "https://jwt-auth-demo.ankurm.com",
|
|
"audience": [
|
|
"jwt-auth-demo-api"
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# end
|