asmhatre
4a8dab6739
Runnable companion for https://ankurm.com/spring-security-7-1-jwt-authentication-guide/ - login -> token issue -> OncePerRequestFilter -> SecurityContext, end to end - HS256 and RS256 variants (RS256 publishes a real JWKS endpoint) - the same API secured by the built-in oauth2ResourceServer().jwt(), for comparison - 11 documentation chapters under docs/, interlinked with the code - docs/output/ is real captured output, regenerated by scripts/run-all.sh - 13 passing tests pinning the 401-vs-403 contract and the CSRF failure Verified against Spring Boot 4.1.1, Spring Security 7.1.1, JDK 25.0.4.1.
84 lines
4.2 KiB
Plaintext
84 lines
4.2 KiB
Plaintext
==========================================================================
|
|
jwt-auth-demo - RS256 variant
|
|
profiles: rs256 (private key signs, public key / JWKS verifies)
|
|
==========================================================================
|
|
|
|
--------------------------------------------------------------------------
|
|
# 1. The public half, published as a JWK Set. No private material here -
|
|
# n and e only. Any number of resource servers can poll this.
|
|
|
|
HTTP 200
|
|
{
|
|
"keys": [
|
|
{
|
|
"kty": "RSA",
|
|
"e": "AQAB",
|
|
"kid": "demo-rsa-2026-08",
|
|
"n": "5NEDQPQW0Gz6iR5-UNl7J7660_Psd5q1f5VamK9KTS9f6YhPPIG8mfi6zWe8XmxxdR_Bd2yaX-v_Wz6MgeFLbBVkRFfve_zVnq4-kgjhn8UaRK1iU0C1j-7SahD73hHqGaOjAlFNro5ygjGAcVL8RGVMxRMy4aaTAm3KB4EdG2hJFxyfCBqtkwsHTM_DXcoFTLTZ2bI-hPhN6uBxk7ykFaCnQ47yrKSM6kn0ul0dp22AK_4mP1SRDnnr3Da5GFhMKtBqy_GgXcJ9WTpxIYhlr8B5modtb5S34900VPScpoXiJdUhghxEpXbb1W_PlpVIElISHzldnwWOogdPncO0zQ"
|
|
}
|
|
]
|
|
}
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# 2. Login. Same endpoint, same request, different signature algorithm.
|
|
|
|
HTTP 200
|
|
{
|
|
"accessToken": "eyJraWQiOiJkZW1vLXJzYS0yMDI2LTA4IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJyb290IiwiYXVkIjoiand0LWF1dGgtZGVtby1hcGkiLCJuYmYiOjE3ODczNzkzOTEsInNjb3BlIjoiYWRtaW46cmVhZCBwcm9maWxlOnJlYWQiLCJyb2xlcyI6WyJBRE1JTiIsIlVTRVIiXSwiaXNzIjoiaHR0cHM6Ly9qd3QtYXV0aC1kZW1vLmFua3VybS5jb20iLCJleHAiOjE3ODczODAyOTEsInRva2VuX3R5cGUiOiJhY2Nlc3MiLCJpYXQiOjE3ODczNzkzOTEsImp0aSI6IjIwZWZiMmRhLTkwYWEtNGZjYy04ZTU1LWI0NjhkNDAxMWUwYSJ9.0sPi-ArszI-wKbMuZes2bUCQbi3b68hyNngUPohzrKhWgYlHThu_JIq6gIFcYhq6qK1UYrL2c2lI6uxflSHjdtl5vRhvOUHlDc63eDtzQFIMnC9-kitwwi_x5pV09IxYBVRo38K5WkD9uiIYnNoAenNLhoAfAV424464oi2X_XtsPlXdrhUjCFl8nLghAZSsDaVvTFW9PKHtWfdJUZht2vcZI54TaNFFQKIjAOjTObAwFg9kkzXzcoNiH3wBYKXe4hy3IRDxi62Zl0-eVA67a-ODGqbsPn3BVMbaaLN8iX3OKZtBAUTpYNQQ9StkBfPds5PrxbL_i9EI-j2GpXzA8Q",
|
|
"refreshToken": "eyJraWQiOiJkZW1vLXJzYS0yMDI2LTA4IiwidHlwIjoiSldUIiwiYWxnIjoiUlMyNTYifQ.eyJzdWIiOiJyb290IiwiYXVkIjoiand0LWF1dGgtZGVtby1hcGkiLCJuYmYiOjE3ODczNzkzOTEsImlzcyI6Imh0dHBzOi8vand0LWF1dGgtZGVtby5hbmt1cm0uY29tIiwiZXhwIjoxNzg3NDA4MTkxLCJ0b2tlbl90eXBlIjoicmVmcmVzaCIsImlhdCI6MTc4NzM3OTM5MSwianRpIjoiMjdiOGVhZmMtMGY1NS00YTQ3LWJlYjMtNjJlZDlkOTFmYzgzIn0.pnT-xsAMa-4a1VdUA3_98dGYD-6A7wYKOGUCdmnWbBL44JT2D159w4LASgAAr41Vd7onzlbCgK-cIXlscLmsDSm3Qo0xTO9VjeLYkmFByfSHM7YnG1ecZCuv6PXcqGvpTY_VT35oou0J5qpAl3pBIbkI9mtlI-mBj4ecnlZAEewki_gatloopkDUhg_5xitCeYZfZhB1nvEyCHcv42hpvGHUDBVtebNo6m7rVSpgr7BfVSyAi057qZR0m0Ddm-oJk252vYIQWu9ZH3QE15bMbP7wKOPHfeX1VfuaaUh_o9EgIEblaW1rD9MhupjokUhd2G5OfEbBA_4EDEIB3SpHWg",
|
|
"tokenType": "Bearer",
|
|
"expiresIn": 900
|
|
}
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# 3. The JOSE header now carries alg=RS256 and the kid that selects the key.
|
|
|
|
{
|
|
"kid": "demo-rsa-2026-08",
|
|
"typ": "JWT",
|
|
"alg": "RS256"
|
|
}
|
|
|
|
--------------------------------------------------------------------------
|
|
# 4. Token length. RS256 signatures are 256 bytes; HS256 signatures are 32.
|
|
|
|
RS256 access token: 758 characters
|
|
signature segment : 343 characters
|
|
|
|
--------------------------------------------------------------------------
|
|
# 5. It works exactly the same from the caller's side.
|
|
|
|
HTTP 200
|
|
{
|
|
"name": "root",
|
|
"authorities": [
|
|
"FACTOR_BEARER",
|
|
"ROLE_ADMIN",
|
|
"ROLE_USER",
|
|
"SCOPE_admin:read",
|
|
"SCOPE_profile:read"
|
|
],
|
|
"authenticationType": "JwtAuthenticationToken",
|
|
"jti": "20efb2da-90aa-4fcc-8e55-b468d4011e0a",
|
|
"issuer": "https://jwt-auth-demo.ankurm.com",
|
|
"audience": [
|
|
"jwt-auth-demo-api"
|
|
],
|
|
"issuedAt": "2026-08-22T06:16:31Z",
|
|
"expiresAt": "2026-08-22T06:31:31Z",
|
|
"algorithm": "RS256",
|
|
"keyId": "demo-rsa-2026-08"
|
|
}
|
|
|
|
|
|
--------------------------------------------------------------------------
|
|
# 6. Tampered payload, original signature -> 401, same as HS256.
|
|
|
|
HTTP 401
|
|
WWW-Authenticate: Bearer realm="jwt-auth-demo", error="invalid_token", error_description="An error occurred while attempting to decode the Jwt: Signed JWT rejected: Invalid signature", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1", resource_metadata="http://localhost:8080/.well-known/oauth-protected-resource"
|
|
|
|
--------------------------------------------------------------------------
|
|
# end
|