$ show hantsy/spring-webmvc-jwt-sample
This repository is a sample Spring Boot application that demonstrates custom JWT token-based authentication for protecting RESTful APIs. It provides a vehicle CRUD API (via both a custom controller and Spring Data REST), a user authentication endpoint (/auth/signin), and a user info endpoint (/me). The architecture follows a standard Spring Boot monolith with Spring Security, Spring Data JPA, and Spring HATEOAS. The custom JWT implementation is encapsulated in a JwtTokenProvider and a JwtTokenAuthenticationFilter, which extract, validate, and set authentication from JWTs. The codebase is modern, using Spring Boot 3.x, Jakarta EE, Java 21, and the latest JJWT library. It includes unit tests, integration tests, and a docker-compose file for PostgreSQL. While the core functionality is straightforward and typical for such samples, the separation of JWT logic into reusable components and the use of Spring Boot 3.x best practices make it a solid reference implementation. It is primarily an application with no data research elements.
The LLM identified 3 files worth highlighting for reuse:
Encapsulates all JWT operations: creating tokens with claims (subject, roles, expiration), parsing/validating tokens, and extracting authentication. Uses HMAC-SHA256 secret key, integrates with Spring Security's Authentication object. Isolated from the rest of the application except for JwtProperties configuration. Can be extracted as a reusable JWT utility library for any Spring Security project.
A GenericFilterBean that intercepts incoming HTTP requests, extracts the JWT token from the Authorization header (Bearer scheme), validates it via JwtTokenProvider, and sets the SecurityContext. Designed as a standalone filter with minimal dependencies (only JwtTokenProvider). Demonstrates a clean pattern for integrating JWT authentication into Spring Security's filter chain.
A @ConfigurationProperties class that binds JWT settings (secret key, validity duration) from application properties. Clean, immutable (via Lombok @Data), and decoupled from the token provider. Can be reused across projects to externalize JWT configuration.