$ show raphaelDL/spring-webflux-security-jwt
This repository is a historical demo application showcasing JWT-based authentication and authorization in a Spring WebFlux reactive stack. It implements a custom security filter chain that first authenticates via HTTP Basic (returning a signed JWT) and then validates Bearer tokens on protected endpoints. The code uses Spring Boot 2.1.1, Java 8, and the Nimbus JOSE library for JWT signing and verification. The architecture is a simple monolith with in-memory user details and hardcoded secrets, intended for educational purposes rather than production use. The README explicitly states the project has been superseded by a modernized version (Spring Boot 4, Java 21, Spring Security 7) and is kept for historical reference. The code demonstrates key patterns: custom ServerAuthenticationSuccessHandler, functional bearer token converter, and a dummy ReactiveAuthenticationManager for stateless JWT authentication. However, it suffers from significant technical drift (outdated dependencies, Java 8, deprecated APIs) and lacks proper error handling, tests, and configurability.
The LLM identified 3 files worth highlighting for reuse:
A self-contained JWT verifier that parses a signed JWT, checks expiration and signature using Nimbus. It uses reactive Mono and Java Predicates for clean composition. The logic is isolated and could be extracted into a reusable JWT validation utility with minimal changes (e.g., making the secret configurable).
Implements a Function<ServerWebExchange, Mono<Authentication>> that extracts a Bearer token from the Authorization header, verifies it via JWTCustomVerifier, and constructs an Authentication object. This pattern is a clean, testable way to convert HTTP requests into authentication objects in a reactive pipeline. The converter is decoupled from the filter chain and could be reused in other reactive security setups.
A custom ServerAuthenticationSuccessHandler that generates a JWT on successful basic authentication and adds it as a Bearer token in the response header. It demonstrates how to hook into the Spring Security filter chain to issue tokens. While simple, the pattern of overriding the success handler to produce a token is reusable for any stateless authentication flow.