JSON Web Token (JWT) Authentication in Java

This guide demonstrates how to use JSON Web Token (JWT) to authenticate users in a Java application. Specifically, we'll use JWT to secure APIs in a Spring Boot application, covering token generation, validation, and securing endpoints.

In this article, we will explore how to use JSON Web Token (JWT) for authentication and authorization in Java applications. JWT helps securely authenticate client requests and protect your APIs from unauthorized access. We will be using Spring Boot to build the application and integrate JWT.

Java Code

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.stereotype.Component;

import javax.servlet.http.HttpServletRequest;
import java.util.Date;
import java.util.function.Function;

@Component
public class JwtUtil {

    private String SECRET_KEY = "your_secret_key";

    // Generate JWT from username
    public String generateToken(UserDetails userDetails) {
        return Jwts.builder()
                .setSubject(userDetails.getUsername())
                .setIssuedAt(new Date())
                .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10)) // 10 hours
                .signWith(SignatureAlgorithm.HS256, SECRET_KEY)
                .compact();
    }

    // Extract username from JWT
    public String extractUsername(String token) {
        return extractClaim(token, Claims::getSubject);
    }

    // Extract a claim from JWT
    public <T> T extractClaim(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = extractAllClaims(token);
        return claimsResolver.apply(claims);
    }

    // Extract all claims from JWT
    private Claims extractAllClaims(String token) {
        return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();
    }

    // Check if token is expired
    private Boolean isTokenExpired(String token) {
        return extractExpiration(token).before(new Date());
    }

    // Extract expiration date from JWT
    public Date extractExpiration(String token) {
        return extractClaim(token, Claims::getExpiration);
    }

    // Validate JWT
    public Boolean validateToken(String token, UserDetails userDetails) {
        final String username = extractUsername(token);
        return (username.equals(userDetails.getUsername()) && !isTokenExpired(token));
    }
}

Detailed explanation:

1. import io.jsonwebtoken.*;: JWT library for generating and validating tokens.
2. private String SECRET_KEY = "your_secret_key";: Secret key used for signing the JWT.
3. generateToken: Method to create JWT with a username and expiration time.
4. extractUsername: Extracts the username from the JWT.
5. extractClaim: Retrieves any claim from the JWT based on the provided key.
6. extractAllClaims: Extracts all claims from the JWT.
7. validateToken: Validates if the JWT is valid by checking the username and expiration.

System requirements:

• Java 8 or higher
• Spring Boot
• JSON Web Token library (io.jsonwebtoken:jjwt)

How to install the libraries needed to run the above code:

• Add the following dependency to your Maven pom.xml:

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>

Tips:

• Make sure to use a strong secret key and do not share it with anyone.
• Use HTTPS to protect JWT when transmitting over the network.

---