Learn Spring Security 7 Framework & JWT: The Practical Guide

Create a Spring Boot project with Maven, Java 25, and Spring Boot 4 using Spring Initializr, then import the generated zip into IntelliJ IDEA and explore the basic project structure.

Build REST APIs with Spring Boot by creating user, admin, and welcome controllers and mapping GET requests to /user, /admin, and /welcome.

Add spring security 7 to a spring boot app by including the spring boot starter security dependency, exploring auto-configuration, and securing rest apis with a default login form.

Spring Security verifies credentials or JWT tokens through filter chain and authentication manager, creating an authentication object stored in the security context; invalid credentials block access, enabling authorization.

Learn how Spring Security provides a default user to access rest APIs via form-based or http basic authentication, and customize the default credentials with Spring.Security.user.name and Spring.Security.user.password in application.properties.

Explore basic authentication in Spring Security 7, comparing it with form-based login, and learn to send credentials in request headers to secure rest APIs.

Explore Spring Security's default internal flow: filters intercept requests, credentials are verified by the username password authentication filter and dao authentication provider, with results stored in the security context.

Explore the Spring Security default flow in action, from the authorization filter to the login page and the username password authentication process, including in memory user details and password verification.

Explore how Spring Security auto-configures form-based and HTTP basic authentication by default, and learn to customize with RequestMatchers, PermitAll, and DenyAll for public and protected REST APIs.

Disable form-based login and http basic authentication in a spring boot app, and verify changes by testing secured rest APIs with a browser and postman.

secure rest apis with spring security 7 using in-memory authentication by configuring an in-memory user details manager, adding multiple users, encoding passwords with bcrypt, and enabling http basic authentication.

Learn how authorization works in Spring Security, from authentication and the security context to role-based access control on endpoints, ensuring least-privilege access and forbidden responses when needed.

Explore role-based authorization with Spring Security to secure REST APIs by mapping user and admin roles to specific endpoints, using hasRole/hasAnyRole, request matchers, and public welcome endpoints.

Enable method security in spring security 7 to implement role-based authorization for REST APIs, using pre/post annotations to guard admin and user endpoints.

Learn how password encoding secures logins in Spring Security by converting plain passwords to one-way hashes, using bcrypt with salt, during registration and login verification.

Understand how the authentication manager delegates login requests to providers like dao, jwt, and ldap via the security filter chain, producing a fully authenticated object stored in the security context.

Security Context Holder in Spring Security stores the current authenticated user, their principal and authorities, inside a security context and authentication object, accessible throughout the request lifecycle via thread-local storage.

Configure a Spring Boot app to connect to a MySQL database using the JDBC driver and Spring Data JPA, configure application.properties, then create and connect to users_db.

Create user and role JPA entities and establish a many-to-many relationship with a join table users_roles in a Spring Boot app using MySQL, with fetch type eager and cascade all.

Create Spring Data JPA repositories for user and role entities to enable automatic create, read, update, delete operations, using generic JPA repositories and simple JPA repository implementation with transactional behavior.

Implement a custom user details service to load user data by username or email from database, inject a user repository, and convert roles to granted authorities for Spring Security authentication.

Configure and test database authentication by wiring a custom user detail service into Spring Security, injecting dependencies, encoding passwords, and verifying role-based access.

Trace the database authentication flow in spring security, from the authentication filter converting requests to authentication objects to the DAO authentication provider loading users from the database and verifying passwords.

Explore how Spring Security handles authentication and authorization errors via the exception translation filter, routing 401 and 403 to entry points and handlers, to help customize json error responses.

Learn how to implement a custom authentication entry point in Spring Security 7 to return a proper JSON error response for authentication failures in a REST API.

Implement a custom access denied handler in Spring Security to return a JSON error response for forbidden admin API access. Configure it in security and test with Postman.

builds a signup REST API in spring boot, converting register data to a user entity, assigning roles, and persisting to the database; secures endpoints with Spring Security and password encoding.

Refactor the register rest API to fetch roles from the client and assign them via a set. Leverage user and role entities with a many-to-many relationship for dynamic database authentication.

Implement two validations in the register REST API to prevent duplicate usernames or emails, throwing user not found exception or email already exist exception, and return proper error responses.

Implement a global exception handler for the register rest api, with an error details class, throwing username not found and email already exist exceptions to return 400 bad request.

build a login rest api with spring security, using a login dto and authentication manager to authenticate with username or email and password, paving the way for a jwt token.

Outline the disadvantages of basic authentication and explain why JWT-based token authentication provides a secure, stateless, and scalable alternative.

Explore how a json web token, or jwt, enables stateless authentication with three parts: header, payload, and signature, separated by dots, and issued after login as a bearer token.

Discover how JWT works in a simple flow. Authenticate with credentials to obtain a signed token, then use it in the authorization header for future stateless requests.

Learn to implement JWT token-based authentication in a Spring Boot app by adding dependencies, configuring secret and expiration, and wiring the entry point, token provider, and authentication filter.

Create a jwt token provider in Spring Boot to generate token, extract username, and validate token with a decoded secret key. Bind properties and reuse a private key helper.

Implement a jwt authentication filter to extract and validate tokens, load user details from the database, and set authentication in the security context before the username-password filter.

Create a jwt auth response dto, configure jwt in spring security, and update the login rest api to return a bearer token for client access.