1. How to implement Spring Security With JWT – Complete Solution

{
"alg": "HS256",
"typ": "JWT"
}

{
  "sub": "1234567890",
  "name": "John Doe",
  "admin": true,
  "iat": 1516239022
}

HMACSHA256(
  base64UrlEncode(header) + "." +
  base64UrlEncode(payload),
  secret)

Covid19-REST-API/
│
├── pom.xml                                   // Maven configuration file
│
├── src
│   ├── main
│   │   ├── java
│   │   │   └── com
│   │   │       └── api
│   │   │           ├── config
│   │   │           │   ├── JwtAuthenticationFilter.java   // Filter for JWT authentication
│   │   │           │   └── SecurityConfig.java            // Configuration for Spring Security
│   │   │           │
│   │   │           ├── constants
│   │   │           │   └── JwtConstant.java               // Constants used for JWT configuration
│   │   │           │
│   │   │           ├── controller
│   │   │           │   ├── AdminController.java           // Controller for admin-specific endpoints
│   │   │           │   ├── AuthController.java            // Controller for authentication endpoints
│   │   │           │   └── UserController.java            // Controller for user-specific endpoints
│   │   │           │
│   │   │           ├── dao
│   │   │           │   └── UserDao.java                   // Data Access Object interface for user operations
│   │   │           │
│   │   │           ├── daoimpl
│   │   │           │   └── UserDaoImpl.java               // Implementation of the UserDao interface
│   │   │           │
│   │   │           ├── entity
│   │   │           │   ├── Role.java                      // Entity representing a user's role
│   │   │           │   └── User.java                      // Entity representing a user
│   │   │           │
│   │   │           ├── model
│   │   │           │   └── JwtResponse.java               // Model representing the JWT response
│   │   │           │
│   │   │           ├── security
│   │   │           │   ├── CustomUserDetail.java          // User details implementation for Spring Security
│   │   │           │   └── CustomUserDetailService.java   // Service for loading user-specific data
│   │   │           │
│   │   │           ├── service
│   │   │           │   └── UserService.java               // Interface for user-related business logic
│   │   │           │
│   │   │           ├── serviceimpl
│   │   │           │   └── UserServiceImpl.java           // Implementation of the UserService interface
│   │   │           │
│   │   │           └── utility
│   │   │               └── JwtUtil.java                   // Utility class for JWT-related operations
│   │   │
│   │   └── resources
│   │       └── application.yml                            // Configuration file for the application
│
└── [Other project files and directories]

<parent>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-parent</artifactId>
		<version>2.5.2</version>
		<relativePath/> <!-- lookup parent from repository -->
	</parent>
	
	<dependencies>
	
	<dependency>
		<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-security</artifactId>
		</dependency>

		<dependency>
			<groupId>io.jsonwebtoken</groupId>
			<artifactId>jjwt</artifactId>
			<version>0.9.1</version>
		</dependency>
		
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-data-jpa</artifactId>
		</dependency>
		
		<dependency>
			<groupId>mysql</groupId>
			<artifactId>mysql-connector-java</artifactId>
			<version>8.0.31</version>
		</dependency>
		
	  <dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-web</artifactId>
		</dependency>
		
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-devtools</artifactId>
			<scope>runtime</scope>
			<optional>true</optional>
		</dependency>
		
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
		
	</dependencies>

server:
  port: 8091
  hostname: localhost

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/covid19?createDatabaseIfNotExist=true
    username: root
    password: root
    driver-class-name: com.mysql.cj.jdbc.Driver

  jpa:
    hibernate:
      ddl-auto: update           # Automatically update the database schema
    properties:
      hibernate:
        dialect: org.hibernate.dialect.MySQL8Dialect   # MySQL 8 dialect
        show_sql: true                          # Show SQL statements in logs

package com.api.config;


@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {

	@Autowired
	private UserDetailsService userDetailsService;

	@Autowired
	private JwtUtil jwtTokenUtil;

	@Override
	protected void doFilterInternal(HttpServletRequest req, HttpServletResponse res, FilterChain chain)
			throws IOException, ServletException {
		String header = req.getHeader(JwtConstatnt.HEADER_STRING);
		String username = null;
		String authToken = null;
		if (header != null && header.startsWith(JwtConstatnt.TOKEN_PREFIX)) {

			// header= Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJyYW0iLCJzY29wZXMiOiJST0xFX0FETUlOIiwiaWF0IjoxNjgxMTEyOTUyLCJleHAiOjE2ODExMzA5NTJ9.SHNB6bgI_HgWFBZyhNnG0nQO7SWvJLfaxmSDAeRkZiw
			// 

			authToken = header.replace(JwtConstatnt.TOKEN_PREFIX, "");
			try {
				username = jwtTokenUtil.getUsernameFromToken(authToken);
				// System.out.println("User from token "+username);
			} catch (IllegalArgumentException e) {
				System.err.println("an error occured during getting username from token");
			} catch (ExpiredJwtException e) {
				System.err.println("the token is expired and not valid anymore");
			} catch (SignatureException e) {
				System.err.println("Authentication Failed. Username or Password not valid.");
			}

			catch (Exception e) {
				 e.printStackTrace();
			}

		} else {
			System.err.println("couldn't find bearer string, will ignore the header ! Logged In With Credientials");
		}
		if (username != null && SecurityContextHolder.getContext().getAuthentication() == null) {

			UserDetails userDetails = userDetailsService.loadUserByUsername(username);

			if (jwtTokenUtil.validateToken(authToken, userDetails)) {
				UsernamePasswordAuthenticationToken authentication = jwtTokenUtil.getAuthentication(authToken,
						SecurityContextHolder.getContext().getAuthentication(), userDetails);
				authentication.setDetails(new WebAuthenticationDetailsSource().buildDetails(req));
				System.err.println("authenticated user " + username + ", setting security context");
				SecurityContextHolder.getContext().setAuthentication(authentication);
			}
		}

		chain.doFilter(req, res);
	}
}

package com.api.config;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

	@Autowired
	public CustomUserDetailService customUserDetilService;

	@Autowired
	private JwtAuthenticationFilter jwtFilter;

	@Override
	protected void configure(AuthenticationManagerBuilder auth) throws Exception {
		auth.userDetailsService(customUserDetilService).passwordEncoder(bCryptPasswordEncoder());
	}

	@Override
	protected void configure(HttpSecurity http) throws Exception {
		http.csrf().disable().authorizeRequests()
		.antMatchers("/auth/**").permitAll()
		.and()
		.authorizeRequests()
		.antMatchers("/admin/**").hasRole("ADMIN") // ADMIN USER
				.antMatchers("/user/**").hasRole("USER") // RECEPTIONIST USER
				
				.anyRequest().authenticated().and().httpBasic();
		http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
	}

	@Override
	public void configure(WebSecurity web) throws Exception {
		web.ignoring().antMatchers("/v2/api-docs", "/configuration/ui", "/swagger-resources/**",
				"/configuration/security", "/webjars/**");
	}

	@Bean
	public BCryptPasswordEncoder bCryptPasswordEncoder() {
		return new BCryptPasswordEncoder(10);
	}

	@Bean
	public AuthenticationManager authenticationManager() throws Exception {
		return super.authenticationManager();
	}

}

package com.api.constants;

public interface JwtConstatnt 
{
	public static final String HEADER_STRING = "Authorization";
	public static final String TOKEN_PREFIX = "Bearer ";
	public static final String SIGNING_KEY = "MyHealthifyApplicationSigningKEY702019272609876654321";
	public static final int ACCESS_TOKEN_VALIDITY_SECONDS = 5*60*60;
	public static final String AUTHORITIES_KEY = "scopes";
}

package com.api.controller;

@RestController
@RequestMapping("/admin")
public class AdminController {
	
	@GetMapping("/get-all-center")
	public ResponseEntity<String> getAllCenter(){
		return new ResponseEntity<String>("Pune Center, Mumbai Center",HttpStatus.OK) ;
			
		
	}

}

////////////////////////////////////////////////////////////////////////////////

package com.api.controller;

@RestController
@RequestMapping("/user")
public class UserController {
	
	@GetMapping("/search-vancine/{name}")
	public ResponseEntity<String> getCenter(){
		return new ResponseEntity<String>("Pune Center",HttpStatus.OK) ;
			
		
	}

}

package com.api.controller;

@RestController
@RequestMapping("/auth")
public class AuthController {

	@Autowired
	UserService userService;
	
	@Autowired
	CustomUserDetailService customUserDetailService;
	
	@Autowired
	JwtUtil jwtUtil;
	
	@Autowired
	private AuthenticationManager authenticationManager;

	// completed
	@PostMapping("/login-user")
	
	public ResponseEntity<?> loginAdmin(@RequestBody User user,HttpServletResponse response) throws AuthenticationException {

			
        final Authentication authentication = authenticationManager.authenticate(
                new UsernamePasswordAuthenticationToken(
                        user.getUsername(),
                        user.getPassword()
              )
        );
        SecurityContextHolder.getContext().setAuthentication(authentication); //check 
        final String token = jwtUtil.generateToken(authentication); 
        response.addHeader("token", token);
       return ResponseEntity.ok(new JwtResponse(token));
    
    }
}

package com.api.serviceimpl;

@Service
public class UserServiceImpl implements UserService {

	@Autowired
	public BCryptPasswordEncoder passwordEncoder;

	@Autowired
	private UserDao dao;

	@Override
	public User loginUser(User user) {

		return dao.loginUser(user);
	}

	@Override
	public CustomUserDetail loadUserByUserId(String userId) {
		return dao.loadUserByUserId(userId);
	}
}

package com.api.daoimpl;

@Repository
public class UserDaoImpl implements UserDao {
	private static Logger LOG = LogManager.getLogger(UserDaoImpl.class);

	@Autowired
	private SessionFactory sf;

	@Autowired
	public PasswordEncoder passwordEncoder;

	@Override
	public User loginUser(User user) {
		Session session = sf.getCurrentSession();
		User usr = null;
		try {
			usr = session.get(User.class, user.getUsername());
			boolean matches = passwordEncoder.matches(user.getPassword(), usr.getPassword());
			if (matches) {
				return usr;
			} else {
				usr = null;
			}
		} catch (Exception e) {
			e.printStackTrace();
		}
		return usr;

	}

	@Override
	public CustomUserDetail loadUserByUserId(String userId) {
		Session session = sf.getCurrentSession();
		CustomUserDetail user = new CustomUserDetail();
		User usr = null;
		try {
			usr = session.get(User.class, userId);
			if (usr != null) {
				user.setUserid(usr.getUsername());
				user.setPassword(usr.getPassword());
				user.setRoles(usr.getRoles());
			}
			System.out.println("load user ..." + user);
		} catch (Exception e) {
			e.printStackTrace();
		}
		return user;
	}
}

package com.api.entity;



/**
 * @author RAM
 */
 
@Entity
public class User {

	@Id
	@Column(name = "UserName",unique = true,nullable = false)
	@Pattern(regexp = "^[a-zA-Z0-9_]{3,20}$", message = "Invalid username format")	
	private String username;

	@NotBlank(message = "First name is manadtory")
	@Column(name = "FirstName",nullable = false)
    @Pattern(regexp = "^[a-zA-Z]+(\\s[a-zA-Z]+)*$", message = "Invalid first name")
	private String firstname;

	@Column(name = "LastName",nullable = false)
    @Pattern(regexp = "^[a-zA-Z]+(\\s[a-zA-Z]+)*$", message = "Invalid last name")
	private String lastname;

	@Column(name = "EmailId", unique = true,nullable = false)
	@NotEmpty(message = "Email should not be empty")
    @Email(message = "Invalid email format")
	private String emailid;

	@Column(name = "Password",nullable = false)
    //@Pattern(regexp = "^(?=.*[a-z])(?=.*[A-Z])(?=.*\\d)(?=.*[@$!%*?&])[A-Za-z\\d@$!%*?&]{8,}$",message = "At least 8 characters long, one uppercase,lowercase,digit,special character")
	private String password;

	@Column(name = "MobileNo", unique = true,nullable = false)
	@Pattern(regexp = "^[0-9]{10}$",message = "Invalid mobile number")
	private String mobileno;

	@Column(name = "Street")
	private String street;

	@Column(name = "City")
	private String city;

	@Column(name = "Pincode")
	private String pincode;

	@Column(name = "Question",nullable = false)
	@NotBlank(message = "Question is manadtory")
	private String Question;

	@Column(name = "Answer",nullable = false)
	@NotBlank(message = "Answer is manadtory")
	private String answer;

	@DateTimeFormat(pattern = "yyyy-MM-dd")
	@JsonFormat(pattern = "yyyy-MM-dd")
	@Column(name = "CreatedDate",nullable = false)
	private Date createdDate;

	@ManyToMany(fetch = FetchType.EAGER)
	@JoinTable(name = "user_role", joinColumns = { @JoinColumn(name = "USER_ID") }, inverseJoinColumns = {
			@JoinColumn(name = "ROLE_ID") })
	private Set<Role> roles;

	public User() {

	}

	// setter & getter
}

package com.api.entity;

@Entity
public class Role {
	@Id
	private int id;
	private String name;
	

	public Role() {
		// TODO Auto-generated constructor stub
	}
// setter & getter
}

package com.api.security;

public class CustomUserDetail implements UserDetails {

	private String userid;
	private String password;

	private Set<Role> roles;

	public CustomUserDetail() {
		// TODO Auto-generated constructor stub
	}

	public CustomUserDetail(String userid, String password, Set<Role> roles) {
		super();
		this.userid = userid;
		this.password = password;
		this.roles = roles;
	}

	public String getUserid() {
		return userid;
	}

	public void setUserid(String userid) {
		this.userid = userid;
	}

	public Set<Role> getRoles() {
		return roles;
	}

	public void setRoles(Set<Role> roles) {
		this.roles = roles;
	}

	public void setPassword(String password) {
		this.password = password;
	}

	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {

		List<SimpleGrantedAuthority> autorities = this.roles.stream()
				.map((role) -> new SimpleGrantedAuthority(role.getName())).collect(Collectors.toList());
		return autorities;

	}

	@Override
	public String getUsername() {
		return this.userid;
	}

	@Override
	public boolean isAccountNonExpired() {
		return true;
	}

	@Override
	public boolean isAccountNonLocked() {
		return true;
	}

	@Override
	public boolean isCredentialsNonExpired() {
		return true;
	}

	@Override
	public boolean isEnabled() {
		return true;
	}

	@Override
	public String getPassword() {
		// TODO Auto-generated method stub
		return this.password;
	}

	@Override
	public String toString() {
		return "CustomUserDetail [userid=" + userid + ", password=" + password + ", roles=" + roles + "]";
	}

}

package com.api.security;

@Service
public class CustomUserDetailService implements UserDetailsService {

	@Autowired
	private UserService service;

	@Override
	public UserDetails loadUserByUsername(String username) throws ResourceNotFoundException {
		// loading user from db
		CustomUserDetail user = service.loadUserByUserId(username);
		if (user != null) {
			return user;
		} else {
			throw new ResourceNotFoundException("User not found with username: " + username);
		}

	}

}

package com.api.utility;

@Component
public class JwtUtil implements Serializable {

	public String getUsernameFromToken(String token) {
        return getClaimFromToken(token, Claims::getSubject);
    }

    public Date getExpirationDateFromToken(String token) {
        return getClaimFromToken(token, Claims::getExpiration);
    }

    public <T> T getClaimFromToken(String token, Function<Claims, T> claimsResolver) {
        final Claims claims = getAllClaimsFromToken(token);
        return claimsResolver.apply(claims);
    }

    private Claims getAllClaimsFromToken(String token) {
        return Jwts.parser()
                .setSigningKey(JwtConstatnt.SIGNING_KEY)
                .parseClaimsJws(token)
                .getBody();
    }

    private Boolean isTokenExpired(String token) {
        final Date expiration = getExpirationDateFromToken(token);
        return expiration.before(new Date());
    }

    public String generateToken(Authentication authentication) {
        final String authorities = authentication.getAuthorities().stream()
                .map(GrantedAuthority::getAuthority)
                .collect(Collectors.joining(","));
        return Jwts.builder()
                .setSubject(authentication.getName())
                .claim(JwtConstatnt.AUTHORITIES_KEY, authorities)
                .signWith(SignatureAlgorithm.HS256, JwtConstatnt.SIGNING_KEY)
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + JwtConstatnt.ACCESS_TOKEN_VALIDITY_SECONDS*1000))
                .compact();
    }

    public Boolean validateToken(String token, UserDetails userDetails) {
        final String username = getUsernameFromToken(token);
        return (
              username.equals(userDetails.getUsername())
                    && !isTokenExpired(token));
    }

    public UsernamePasswordAuthenticationToken getAuthentication(final String token, final Authentication existingAuth, final UserDetails userDetails) {

        final JwtParser jwtParser = Jwts.parser().setSigningKey(JwtConstatnt.SIGNING_KEY);

        final Jws<Claims> claimsJws = jwtParser.parseClaimsJws(token);

        final Claims claims = claimsJws.getBody();

        final Collection<? extends GrantedAuthority> authorities =
                Arrays.stream(claims.get(JwtConstatnt.AUTHORITIES_KEY).toString().split(","))
                        .map(SimpleGrantedAuthority::new)
                        .collect(Collectors.toList());

        return new UsernamePasswordAuthenticationToken(userDetails, "", authorities);
    }

}