Applying Spring Security using JSON Web Token (JWT)

Authentication and authorization

Let's look at an example to explain this. Assume you have a library with many books. Authentication will provide a key to enter the library; however, authorization will give you permission to take a book. Without a key, you can't even enter the library. Even though you have a key to the library, you will be allowed to take only a few books.

JSON Web Token (JWT)

Spring Security can be applied in many forms, including XML configurations using powerful libraries such as Jason Web Token. As most companies use JWT in their security, we will focus more on JWT-based security than simple Spring Security, which can be configured in XML. JWT tokens are URL-safe and web browser-compatible especially for Single Sign-On (SSO) contexts. JWT has three parts:

• Header
• Payload
• Signature

The header part decides which algorithm should be used to generate the token. While authenticating, the client has to save the JWT, which is returned by the server. Unlike traditional session creation approaches, this process doesn't need to store any cookies on the client side. JWT authentication is stateless as the client state is never saved on a server.

JWT dependency

To use JWT in our application, we may need to use the Maven dependency. The following dependency should be added in the pom.xml file. You can get the Maven dependency from: https://mvnrepository.com/artifact/javax.xml.Bind.

We have used version 2.3.0 of the Maven dependency in our application:

<dependency>

<groupId>javax.xml.bind</groupId>

<artifactId>jaxb-api</artifactId>

<version>2.3.0</version>

</dependency>

Note: As Java 9 doesn't include DataTypeConverter in their bundle, we need to add the preceding configuration to work with DataTypeConverter. We will cover DataTypeConverter in the following section.

Creating a Jason Web Token

To create a token, we have added an abstract method called createToken in our SecurityService interface. This interface will tell the implementing class that it has to create a complete method for createToken. In the createToken method, we will use only the subject and expiry time as these two options are important when creating a token.

At first, we will create an abstract method in the SecurityService interface. The concrete class (whoever implements the SecurityService interface) has to implement the method in their class:

public interface SecurityService {

String createToken(String subject, long ttlMillis);

// other methods

}

In the preceding code, we defined the method for token creation in the interface. SecurityServiceImpl is the concrete class that implements the abstract method of the SecurityService interface by applying the business logic. The following code will explain how JWT will be created by using the subject and expiry time:

private static final String secretKey= "4C8kum4LxyKWYLM78sKdXrzbBjDCFyfX";
@Override
public String createToken(String subject, long ttlMillis) {
if (ttlMillis <= 0) {
throw new RuntimeException("Expiry time must be greater than Zero
:["+ttlMillis+"] ");
}
// The JWT signature algorithm we will be using to sign the token
SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
byte[] apiKeySecretBytes =
DatatypeConverter.parseBase64Binary(secretKey);
Key signingKey = new SecretKeySpec(apiKeySecretBytes,
signatureAlgorithm.getJcaName());
JwtBuilder builder = Jwts.builder()
.setSubject(subject)
.signWith(signatureAlgorithm, signingKey);
long nowMillis = System.currentTimeMillis();
builder.setExpiration(new Date(nowMillis + ttlMillis));
return builder.compact();
}

The preceding code creates the token for the subject. Here, we have hardcoded the secret key "4C8kum4LxyKWYLM78sKdXrzbBjDCFyfX " to simplify the token creation process. If needed, we can keep the secret key inside the properties file to avoid hard code in the Java code.

At first, we verify whether the time is greater than zero. If not, we throw the exception right away. We are using the SHA-256 algorithm as it is used in most applications.

Note: Secure Hash Algorithm (SHA) is a cryptographic hash function. The cryptographic hash is in the text form of a data file. The SHA-256 algorithm generates an almost-unique, fixed-size 256-bit hash. SHA-256 is one of the more reliable hash functions.

We have hardcoded the secret key in this class. We can also store the key in the application.properties file. However to simplify the process, we have hardcoded it:

private static final String secretKey= "4C8kum4LxyKWYLM78sKdXrzbBjDCFyfX";

We are converting the string key to a byte array and then passing it to a Java class, SecretKeySpec, to get a signingKey. This key will be used in the token builder. Also, while creating a signing key, we use JCA, the name of our signature algorithm.

Note: Java Cryptography Architecture (JCA) was introduced by Java to support modern cryptography techniques.

We use the JwtBuilder class to create the token and set the expiration time for it. The following code defines the token creation and expiry time setting option:

JwtBuilder builder = Jwts.builder()

.setSubject(subject)

.signWith(signatureAlgorithm, signingKey);

long nowMillis = System.currentTimeMillis();

builder.setExpiration(new Date(nowMillis + ttlMillis));

We will have to pass time in milliseconds while calling this method as the setExpiration takes only milliseconds.

Finally, we have to call the createToken method in our HomeController. Before calling the method, we will have to autowire the SecurityService as follows:

@Autowired

SecurityService securityService;

The createToken call is coded as follows. We take the subject as the parameter. To simplify the process, we have hardcoded the expiry time as 2 * 1000 * 60 (two minutes).

HomeController.java:

@Autowired

SecurityService securityService;

@ResponseBody

@RequestMapping("/security/generate/token")

public Map<String, Object> generateToken(@RequestParam(value="subject")

String subject){

String token = securityService.createToken(subject, (2 * 1000 * 60));

Map<String, Object> map = new LinkedHashMap<>();

map.put("result", token);

return map;

}

Generating a token

We can test the token by calling the API in a browser or any REST client. By calling this API, we can create a token. This token will be used for user authentication-like purposes. Sample API for creating a token is as follows:

http://localhost:8080/security/generate/token?subject=one

Here we have used one as a subject. We can see the token in the following result. This is how the token will be generated for all the subjects we pass to the API:

{

result:

"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJvbmUiLCJleHAiOjE1MDk5MzY2ODF9.GknKcywiIG4-

R2bRmBOsjomujP0MxZqdawrB8TO3P4"

}

Note: JWT is a string that has three parts, each separated by a dot (.). Each section is base-64 encoded. The first section is the header, which gives a clue about the algorithm used to sign the JWT. The second section is the body, and the final section is the signature.

Getting a subject from a Jason Web Token

So far, we have created a JWT token. Here, we are going to decode the token and get the subject from it. In a future section, we will talk about how to decode and get the subject from the token.

As usual, we have to define the method to get the subject. We will define the getSubject method in SecurityService.

Here, we will create an abstract method called getSubject in the SecurityService interface. Later, we will implement this method in our concrete class:

String getSubject(String token);

In our concrete class, we will implement the getSubject method and add our code in the SecurityServiceImpl class. We can use the following code to get the subject from the token:

@Override

public String getSubject(String token) {

Claims claims = Jwts.parser()

.setSigningKey(DatatypeConverter.parseBase64Binary(secretKey))

.parseClaimsJws(token).getBody();

return claims.getSubject();

}

In the preceding method, we use the Jwts.parser to get the claims. We set a signing key by converting the secret key to binary and then passing it to a parser. Once we get the Claims, we can simply get the subject by calling getSubject.

Finally, we can call the method in our controller and pass the generated token to get the subject. You can check the following code, where the controller is calling the getSubject method and returning the subject in the HomeController.java file:

@ResponseBody

@RequestMapping("/security/get/subject")

public Map<String, Object> getSubject(@RequestParam(value="token") String

token){

String subject = securityService.getSubject(token);

Map<String, Object> map = new LinkedHashMap<>();

map.put("result", subject);

return map;

}

Getting a subject from a token

Previously, we created the code to get the token. Here we will test the method we created previously by calling the get subject API. By calling the REST API, we will get the subject that we passed earlier.

Sample API:

http://localhost:8080/security/get/subject?token=eyJhbGciOiJIUzI1NiJ9.eyJzd

WIiOiJvbmUiLCJleHAiOjE1MDk5MzY2ODF9.GknKcywiI-G4-

R2bRmBOsjomujP0MxZqdawrB8TO3P4

Since we used one as the subject when creating the token by calling the generateToken method, we will get "one" in the getSubject method:

{

result: "one"

}

Note: Usually, we attach the token in the headers; however, to avoid complexity, we have provided the result. Also, we have passed the token as a parameter to get the subject. You may not need to do it the same way in a real application. This is only for demo purposes.

This article is an excerpt from the book Building RESTful Web Services with Spring 5 - Second Edition, written by Raja CSP Raman. This book involves techniques to deal with security in Spring and shows how to implement unit test and integration test strategies. You may also like How to develop RESTful web services in Spring, another tutorial from this book.

Check out other posts on Spring Security:

• Spring Security 3: Tips and Tricks
• Opening up to OpenID with Spring Security
• Migration to Spring Security 3