Securing REST APIs with OAuth 2.0 and JWT in Spring Boot

In today's digital landscape, securing your applications is not just an option—it's a necessity. REST APIs serve as the backbone for many applications, and with the rise of cloud computing and mobile apps, ensuring their security is paramount. In this article, we'll explore how to secure REST APIs using OAuth 2.0 and JSON Web Tokens (JWT) in Spring Boot, one of the most popular Java frameworks for building web applications.

Understanding OAuth 2.0 and JWT

What is OAuth 2.0?

OAuth 2.0 is an authorization framework that enables third-party applications to obtain limited access to a web service. It allows users to grant access to their information without sharing their passwords. OAuth 2.0 is widely used in scenarios where secure access delegation is required, such as social logins or API access.

What is JWT?

JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. The claims in a JWT are encoded as a JSON object that is used as the payload of a JSON Web Signature (JWS) structure or as the plaintext of a JSON Web Encryption (JWE) structure. JWTs are often used in authentication and information exchange scenarios because they are stateless and can be easily verified.

Use Cases for OAuth 2.0 and JWT

• Social Login: Allow users to authenticate using their social media accounts.
• Microservices Security: Secure communication between microservices using tokens.
• Mobile Applications: Authenticate users in mobile apps without exposing credentials.

Setting Up Your Spring Boot Project

Step 1: Create a New Spring Boot Project

You can use Spring Initializr (https://start.spring.io/) to create a new Spring Boot project. Select the following dependencies:

• Spring Web
• Spring Security
• Spring Data JPA
• JWT

Step 2: Add Dependencies

In your pom.xml, add the necessary dependencies for Spring Security and JWT:

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Step 3: Configure Spring Security

In your application, you need to configure Spring Security to use JWT for authentication. Create a security configuration class:

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeRequests()
            .antMatchers("/api/auth/**").permitAll()
            .anyRequest().authenticated()
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }
}

Step 4: Implement JWT Utility Class

Create a utility class to manage JWT creation and validation:

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.stereotype.Component;

import java.util.Date;
import java.util.HashMap;
import java.util.Map;

@Component
public class JwtUtil {
    private String SECRET_KEY = "your_secret_key";

    public String generateToken(String username) {
        Map<String, Object> claims = new HashMap<>();
        return createToken(claims, username);
    }

    private String createToken(Map<String, Object> claims, String subject) {
        return Jwts.builder()
                .setClaims(claims)
                .setSubject(subject)
                .setIssuedAt(new Date(System.currentTimeMillis()))
                .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10)) // 10 hours
                .signWith(SignatureAlgorithm.HS256, SECRET_KEY)
                .compact();
    }

    public Boolean validateToken(String token, String username) {
        final String extractedUsername = extractUsername(token);
        return (extractedUsername.equals(username) && !isTokenExpired(token));
    }

    public String extractUsername(String token) {
        return extractAllClaims(token).getSubject();
    }

    private Claims extractAllClaims(String token) {
        return Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();
    }

    private Boolean isTokenExpired(String token) {
        return extractAllClaims(token).getExpiration().before(new Date());
    }
}

Step 5: Create Authentication Controller

Create a controller to handle authentication requests:

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.ResponseEntity;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/api/auth")
public class AuthController {

    @Autowired
    private JwtUtil jwtUtil;

    @PostMapping("/login")
    public ResponseEntity<String> login(@RequestParam String username, @RequestParam String password) {
        // Validate user credentials here
        String token = jwtUtil.generateToken(username);
        return ResponseEntity.ok(token);
    }
}

Testing Your API

Step 6: Testing with Postman

1. Start your Spring Boot application.
2. Open Postman and send a POST request to http://localhost:8080/api/auth/login with the required parameters.
3. You should receive a JWT token in the response.

Step 7: Accessing Secure Endpoints

Now, you can secure other endpoints by adding the JWT token in the Authorization header:

Authorization: Bearer <your_jwt_token>

Conclusion

Securing REST APIs with OAuth 2.0 and JWT in Spring Boot is a powerful approach to ensure that your applications are protected against unauthorized access. By following the steps outlined in this article, you can implement a secure authentication mechanism that enhances the security of your applications. As you continue to develop your Spring Boot applications, consider diving deeper into the complexities of OAuth 2.0 for more robust security features.

Whether you’re building microservices or mobile applications, mastering these security practices will ensure your APIs are not only functional but also secure. Happy coding!