Spring Security JWT: How to secure your Spring Boot REST APIs with JSON Web Tokens

In this tutorial, you are going to learn how to secure your Spring Boot REST APIs using JSON Web Tokens (JWT) with Spring Security.
🔗Resources & Links mentioned in this video:
Blog Post: www.danvega.de...
WebSercurityConfigurerAdapter: • Spring Security withou...
👋🏻Connect with me:
Website: www.danvega.dev
Twitter: / therealdanvega
Github: github.com/dan...
LinkedIn: / danvega
Newsletter: www.danvega/de...
SUBSCRIBE TO MY CHANNEL: bit.ly/2re4GH0 ❤️

[@ParnianAndIlian]

Hi Dan, This is the tutorial that was missing in 2022. Thanks a lot. I was struggling with those outdated tutorials and dependencies to make a working solution. this saved me lots of time. Looking forward to your next videos.

[@Scorpion2321-o9o]

Same, Docs mentioned some stuff that are new but honestly Spring Boot Docs is not for Beginner.

[@kaatlev]

These videos are so concise and easy to follow, appreciate you.

[@DanVega]

That makes me so happy. Thank you ☺️

[@petrophilip2279]

This is a great tutorial. You have a way of explaining complex topics in simple terms. I have subbed to your channel.

[@voiceofeverything]

Great video. This is like the only one guide about this topic that is quite easy to follow and does not break your spirit (I have tried to follow like 2 different videos just to realize half way into 3 hour videos that implementation was changed/got deprecated and I wasted my time).

[@kozi-corner]

Thank you so much..I was just working on a project and had a lot of difficulties understanding JWT, I opened youtube and I found your video. How lucky I am!

[@DanVega]

Thank you Abdelhamid. I hope this clears it up for you.

[@rajmohanparayil]

Wow. Learned a lot of very relevant security implementation in a very smooth and clean fashion and in such a short time.

[@DanVega]

Glad you liked it!

[@jy241]

Thanks for the great video!! It helped me a lot!!!!

[@SchefenBaba]

Thanks a lot for this tutorial. I have been stuck in other tutorials for hours.

[@brethagen7776]

Straight to the point, no fluff. Looks looks like a bare-minimum implementation.

[@rafijlouis2432]

Hi Dan, I love the way you explain and it’s much better than a lot of tutorials i have gone through. I have searched in udemy for a springboot course by you but i see it’s outdated. It would be wonderful if you could create a new course or atleast a series of videos of spring topics. Thank you.

[@luisferdev]

thank you Dan, this video help me a lot to understand how to generate JWT in Spring. the only one site where I found the explanation with the new version of spring security and works. regards from Colombia

[@DanVega]

Thank you! I'm glad my videos are helping.

[@kasimgul]

Thank you for this, Dan. I would love to see a follow up video for implementing "Refresh Token" on top of this :) I know people will love it.

[@DanVega]

Thank you for the suggestion, it's already on the backlog. github.com/danvega/office-hours/discussions/27

[@bobgner]

Thank you for making this tutorial. As you mentioned in the beginning there are so many more complicated ways of doing out there because the are not using what is built in to Spring Security. I unfortunately had used one of those more complicated ways so now I'm going to use what I learned in your tutorial to simplify my project code!

[@DanVega]

Thank you Bob. Glad I could help out.

[@GiftNestah]

Just what I needed after struggling with an issue whereby a single user's token expiry invalidates all other users' valid tokens leading to error 403 even for authenticated users. Thanks a lot for this 💯💯

[@drbulltrader9107]

I really appreciated this video. Wishes your channel get bigger n bigger.

[@Learn_with_cosmos]

I am a nodejs and Golang API. I found this tutorial very help for my current work using Spring-boot. One thing about Spring-boot is that, when you use Spring-Boot with higher version some errors like this shows up: This error occurs in the NimbusJwtDecoder.validateJwt method of the org.springframework.security.oauth2.jwt.NimbusJwtDecoder class. The NimbusJwtDecoder class is used to decode JSON Web Tokens (JWTs) and is part of the Spring Security OAuth 2.0 framework.

[@fabricio.entringer]

Hello @Dan, it's amazing! Great video. Please keep producing videos regarding Spring Security, I think it's a black hole in the Spring modules. A lot of specific concepts and it deserves good videos with good explanations like yours. Congratulation and thanks for sharing the content.

[@rbelatamas]

thank you so much ❤

[@robertinnoelson6378]

Awesome Dan! Thanks for the rich tutorial

[@AleksandarT10]

Great video! Really helpful to get people started with latest Spring Security stuff and JWT! Few questions/comments though: 1. It would be good if you can extend the github repo and add a branch which shows the symmetric key approach - i guess it would be easy for the Decoder as u mentioned, but would like to see how to change the Encoder 2. Maybe to make it more realistic instead of HttpBasic - it would be good to have a UserNamePassword Authentication where the user calls an endpoint with username/password as body and the token generation happens based on that 3. Building on top of 2), it would be great if this gets connected to a database where hashing + salting is used as this can be used as a starter for real projects 4. Having roles in the example/video would be great Looking forward to your next video Dan!

[@DanVega]

Great suggestions. Thank you Aleksander

[@lukamaletic9557]

Is there any tutorial that would build on top of this I need the DB connection for users...

[@NARESHBHADKE]

@@lukamaletic9557 You could inject UserDetailsService in SecurityConfig rather than InMemoryUserDetails @Bean public UserDetailsService userDetailsService() { return username -> userRepository .findByUsername(username) .orElseThrow(() -> new UsernameNotFoundException("user not found")); }

[@franciskinyuru3459]

Great video my start to spring security wouldn't have been great without this. A big salute.

[@temptrue3322]

top quality content. very infomative

[@benizraadacudao3020]

Thanks for this Dan.

[@DanVega]

You’re welcome Ben.

[@Justsomeguy492]

finally up to date spring security tutorial :) very good explanation

[@monjurmorshed2854]

U have a nice way to explain, great work!!!

[@DanVega]

I appreciate that Monjur. I make videos that I would enjoy watching and I’m glad others are learning from them as well.

[@rajansonvane488]

Wonderful. Very helpful. Thanks for sharing!!

[@DanVega]

Glad it was helpful!

[@SD-gw5vm]

Thanks for sharing this. I used your example to solve a problem I was working on and it worked. You are a lifesaver

[@sharifyy]

I really enjoyed this video. Thank you for providing such great content.

[@leonzer8257]

Thank you very much! Greetings from Greece!!!

[@DanVega]

You are welcome!

[@intellopitt]

Amazing, how simple it is when explained by experts. Thanks for the great content. Well explained, with the right level of details to understand without getting overwhelmed. I still have to review the blog post if I am not missing any details. Looking forward for the next video :)

[@midewestmond9442]

Nice video you just earn a subscriber I actually love the fact you don't define another class just to write another method like other youtubers do

[@DanVega]

Thanks for the sub!

[@bejobarokah3485]

Thank you for the tutorial

[@DanVega]

You’re welcome 😊

[@rizkysiregar]

Thanks for sharing dan !

[@sajisanjoris2759]

Thank you Dan! Great work!

[@jirivrba3800]

Thanks Dan, really educative content that's very well and clearly presented. Exactly what I was looking for!

[@DanVega]

Thank you, glad I could help out.

[@aayush481]

Hi Dan, can you also please talk about how spring mvc works internally, like dispatcher servlet, how by default exceptions are handled in rest apis etc.

[@toan1nguyen674]

Thanks for asymmetric rsakeys knowledge you've shared.

[@alexanderkazeev3729]

Thanks for a great tutorial. The article is very useful and helpful.

[@fjspitz]

Nice tutorial Dan! Thanks a lot.

[@rahanimhand6895]

Amazing !!!! Great video, Thanks 👌

[@kyriakosmandalas2121]

Great tutorial and topic. Really clears things out. Would be great to show next how to update JWT to include user's roles and permissions. And of course looking forward for Spring Authorization server!

[@DanVega]

I actually set the authority and I believe in the repo there is an example of checking for it at the method level. If there isn’t let me know (I’m away from my computer at the moment)

[@marekj3759]

Very good video, if anybody haven't mentioned yet, it would be good to replace inMemory user with UserDetailsService on data base. Additionally securing rest api with roles. Video would be a bit longer than 1hours, but woud cover topic from A to Z

[@behzadfazelasl9581]

Thanks Dan. it was crystal clear

[@EduardoSilva-us1jp]

Amazing. I used to secure my smalls projects implementing jwt encoder/decoder with the help of libraries like jjwt directly, as well as overriding filter methods from classes/interfaces such as UsernamePasswordAuthenticationFilter, OncePerRequestFilter. But this way you showed us has simplified it a lot. One more subscriber!

[@DanVega]

Fantastic! Glad I could help out.

[@mrkostya008]

finally, an informative tutorial that ACTUALLY uses BUILTIN jwt tools, and not some filters and JwtUtility classes to secure an app

[@arnaudpoutieu1331]

Many thanks, Dan. Your content is quite valuable for someone like me harnessing input to get better at building Enterprise grade applications. Merci beaucoup!!!

[@DanVega]

I appreciate the kind words Arnaud.

[@alexgutjahr]

I'm guilty of rolling up my custom solution, pulling in a third party library. Thanks for this video, Dan! Gotta refactor a bit!

[@DanVega]

Thanks Alex. Hope the refactor goes smooth.

[@IvanRandomDude]

For some reason 99% of tutorials and guides on the internet use that approach instead of resource server.

[@tipswithnna6670]

Thanks for sharing about JWT

[@mdziakhan5950]

Great Explanation

[@samahmahdi5511]

Thanks a lot, can you create new video for spring boot 3

[@arlekino65]

Thank you Dan. I meant A LOT! Would you consider to create a video for those like me with a title "How to read Spring documentation and connect things together"? Lol. Thanks again!

[@neerajagrawal3211]

Great information. I think a simple video will also be helpful which explains how to protect API using Okta or Keycloak since in most situations you don’t write authorization server yourself.

[@mvlad7402]

Excellent video! Need to test spring security with Ping Federate.

[@gamires]

Excellent! Thank you.

[@svalyavasvalyava9867]

wonderful tutorial, thank toy very much 😊

[@dekeyserwilly]

Thanks, very nice explaind.

[@DanVega]

Thank you!

[@davidaskatra4140]

You are great man

[@DanVega]

Thank you, David!

[@m_jdm357]

Everything works great!

[@pavanramagouni6709]

Thank you Dan. nicely explained and Really helpful.

[@DanVega]

Glad you enjoyed it!

[@starterdev]

Thanks for the video ❤

[@WilliamEk-m4v]

First, thank you for such a comprehensive explanation of the new spring security. I'm going to take minor issue with it because, as with just about every tutorial I've seen for spring boot security, the user logon and Jwt generation is in the same sever as the Jwt consumer for endpoint security. This would never happen in the wild and creates confusion as to which SecurityConfig configurations are needed for each.

[@alx1024]

Hi! Great video, like all your videos! Especially now that Spring Security 6 is mixed in with older tutorials on the web this is very helpful. A suggestion: this is now already deprecated: ".oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)" and has to be replaced with ".oauth2ResourceServer((oauth2) -> oauth2.jwt(Customizer.withDefaults())". Also a question, how do you get this snippet-functionality at 30:00?

[@rohitbhandari1873]

can't fix it even using Customizer.withDefaults();

[@fahrican9719]

great tutorial thanks!

[@mehlulinokwara3841]

Very good take there.

[@szalaytamas3184]

your outro music is so good

[@paulo__vieira]

For me as a complete beginner it was so easy to follow. Thanks for this tutorial, it was really helpful.

[@DanVega]

You're very welcome!

[@lts8683]

Thanks you. Can please explain also keycloak with spring.

[@jeanaimeravomanana9545]

Great content, really helpful thank you

[@SigmaLearningCenter]

Amazing, thanks a lot!

[@alibaba40thvs]

Thanks a lot Dan!

[@alibaba40thvs]

Guys take a look at its RFC they have a nice diagrammatic brief of these terms such as Resource Owner, Authorization Server, Resource Server, and Client

[@maxjustmax521]

amazing as usual !

[@DanVega]

Thank you my friend 🙏

[@menabebawy390]

I super like your video, I have learned a lot form it

[@sakthinivas1840]

Hi Dan, really a good video. One functionality which could be added is adding refresh token feature, thanks

[@AntonioCabralNumberOne]

Hi Dan. Since we're already on Spring Boot 3.2+ would you mind an update video on this matter? Keep up the good work!

[@illyam689]

awesome video! subscribed!

[@DanVega]

Thanks for the sub!

[@x2TruNation]

Hey Dan, New question, obviously us as viewers are following along and just basically copying the code that you write down - but you seem to know exactly what we need and why we need it. Are there any resources you can point me to that could potentially help me understand the architecture of spring security in more detail but also how you learned this to a point where you just know what you need to use? Bit of a loaded question, but i’m keen to learn as much as possible. Right now all it feels like is that i’m copying code from you without truly understanding why we’re doing certain things. Cheers

[@mohamedibrahim1836]

Also to use the authorization as a micro service and export it, import it in multiple application across the company portfolio for a aligned one platform!

[@bartomiejdziadosz8616]

That was great! What about video about OAuth2 with Auth/Resource/Client?

[@pabloc1519]

THANK YOU THANK YOU!!!!

[@НикитаПосмак]

Thank you Dan, it's a greate tutorial for beginners. Can you please make a guide about refreshing jwt please.

[@DanVega]

Noted! I have this suggestion here github.com/danvega/office-hours/discussions/27

[@edwardm4348]

Great video! You make it so easy to grasp the concept. A quick question. How would you secure the APIs using JWT if the application is using (username & password) in some cases and also biometrics authentication in other cases.

[@samirmezhoud1851]

Thank you Dan! It is a great video. I wood like if you can provide a video showing how to consume these API from an other Spring boot Web application using Feign client how with JWT (aut he ti cation for the web app is throw the same api )

[@DanVega]

Thank you for the suggestion. I have added it to my content idea list github.com/danvega/office-hours/discussions/29

[@samirmezhoud1851]

@@DanVega thank you

[@EazzyWizzi]

Great Video, keep up the good work

[@DanVega]

Thanks, will do!

[@chanchhaya]

Thank you teacher

[@davypaterne]

great video very useful

[@TheGuroguro12]

thank you very much !!! this is bread and butter even honey. if anybody wondering how to configure http basic to be used only for /token and all other endpoints with bearer check Den Vega -> how to create multiple spring security multiple configuration

[@DanVega]

You are welcome!

[@dodgechallenger5606]

Perfect video. Thank you, Dan! Like+Sub

[@amirhosseinbayat9657]

Hey Dan, it's amazing, but is there any mechanism in order the user logged out of the system, how we can invalidate the user token?

[@youssouphafaye1710]

hello great video btw can you do a video on opaque token that are stock in database

[@shariqshaikh5715]

Thank you so much for such a great Video Dan, One suggestion I would give is Please try to make video a little more short I know you are videos are so helpful but they can be a little more concise

[@DanVega]

Thanks for the tip!

[@sunhsiang6644]

Good video It's really useful🥰🥰!

[@DamLee88]

a video on keycloak and SSo auth? thank you! good video

[@DanVega]

Thank you for the suggestions.

[@lilinh9631]

Hey! Great video! But how did you do to autogenerate code just by typing jwt? Thanks a lot!

[@geeekfa3278]

awesome

[@matyzatka]

hey, this is one great :) ... but for some reason, this error showed up after trying to run the app (26:36) :( Any ideas?:/ We are forced to use Java 8 which does not include records yet.. so I created RsaKeyProperties class instead.. Parameter 0 of constructor in com.greenfoxacademy.springwebapp.config.RsaKeyProperties required a bean of type 'java.security.interfaces.RSAPublicKey' that could not be found. Action: Consider defining a bean of type 'java.security.interfaces.RSAPublicKey' in your configuration.

[@krisztinakover8718]

I have the same problem. What we can use instead of record in java8?

[@alexeybb981]

Try this one @Configuration @ConfigurationProperties(prefix = "rsa") public class RsaKeyProperties { private RSAPublicKey publicKey; private RSAPrivateKey privateKey; public RSAPublicKey getPublicKey() { return publicKey; } public void setPublicKey(RSAPublicKey publicKey) { this.publicKey = publicKey; } public RSAPrivateKey getPrivateKey() { return privateKey; } public void setPrivateKey(RSAPrivateKey privateKey) { this.privateKey = privateKey; } }

[@samueloyekunleoluwafemi4704]

When the jar is run manually, there is a filenotfound exception. How do we handle this?

[@SD-gw5vm]

Are you able to create another video using the other method you mentioned. Where we do not manually create the keys?

[@oreoluwasomuyiwa4049]

Hi, please can you do a tutorial on combining JWT authentication with google's Oauth2 SSO?

[@techystuffs371]

Awesome tutorial as always. I have quick one... When using assymetric encryption do we use the private key to encrypt the data or the public key? With the little knowledge I have on encryption, I'm pretty sure we use the public key for encryption and the private key for decryption.

[@rajibahmed-i2x]

First off awesome video Dan. I have seen no code/logic on the resource server side to validate token. Is this optional on resource server end or its a must.