OAuth 2.0 and JWT Authorization in Java: Step-by-Step Guide

OAuth 2.0 and JWT Authorization in Java: Hands-On

Modern web applications and APIs rarely do without authentication and authorization mechanisms. The two most popular standards — OAuth 2.0 and JWT (JSON Web Token) — allow securely transmitting user data and granting access to resources. In this article, we will break down how to implement OAuth 2.0 and JWT authorization in Java using a practical example with Spring Boot. You will learn how to configure an authorization server, generate and verify JWT tokens, and protect the endpoints of your REST API.

What are OAuth 2.0 and JWT: A Brief Overview

OAuth 2.0 is a delegated access protocol that allows third-party applications to obtain limited access to a user's resources without sharing their credentials. It is widely used for social login (Google, Facebook) and for protecting APIs.

JWT (JSON Web Token) is a compact and self-contained token format that contains user information (claims) and is signed for integrity verification. JWT is often used as an access token in OAuth 2.0 because it requires no server-side storage and is easily transmitted in HTTP headers.

In practice, OAuth 2.0 defines the flow for obtaining a token, while JWT defines the format of the token itself. Together, they form a powerful and secure authorization system.

Setting Up a Spring Boot Project with Dependencies

First, let's create a basic Spring Boot project. We will use Spring Security, Spring Web, and a library for working with JWT (e.g., jjwt).

Add the following dependencies to your pom.xml (Maven) or build.gradle (Gradle):

<!-- Maven -->\n<dependency>\n    <groupId>org.springframework.boot</groupId>\n    <artifactId>spring-boot-starter-security</artifactId>\n</dependency>\n<dependency>\n    <groupId>org.springframework.boot</groupId>\n    <artifactId>spring-boot-starter-web</artifactId>\n</dependency>\n<dependency>\n    <groupId>io.jsonwebtoken</groupId>\n    <artifactId>jjwt-api</artifactId>\n    <version>0.12.3</version>\n</dependency>\n<dependency>\n    <groupId>io.jsonwebtoken</groupId>\n    <artifactId>jjwt-impl</artifactId>\n    <version>0.12.3</version>\n    <scope>runtime</scope>\n</dependency>\n<dependency>\n    <groupId>io.jsonwebtoken</groupId>\n    <artifactId>jjwt-jackson</artifactId>\n    <version>0.12.3</version>\n    <scope>runtime</scope>\n</dependency>

Now let's create a security configuration class that will disable CSRF and define a filter chain.

Implementing the Authorization Server and JWT Generation

For OAuth 2.0, we need an endpoint that will accept client credentials and return a JWT token. In the simplest case, this can be a simulated authorization server.

Let's create a service for working with JWT:

import io.jsonwebtoken.Jwts;\nimport io.jsonwebtoken.SignatureAlgorithm;\nimport io.jsonwebtoken.security.Keys;\nimport org.springframework.stereotype.Service;\n\nimport javax.crypto.SecretKey;\nimport java.util.Date;\n\n@Service\npublic class JwtService {\n\n    private final SecretKey secretKey = Keys.secretKeyFor(SignatureAlgorithm.HS256);\n    private final long expirationMs = 3600000; // 1 hour\n\n    public String generateToken(String username) {\n        Date now = new Date();\n        Date expiryDate = new Date(now.getTime() + expirationMs);\n\n        return Jwts.builder()\n                .subject(username)\n                .issuedAt(now)\n                .expiration(expiryDate)\n                .signWith(secretKey)\n                .compact();\n    }\n\n    public String