OAuth 2.0 and JWT Authorization in Java: A Step-by-Step Guide for Beginners

Introduction to OAuth 2.0 and JWT in Java

Modern web applications and APIs rarely do without authentication and authorization mechanisms. The two most popular standards in this area are OAuth 2.0 and JWT (JSON Web Token). If you are a beginner Java developer, understanding these technologies will open the door to creating secure and scalable systems.

OAuth 2.0 is an authorization protocol that allows applications to obtain limited access to user resources without sharing their credentials. JWT, in turn, is a compact token format used to transmit claims between parties. In this article, we will break down how to combine these technologies in a Java application using Spring Security and popular libraries.

OAuth 2.0 Basics: How It Works

OAuth 2.0 defines several participant roles in the interaction:

\n
• Resource Owner — the user who owns the protected data
\n
• Client — the application requesting access
\n
• Authorization Server — the server that issues tokens after authentication
\n
• Resource Server — the server hosting the protected resources
\n

The core idea of the protocol is that the client receives a temporary access token, which it presents to the resource server. The most common scenario is the Authorization Code Flow, used in web applications.

Example of Configuring an OAuth 2.0 Client in Spring Boot

Add the dependency to pom.xml:

<dependency>\n    <groupId>org.springframework.boot</groupId>\n    <artifactId>spring-boot-starter-oauth2-client</artifactId>\n</dependency>

Configure application.yml for Google OAuth 2.0:

spring:\n  security:\n    oauth2:\n      client:\n        registration:\n          google:\n            client-id: YOUR_CLIENT_ID\n            client-secret: YOUR_CLIENT_SECRET\n            scope:\n              - email\n              - profile

Now Spring Security will automatically handle the redirect to the Google login page and return an access token.

JWT: Structure and Token Creation

JWT consists of three parts separated by dots:

\n
• Header — contains the token type and signing algorithm (e.g., HS256)
\n
• Payload — contains claims: user data, expiration time, role
\n
• Signature — a signature created from the header and payload using a secret key
\n

To work with JWT in Java, the jjwt library is most commonly used. Add the dependency:

<dependency>\n    <groupId>io.jsonwebtoken</groupId>\n    <artifactId>jjwt-api</artifactId>\n    <version>0.12.5</version>\n</dependency>\n<dependency>\n    <groupId>io.jsonwebtoken</groupId>\n    <artifactId>jjwt-impl</artifactId>\n    <version>0.12.5</version>\n    <scope>runtime</scope>\n</dependency>\n<dependency>\n    <groupId>io.jsonwebtoken</groupId>\n    <artifactId>jjwt-jackson</artifactId>\n    <version>0.12.5</version>\n    <scope>runtime</scope>\n</dependency>

Creating a JWT Token in Java

Here is an example class for generating and validating JWT:

import io.jsonwebtoken.*;\nimport io.jsonwebtoken.security.Keys;\nimport javax.crypto.SecretKey;\nimport java.util.Date;\n\npublic class JwtUtil {\n\n    private final SecretKey secretKey = Keys.hmacShaKeyFor(\n        "my-secret-key-which-should-be-at-least-256-bits-long".getBytes()\n    );\n\n    public St