Authentication with JWT

Introduction

A JWT (JSON Web Token) is a signed, base64-encoded JSON blob. It's the standard token format for stateless REST APIs — the server verifies the signature instead of looking the user up in a session store on every request.

Informative example

Issue and verify a token:

import io.jsonwebtoken.*;
import io.jsonwebtoken.security.Keys;
import javax.crypto.SecretKey;

SecretKey key = Keys.hmacShaKeyFor("a-very-long-secret-stored-in-vault!!".getBytes());

// Issue
String jwt = Jwts.builder()
    .subject("user-42")
    .claim("role", "admin")
    .expiration(Date.from(Instant.now().plusSeconds(900)))
    .signWith(key)
    .compact();

// Verify
Claims claims = Jwts.parser()
    .verifyWith(key)
    .build()
    .parseSignedClaims(jwt)
    .getPayload();

System.out.println(claims.getSubject()); // user-42

Best practices

• Short-lived access tokens (≤15 min) + refresh tokens stored httpOnly.
• Sign with a strong secret (≥256-bit) loaded from a secrets manager.
• Reject tokens without an exp claim; check it server-side.
• Use Spring Security to wire JWT validation into the filter chain.

Common mistakes

• Putting passwords or PII in the JWT payload — it's signed, not encrypted.
• Using the none algorithm — it's a notorious bypass.

Purpose of this lesson

Master Authentication with JWT so you can apply it confidently in production Java code, technical interviews, and code reviews.

Step-by-step explanation

1. Understand the core idea behind Authentication with JWT.
2. Walk through the runnable example and tweak it in the playground.
3. Apply the pattern in a small Spring Boot or CLI exercise of your own.
4. Re-read the common mistakes and interview Q&A to lock the concept in.

Interactive workflow diagram

Debugging tips

• Read the full stack trace — Java's exception messages name the offending class and line.
• Reproduce in the smallest possible main() method before fixing in the real app.
• Use IntelliJ's debugger breakpoints and 'Evaluate Expression' rather than scattering System.out.

Optimization strategies

• Profile before optimizing — JFR (Java Flight Recorder) and async-profiler reveal real hotspots.
• Prefer immutable data and stream pipelines over hand-rolled loops when readability matters.
• Reach for the right JDK collection (ArrayList vs LinkedList vs ArrayDeque) before writing custom data structures.

Enterprise example

Teams at Netflix, Uber and Goldman Sachs apply Authentication with JWT daily — usually wrapped behind Spring Boot services with observability hooks (Micrometer + OpenTelemetry).

Interview questions & answers

Summary

In this lesson you learned Authentication with JWT — the concept, syntax, a runnable example, and the production pitfalls to avoid. Apply it in the playground before moving on.