Spring Boot Tutorial 0/110 lessons ~6 min read Lesson 41“Production-grade backends”

JWT Authentication

JWT (JSON Web Token) is a signed, self-contained credential the client sends with every request.

Course progress0%

Focus

4 guided sections

Practice signal

Examples included

Career prep

Foundation builder

Introduction

JWT (JSON Web Token) is a signed, self-contained credential the client sends with every request. Stateless, scalable, and ideal for SPAs/mobile + microservices.

Syntax reference

The three parts of a JWT:

bash

header.payload.signature

# decoded payload
{
  "sub": "42",                 # user id
  "email": "ana@acme.com",
  "roles": ["USER", "ADMIN"],
  "iat": 1730000000,           # issued at
  "exp": 1730003600            # expires at (1h)
}

Informative example

Issue + verify with the modern resource-server stack:

# pom.xml
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

# application.yml
spring:
  security:
    oauth2:
      resourceserver:
        jwt:
          issuer-uri: https://auth.acme.com
          # or jwk-set-uri / public-key-location

// Issuing a token (login endpoint)
@Service @RequiredArgsConstructor
public class JwtIssuer {
  private final JwtEncoder encoder;
  public String issue(User u) {
    var claims = JwtClaimsSet.builder()
        .subject(u.getId().toString())
        .claim("roles", u.getRoles())
        .issuedAt(Instant.now())
        .expiresAt(Instant.now().plusSeconds(3600))
        .build();
    return encoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
  }
}

Best practices

Sign with RS256 (asymmetric) — only auth service has the private key.
Short access tokens (15–60 min) + refresh tokens.
Never store JWTs in localStorage in browsers — httpOnly cookies if possible.

Ready to mark this lesson complete?Track your journey across the entire course.