JWT Authentication & Role-Based Access

Why not just use Basic Auth?

Basic Auth (last lesson) sends the username and password with every single request. That is simple but has real downsides: the password travels constantly, the server must check it every time, and there is no easy way to log out or expire access. Modern APIs use tokens instead.

A JWT (JSON Web Token) is a small, signed string the server gives you when you log in. After that, you send the token — not your password — on every request. Signed means the server can verify the token came from it and was not tampered with, so it trusts it without a database lookup.

The JWT flow, step by step

Picture logging into an app and then using it. There are two phases — getting a token, then using it:

1. Login: the client sends username + password once to POST /login.
2. The server checks the password (against the BCrypt hash stored in the database) and, if correct, creates and signs a JWT and returns it.
3. The client stores the token and, from now on, sends it on every request in a header: Authorization: Bearer <token>.
4. On each request, a security filter reads the token, verifies the signature, and identifies the user — no password, no database session needed.
5. If the token is valid and not expired, the request proceeds; otherwise the server returns 401 Unauthorized.

First: never store raw passwords — hash with BCrypt

You must never store a user’s real password. Instead you store a hash: a one-way scramble that cannot be reversed back into the password. BCrypt is the standard hashing algorithm in Spring. At login you hash the entered password and compare hashes.

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();   // the standard hasher
}

// When a user registers — store the HASH, never the raw password:
String hash = passwordEncoder.encode("secret123");
// hash looks like: $2a$10$N9qo8uLOickgx2ZMRZoMy...

// At login — check the entered password against the stored hash:
boolean ok = passwordEncoder.matches("secret123", hash);  // true

Issue a JWT on successful login

When the password checks out, build and sign a token. A small helper (using a JWT library such as jjwt) does this. The token carries the username and an expiry time, signed with a secret key only the server knows:

@RestController
public class AuthController {
    private final JwtService jwt;          // your helper that builds tokens
    private final AuthService auth;        // checks user + BCrypt password

    public AuthController(JwtService jwt, AuthService auth) {
        this.jwt = jwt; this.auth = auth;
    }

    @PostMapping("/login")
    public Map<String, String> login(@RequestBody LoginRequest req) {
        auth.verify(req.getUsername(), req.getPassword());  // throws 401 if wrong
        String token = jwt.createToken(req.getUsername()); // signed, e.g. 1h expiry
        return Map.of("token", token);
    }
}

Send the token on later requests

From now on the client sends the token in the Authorization header. A security filter validates it on every request:

curl http://localhost:8080/products \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJhZG1pbiI..."

Role-based access (RBAC)

RBAC (Role-Based Access Control) means different users can do different things based on their role — e.g. only an ADMIN can delete. In Spring Security 6 you wire this in the security config, restricting paths or methods by role:

@Bean
public SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http
      .csrf(csrf -> csrf.disable())                 // common for token APIs
      .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
      .authorizeHttpRequests(a -> a
        .requestMatchers("/login").permitAll()       // anyone may log in
        .requestMatchers(HttpMethod.GET, "/products").permitAll()
        .requestMatchers(HttpMethod.DELETE, "/products/**").hasRole("ADMIN")
        .anyRequest().authenticated());              // everything else needs a token
    // ... add your JWT filter here ...
    return http.build();
}