murraco/spring-boot-jwt

JWT auth service using Spring Boot, Spring Security and MySQL

Hi there 👋

• 🛠️ Software Engineer @Grapevine
• 🌱 Currently improving my Django and Angular skills

✉️ Contact me at [email protected]

spring-boot-jwt's Issues

Can not login after changing password

If I update the password of a user, I can not login again with that user. I'm using the same BCryptPasswordEncoder to update the password which is being used in the signUp request at the time of user creation. Any pointers?

How to access to current logged user in controllers?

How can I get access to current logged user in rest controllers? Now I am injecting Principal principal after that I have to load user using principal.getName() and then I can pass to other services User object.

Is there any better solution to inject current User (object) to any methods?

Clarification using Refresh Token

Hi,

I wonder how to use the refresh token using your example.

Normally using JWT, we get a token to authenticate and already the refresh token which allows us in case of 403 to ask for a new one.

However, according to your example, we need to be authenticated to access the /refresh route which gives us a new valid token.

So I would like to know how the frontend of my application can know when to request a new token via /refresh ?

Because in this case it's impossible to ask for a new token when my frontend intercepts a 403, because the token is already invalid, it's impossible to call the /refresh route.

Thanks
Val'

Needs @EnableWebSecurity?

Without the addition of a @EnableWebSecurity annotation, the WebSecurityConfig class is never called.

spring-boot-jwt/src/main/java/murraco/security/WebSecurityConfig.java

Line 15 in fc19d48

@EnableGlobalMethodSecurity(prePostEnabled = true)

org.springframework.boot:spring-boot-starter-security:2.1.1-RELEASE

Is there any way to hide JwtTokenProvider#validateToken exception info on console?

When comes to token validation error, the console prints out exception info.

murraco.exception.CustomException: Expired or invalid JWT token
        at murraco.security.JwtTokenProvider.validateToken(JwtTokenProvider.java:87) ~[classes/:na]
        at murraco.security.JwtTokenFilter.doFilter(JwtTokenFilter.java:28) ~[classes/:na]
       ...

JwtTokenProvider. 
 public boolean validateToken(String token) {
    try {
      Jwts.parser().setSigningKey(secretKey).parseClaimsJws(token);
      return true;
    } catch (JwtException | IllegalArgumentException e) {
      throw new CustomException("Expired or invalid JWT token", HttpStatus.INTERNAL_SERVER_ERROR);
    }
}

It seems that GlobalExceptionHandlerController never called when doFilter throws an exception.

Suggestion: Reduce server load by decoding token claims

Hello, very nice implementation, got a question/suggestion:

JwtTokenProvider:getAuthentication fetches the user from the DB and constructs the Spring Security auth object.

Couldn't it construct it by decoding the token claims instead, without accessing the DB? Unless I'm not getting something right about the entire process (I understand that could lead to having an auth object based on outdated tokens etc).

AccessDeniedException

Hi,

getting a DeniedException from Swagger doc:

token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJjbGllbnQiLCJhdXRoIjpbeyJhdXRob3JpdHkiOiJST0xFX0NMSUVOVCJ9XSwiaWF0IjoxNjEzNjM2NjAwLCJleHAiOjE2MTM2MzY5MDB9.JKxNcdaHL8tUQ4-s9SBweP6mGXabilHfVbP_dcxJKG4password: username: org.springframework.security.core.userdetails.User@af12f3cb: Username: client; Password: [PROTECTED]; Enabled: true; AccountNonExpired: true; credentialsNonExpired: true; AccountNonLocked: true; Granted Authorities: ROLE_CLIENT2021-02-18 09:23:33.493 WARN 20332 --- [nio-8080-exec-2] .m.m.a.ExceptionHandlerExceptionResolver : Resolved [org.springframework.security.access.AccessDeniedException: AccΦs refusΘ]

Any advice on that ?

Regards

How to obtain refresh token

@murraco How do I obtain a refresh token? I see it mentioned briefly but not sure of how to implement in this auth flow.

Not getting refresh token

Hi,

I tried to consume refresh api with http://localhost:8080/users/refresh with Bearer > Generated code at the time of login

JWT is expiring after each request

Hi Mate,

I tried the code and found that the JWT token is expiring after each request, is there any way to keep it alive ?

Advance Thanks,
Darshan

required a bean of type 'org.springframework.security.authentication.AuthenticationManager' that could not be found.

thanks

This is not standard to not use authController

I checked this repo being good reputation.

But conventionally most the Spring Security is using authController for authentication, and userController for accessing the data.

But all logic crammed in same place is not good practice.

One should always follow convention, because Open Source examples are being used in Live Projects.

Bad credentials

Your code is working fine. I am just altering it to support email-password authentication, but getting Bad credentials error. Any solutions?

It is throwing error at .authenticate step

CORS issue reactjs and axios

hello i get this error when performing a request from axios:

Access to XMLHttpRequest at 'http://localhost:8080/users/signin?username=admin&password=admin' from origin 'http://localhost:3000' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.

ExpiredJwtException

Hi, i tested your code, my problem ist that after tomcat started i have something about 20 sec to test API via Swagger, after ~20 sec i got this: ExpiredJwtException

I dont understand why, because in your code i found: validityInMilliseconds == 1 h.

can you reproduce the problem?

Question about code: Why is clearing the context important?

Hey,

just a quick question on why clearing the context (JwtTokenFilter, 38) is important?!
-> If the token is wrong the authentication won't be set anyway because it will throw an exception, so why do we need to clear the context then?

Update jjwt dependency to the latest version

Any help will be appreciated!

Repo: https://github.com/jwtk/jjwt

Error creating bean with name 'springSecurityFilterChain' defined in class path resource

org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'springSecurityFilterChain' defined in class path resource [org/springframework/security/config/annotation/web/configuration/WebSecurityConfiguration.class]: Bean instantiation via factory method failed; nested exception is org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.IllegalStateException: Can't configure anyRequest after itself
	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:656) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.ConstructorResolver.instantiateUsingFactoryMethod(ConstructorResolver.java:484) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.instantiateUsingFactoryMethod(AbstractAutowireCapableBeanFactory.java:1338) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBeanInstance(AbstractAutowireCapableBeanFactory.java:1177) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:557) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:517) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractBeanFactory.lambda$doGetBean$0(AbstractBeanFactory.java:323) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:222) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:321) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:310) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.DefaultListableBeanFactory.preInstantiateSingletons(DefaultListableBeanFactory.java:879) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.context.support.AbstractApplicationContext.finishBeanFactoryInitialization(AbstractApplicationContext.java:878) ~[spring-context-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:550) ~[spring-context-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:141) ~[spring-boot-2.2.2.RELEASE.jar:2.2.2.RELEASE]
	at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:747) [spring-boot-2.2.2.RELEASE.jar:2.2.2.RELEASE]
	at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:397) [spring-boot-2.2.2.RELEASE.jar:2.2.2.RELEASE]
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:315) [spring-boot-2.2.2.RELEASE.jar:2.2.2.RELEASE]
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1226) [spring-boot-2.2.2.RELEASE.jar:2.2.2.RELEASE]
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1215) [spring-boot-2.2.2.RELEASE.jar:2.2.2.RELEASE]
	at murraco.JwtAuthServiceApp.main(JwtAuthServiceApp.java:24) [classes/:na]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_201]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_201]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_201]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_201]
	at org.springframework.boot.devtools.restart.RestartLauncher.run(RestartLauncher.java:49) [spring-boot-devtools-2.2.2.RELEASE.jar:2.2.2.RELEASE]
Caused by: org.springframework.beans.BeanInstantiationException: Failed to instantiate [javax.servlet.Filter]: Factory method 'springSecurityFilterChain' threw exception; nested exception is java.lang.IllegalStateException: Can't configure anyRequest after itself
	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:185) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.beans.factory.support.ConstructorResolver.instantiate(ConstructorResolver.java:651) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	... 26 common frames omitted
Caused by: java.lang.IllegalStateException: Can't configure anyRequest after itself
	at org.springframework.util.Assert.state(Assert.java:73) ~[spring-core-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	at org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry.anyRequest(AbstractRequestMatcherRegistry.java:74) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.configure(WebSecurityConfigurerAdapter.java:355) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at murraco.security.WebSecurityConfig.configure(WebSecurityConfig.java:50) ~[classes/:na]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.getHttp(WebSecurityConfigurerAdapter.java:231) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:322) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.init(WebSecurityConfigurerAdapter.java:92) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at murraco.security.WebSecurityConfig$$EnhancerBySpringCGLIB$$89f2907b.init(<generated>) ~[classes/:na]
	at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.init(AbstractConfiguredSecurityBuilder.java:370) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder.doBuild(AbstractConfiguredSecurityBuilder.java:324) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.security.config.annotation.AbstractSecurityBuilder.build(AbstractSecurityBuilder.java:41) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration.springSecurityFilterChain(WebSecurityConfiguration.java:104) ~[spring-security-config-5.2.1.RELEASE.jar:5.2.1.RELEASE]
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_201]
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_201]
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_201]
	at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_201]
	at org.springframework.beans.factory.support.SimpleInstantiationStrategy.instantiate(SimpleInstantiationStrategy.java:154) ~[spring-beans-5.2.2.RELEASE.jar:5.2.2.RELEASE]
	... 27 common frames omitted

but when i delete this line , it works, why?

https://github.com/murraco/spring-boot-jwt/blob/master/src/main/java/murraco/security/WebSecurityConfig.java#L50