A JSON Web Token (JWT) is a compact JSON-based token for conveying claims between parties. It can be signed or encrypted. In an OAuth 2 application, a client obtains a JWT access token and sends it to a resource server, which uses the token to authorize API requests. section 8.1 section 8.3
A JWT-based resource server typically performs these checks:
- Reads security claims from the token, including OAuth 2 scopes such as writeIngredients and deleteIngredients. section 8.3
- Matches scopes through authorities such as SCOPE_writeIngredients when protecting POST and DELETE endpoints. section 8.3
- Verifies the token signature with the public key corresponding to the authorization server’s private key. section 8.3
- Rejects requests without a valid token and required scope, returning HTTP 401 for an unauthenticated request. section 8.3
Protecting an ingredients API
A Taco Cloud administrative client requests a JWT through the OAuth 2 authorization code flow. It sends the token as a Bearer token when adding an ingredient. The API accepts the POST request only when the JWT contains the writeIngredients scope; DELETE requests similarly require deleteIngredients. A Spring resource server obtains the verification key from a configured JWK set URL before trusting the token. section 8.1 section 8.3
@Override
protected void configure(HttpSecurity http) throws Exception {
http
...
.and()
.oauth2ResourceServer(oauth2 -> oauth2.jwt())
...
}
Shows the Spring Security configuration that enables JWT processing for the resource server. section 8.3
spring:
security:
oauth2:
resourceserver:
jwt:
jwk-set-uri: http://localhost:9000/oauth2/jwks
Shows the JWK set URL used to obtain the public key for JWT signature verification. section 8.3
