{"enrichment":{"faq":[{"a":"spring-boot-security-jwt implements JWT authentication by configuring Spring Security 6.x with a custom SecurityFilterChain that validates Bearer tokens via a OncePerRequestFilter. Use JJWT 0.12.6 to generate tokens during login, extract claims in the filter, and populate the SecurityContext. Configure a JwtProvider bean to handle token creation with expiration, issuer, and audience claims, then validate incoming tokens before granting access to protected endpoints.","q":"How to implement JWT authentication in Spring Boot?"},{"a":"spring-boot-security-jwt supports refresh token rotation by issuing a new refresh token alongside each access token refresh. Store refresh tokens in a database or cache with expiration timestamps and a revocation flag. When a client requests a new access token, validate the refresh token, mark the old one as used, and issue a fresh pair. This prevents token replay attacks and enforces strict token lifecycle management.","q":"What is the refresh token rotation strategy in spring-boot-security-jwt?"},{"a":"spring-boot-security-jwt uses Spring Security's @PreAuthorize annotation with role and permission expressions to enforce RBAC. Define roles (ADMIN, USER) in your User entity, load them via a custom UserDetailsService, and apply @PreAuthorize(\"hasRole('ADMIN')\") on controller methods. For fine-grained control, implement a custom PermissionEvaluator to check resource-level permissions in @PreAuthorize(\"@permissionEvaluator.canAccess(#id)\") expressions.","q":"How does spring-boot-security-jwt configure role-based access control?"},{"a":"spring-boot-security-jwt supports OAuth2 provider integration by configuring Spring Security's OAuth2Login with client registrations for Google, GitHub, or custom providers. Define spring.security.oauth2.client properties with client-id and client-secret, then add a custom OAuth2SuccessHandler to generate JWT tokens after successful provider authentication. This enables stateless SPA backends to authenticate users via social providers while issuing application-specific JWTs.","q":"Can spring-boot-security-jwt integrate OAuth2 social login?"},{"a":"spring-boot-security-jwt secures REST APIs by extracting Bearer tokens from the Authorization header in the JWT filter, or by reading HttpOnly cookies set during login. For SPAs, HttpOnly cookies prevent XSS attacks since JavaScript cannot access them. Configure CORS and SameSite policies in your SecurityFilterChain, and ensure the filter validates token signatures and expiration before granting access to protected resources.","q":"How to secure REST APIs with Bearer tokens or HttpOnly cookies?"},{"a":"spring-boot-security-jwt implements token blacklisting by storing revoked token JTIs (unique identifiers) in Redis or a database during logout. Before granting access, the JWT filter checks if the token's JTI exists in the blacklist; if found, the request is rejected. This enables immediate logout without waiting for token expiration, and supports token revocation scenarios like password changes or permission updates.","q":"What does spring-boot-security-jwt do for token blacklisting?"}],"shadow_tags":["stateless-auth","token-lifecycle","bearer-auth","method-security","oauth-integration","cookie-auth","access-control","token-rotation","key-management","security-hardening"],"summary_rewrite":"Implement stateless JWT authentication in Spring Boot 3.5 applications with Spring Security 6.x and JJWT 0.12.6. This skill covers token generation and validation, Bearer and HttpOnly cookie strategies, refresh token rotation, role and permission-based access control, and OAuth2 provider integration. Use it to secure REST APIs with method-level authorization rules and token revocation patterns."},"files":[{"bytes":15488,"path":"plugins/developer-kit-java/skills/spring-boot-security-jwt/SKILL.md","sha256":"b60091ba42fb1e98c17c65886e7960b12e5759dc8659c025a4f1764b4d9f7571","url":"https://skillfed.io/files/giuseppe-trisciuoglio/developer-kit/spring-boot-security-jwt/143eafd4/SKILL.md"}],"id":"giuseppe-trisciuoglio/developer-kit/spring-boot-security-jwt","links":{"html":"https://skillfed.io/giuseppe-trisciuoglio/developer-kit/spring-boot-security-jwt","md":"https://skillfed.io/giuseppe-trisciuoglio/developer-kit/spring-boot-security-jwt.md","repo":"https://github.com/giuseppe-trisciuoglio/developer-kit"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":37,"language":"Python","last_updated":"2026-06-22","license":"MIT","name":"spring-boot-security-jwt","publisher":"giuseppe-trisciuoglio","stars":311},"relations":{"similar":[{"id":"xu-xiang/everything-claude-code-zh/springboot-security"},{"id":"personamanagmentlayer/pcl/spring-boot-expert"},{"id":"affaan-m/ECC/springboot-security"},{"id":"jabrena/plinth/304-frameworks-spring-boot-security"},{"id":"bobmatnyc/claude-mpm-skills/spring-boot"},{"id":"Jeffallan/claude-skills/java-architect"},{"id":"giuseppe-trisciuoglio/developer-kit/unit-test-security-authorization"},{"id":"pluginagentmarketplace/custom-plugin-java/java-spring-boot"},{"id":"manutej/luxor-claude-marketplace/spring-boot-development"},{"id":"dawiddutoit/custom-claude/java-best-practices-security-audit"}]},"slug":{"owner":"giuseppe-trisciuoglio","repo":"developer-kit","skill":"spring-boot-security-jwt"},"version":"143eafd4"}