spring-boot-security-jwt
Implement stateless JWT authentication in Spring Boot 3.5 applications with Spring Security 6.x and JJWT 0.12.6. This skill covers token generation and validation, Bearer and HttpOnly cookie strategies, refresh token rotation, role and permission-based access control, and OAuth2 provider integration. Use it to secure REST APIs with method-level authorization rules and token revocation patterns.
Spring Boot Security JWT provides JWT authentication patterns for Spring Boot 3.5 using Spring Security 6.x and JJWT.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-22
Spring Boot Security JWT provides JWT authentication patterns for Spring Boot 3.5 using Spring Security 6.x and JJWT. Implement stateless JWT authentication in Spring Boot 3.5 applications with Spring Security 6.x and JJWT 0.12.6. This skill covers token generation and validation, Bearer and HttpOnly cookie strategies, refresh token rotation, role and permission-based access control, and OAuth2 provider integration. Use it to secure REST APIs with method-level authorization rules and token revocation patterns.
Use it when
- spring-boot-security-jwt supports refresh token rotation by issuing a new refresh token alongside each access token refresh.
- spring-boot-security-jwt uses Spring Security's @PreAuthorize annotation with role and permission expressions to enforce RBAC.
Verify before relying
Read SKILL.md below before installing (20 files). Open directory: indexed for reading, not audited.
Install
giuseppe-trisciuoglio/developer-kit/spring-boot-security-jwt · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How to implement JWT authentication in Spring Boot?
spring-boot-security-jwt implements JWT authentication by configuring Spring Security 6.x with a custom SecurityFilterChain that validates Bearer tokens via a OncePerRequestFilter. Use JJWT 0.12.6 to generate tokens during login, extract claims in the filter, and populate the SecurityContext. Configure a JwtProvider bean to handle token creation with expiration, issuer, and audience claims, then validate incoming tokens before granting access to protected endpoints.
What is the refresh token rotation strategy in spring-boot-security-jwt?
spring-boot-security-jwt supports refresh token rotation by issuing a new refresh token alongside each access token refresh. Store refresh tokens in a database or cache with expiration timestamps and a revocation flag. When a client requests a new access token, validate the refresh token, mark the old one as used, and issue a fresh pair. This prevents token replay attacks and enforces strict token lifecycle management.
How does spring-boot-security-jwt configure role-based access control?
spring-boot-security-jwt uses Spring Security's @PreAuthorize annotation with role and permission expressions to enforce RBAC. Define roles (ADMIN, USER) in your User entity, load them via a custom UserDetailsService, and apply @PreAuthorize("hasRole('ADMIN')") on controller methods. For fine-grained control, implement a custom PermissionEvaluator to check resource-level permissions in @PreAuthorize("@permissionEvaluator.canAccess(#id)") expressions.
Can spring-boot-security-jwt integrate OAuth2 social login?
spring-boot-security-jwt supports OAuth2 provider integration by configuring Spring Security's OAuth2Login with client registrations for Google, GitHub, or custom providers. Define spring.security.oauth2.client properties with client-id and client-secret, then add a custom OAuth2SuccessHandler to generate JWT tokens after successful provider authentication. This enables stateless SPA backends to authenticate users via social providers while issuing application-specific JWTs.
How to secure REST APIs with Bearer tokens or HttpOnly cookies?
spring-boot-security-jwt secures REST APIs by extracting Bearer tokens from the Authorization header in the JWT filter, or by reading HttpOnly cookies set during login. For SPAs, HttpOnly cookies prevent XSS attacks since JavaScript cannot access them. Configure CORS and SameSite policies in your SecurityFilterChain, and ensure the filter validates token signatures and expiration before granting access to protected resources.
What does spring-boot-security-jwt do for token blacklisting?
spring-boot-security-jwt implements token blacklisting by storing revoked token JTIs (unique identifiers) in Redis or a database during logout. Before granting access, the JWT filter checks if the token's JTI exists in the blacklist; if found, the request is rejected. This enables immediate logout without waiting for token expiration, and supports token revocation scenarios like password changes or permission updates.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
Spring Boot JWT Security
JWT authentication and authorization patterns for Spring Boot 3.5.x using Spring Security 6.x and JJWT. Covers token generation, validation, refresh strategies, RBAC/ABAC, and OAuth2 integration.
Overview
This skill provides implementation patterns for stateless JWT authentication in Spring Boot applications. It covers the complete authentication flow including token generation with JJWT 0.12.6, Bearer/cookie-based authentication, refresh token rotation, and method-level authorization with @PreAuthorize expressions.
Key capabilities: - Access and refresh token generation with configurable expiration - Bearer token and HttpOnly cookie authentication strategies - Integration with Spring Data JPA and OAuth2 providers - RBAC with
(truncated - see the full file via the links below)
File tree — 15 files
plugins/developer-kit-java/skills/spring-boot-security-jwt/SKILL.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/assets/generate-jwt-keys.sh
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/authorization-patterns.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/configuration.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/examples.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/jwt-complete-configuration.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/jwt-configuration.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/jwt-quick-reference.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/jwt-testing-guide.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/microservices-security.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/migration-spring-security-6x.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/oauth2-integration.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/performance-optimization.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/security-hardening.md
plugins/developer-kit-java/skills/spring-boot-security-jwt/references/structure.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Implement JWT authentication and authorization in Spring Boot 3.5 with Spring Security 6.x”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill guides you through hardening Spring Boot applications with production-ready security patterns. It covers stateless JWT and session-based authentication, method-level authorization controls, input validation, CSRF and CORS configuration, secure password encoding, secrets externalization, protective response headers, rate limiting, and dependency vulnerability scanning.
Develop production-grade Spring Boot applications covering REST API creation, security configuration with OAuth2 and JWT, data persistence via Spring Data JPA, and operational monitoring through Actuator. Includes templates for common patterns like layered architecture, validation, and exception handling.
Java Architect guides enterprise Spring Boot 3.x development across microservices, reactive endpoints, and cloud-native patterns. It covers architecture analysis, domain design, JPA query tuning, Spring Security configuration with OAuth2/JWT, and comprehensive testing workflows. Use it to implement WebFlux services, resolve async challenges, and ensure production-ready code quality.
Connect Aurora, MySQL, or PostgreSQL databases to Spring Boot applications with production-ready patterns for datasource configuration, HikariCP pooling, SSL encryption, and credential management via AWS Secrets Manager. Includes read/write split setup for Aurora replicas, environment-specific profiles, and Flyway migration support.
This skill guides you through building well-structured REST APIs in Spring Boot, covering resource-based URL design, proper HTTP method usage, appropriate status codes, and DTO patterns. It includes strategies for validation, global exception handling, pagination setup, and security header configuration. Use it when creating endpoints, designing API contracts, or reviewing REST architecture.
This skill scaffolds end-to-end CRUD operations for Spring Boot 3.5+ applications using feature-focused, domain-driven design patterns. It generates domain aggregates, repository contracts, JPA persistence adapters, application services, and REST controllers with proper separation of concerns and validation gates. Use it to build REST endpoints, implement database operations, or diagnose transaction boundaries in existing Spring Boot services.
More skills spring-boot-actuator (MIT)