Stateless REST API Security with JWT in Spring Boot

//JwtConfig.java
package com.javabrahman.security.jwt;

import static org.springframework.security.config.Customizer.withDefaults;

import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpMethod;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class JwtConfig {

  private final KeyPair keys = generateRsaKeys();   // a new key pair at every start, for this example

  @Bean
  SecurityFilterChain chain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers(HttpMethod.POST, "/token").authenticated()          // username and password
            .requestMatchers(HttpMethod.GET, "/api/**").hasAuthority("SCOPE_books:read")
            .requestMatchers(HttpMethod.POST, "/api/**").hasAuthority("SCOPE_books:write")
            .anyRequest().authenticated())
        .httpBasic(withDefaults())                                               // only used for /token
        .oauth2ResourceServer(oauth2 -> oauth2.jwt(withDefaults()))              // Authorization: Bearer <jwt>
        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .csrf(csrf -> csrf.disable());
    return http.build();
  }

  @Bean
  JwtEncoder jwtEncoder() {
    RSAKey key = new RSAKey.Builder((RSAPublicKey) keys.getPublic()).privateKey((RSAPrivateKey) keys.getPrivate()).build();
    return new NimbusJwtEncoder(new ImmutableJWKSet<>(new JWKSet(key)));
  }

  @Bean
  JwtDecoder jwtDecoder() {
    return NimbusJwtDecoder.withPublicKey((RSAPublicKey) keys.getPublic()).build();
  }

  @Bean
  UserDetailsService users() {
    return new InMemoryUserDetailsManager(
        User.withUsername("ann").password("{noop}ann-pass").authorities("books:read").build(),
        User.withUsername("raj").password("{noop}raj-pass").authorities("books:read", "books:write").build());
  }

  private static KeyPair generateRsaKeys() {
    try {
      KeyPairGenerator generator = KeyPairGenerator.getInstance("RSA");
      generator.initialize(2048);
      return generator.generateKeyPair();
    } catch (Exception e) {
      throw new IllegalStateException(e);
    }
  }
}

//TokenController.java
package com.javabrahman.security.jwt;

import java.time.Instant;
import java.util.Map;
import java.util.stream.Collectors;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.oauth2.jwt.JwsHeader;
import org.springframework.security.oauth2.jwt.JwtClaimsSet;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class TokenController {
  private final JwtEncoder encoder;

  public TokenController(JwtEncoder encoder) {
    this.encoder = encoder;
  }

  @PostMapping("/token")
  public Map<String, Object> token(Authentication user, @RequestParam(defaultValue = "600") long seconds,
                                   @RequestParam(defaultValue = "0") long ageSeconds) {   // ageSeconds: to demonstrate expiry
    Instant now = Instant.now().minusSeconds(ageSeconds);
    String scope = user.getAuthorities().stream()
        .map(GrantedAuthority::getAuthority)
        .filter(a -> a.startsWith("books:"))            // the permissions, not FACTOR_PASSWORD
        .sorted()
        .collect(Collectors.joining(" "));
    JwtClaimsSet claims = JwtClaimsSet.builder()
        .issuer("javabrahman-demo")
        .subject(user.getName())
        .issuedAt(now)
        .expiresAt(now.plusSeconds(seconds))
        .claim("scope", scope)
        .build();
    JwsHeader header = JwsHeader.with(SignatureAlgorithm.RS256).build();
    String token = encoder.encode(JwtEncoderParameters.from(header, claims)).getTokenValue();
    return Map.of("access_token", token, "token_type", "Bearer", "expires_in", seconds);
  }
}

//BookApiController.java
package com.javabrahman.security.jwt;

import java.util.List;
import java.util.Map;
import org.springframework.http.ResponseEntity;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.oauth2.jwt.Jwt;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
@RequestMapping("/api")
public class BookApiController {

  @GetMapping("/books")
  public List<String> books() {
    return List.of("Effective Java", "Clean Code");
  }

  @PostMapping("/books")
  public ResponseEntity<String> add(@RequestBody String title) {
    return ResponseEntity.status(201).body("added: " + title);
  }

  @GetMapping("/me")
  public Map<String, Object> me(@AuthenticationPrincipal Jwt jwt) {
    return Map.of("header", jwt.getHeaders(), "claims", jwt.getClaims());
  }
}

//JwtApp.java
package com.javabrahman.security.jwt;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;

@SpringBootApplication
public class JwtApp {

  public static void main(String[] args) {
    SpringApplication.run(JwtApp.class, args);
  }
}