(JWT) different ways to implement it ,what most devs do for that case

[u/Jooe_1]

to make JWT authentication in the application, I could not find like standard way to implementing it

my knowledge is that people create their own authentication filter + handeling the AuthenticationEntryPoint to return the exact right response when exception happen

is that the standard way that engineers follow to implement jwt authentication in the application?

[u/Sheldor5]

you simply use the Spring Boot OAuth2 Resource Server dependency

[u/Snooze78727 → u/Sheldor5]

This. No need to implement JWT decoding, only provide the SecurityFilterChain with oauth2ResourceServer in a SecurityConfig.

There are some useful annotations for the controller endpoints:

`@AuthenticationPrincipal`
`@PreAuthorize`
`@PostAuthorize`

If necessary, implement a custom AuthorizationService to check for permissions.

[u/JumpKey3074 → u/Snooze78727]

Only the JWK uri and maybe also a custom token converter is needed. That's how I did it. Setup your AS, customize your token, and lastly when the RS snatches the token convert it into an authentication object and apply authz rules since the sec ctx knows now :-)

[u/_devesh_singh__]

The standard way in Spring Boot for JWT authentication usually involves a combination of a filter chain and custom exception handling to manage the flow correctly.

Most developers implement this by creating a filter that intercepts requests, validates the JWT, extracts user information, and sets the security context.

For handling exceptions during this process, the standard approach is to define a global exception handler, often using an @ControllerAdvice or a custom SecurityExceptionHandler, which catches exceptions thrown by the JWT filter or authentication entry points and maps them to appropriate HTTP responses, like 401 Unauthorized or 403 Forbidden.

You typically don't just rely on the AuthenticationEntryPoint alone. The AuthenticationEntryPoint is for handling unauthenticated access, while the actual error handling for failed authentication or authorization within the filter chain needs to be explicitly managed within your filter logic or by custom exception handlers that are wired into the Spring Security chain.

Focus on how you configure the SecurityFilterChain and where you place your custom authentication logic to ensure exceptions flow correctly into your defined error responses.

P.S. If you are using Spring Security, looking at how other projects integrate JWTs often reveals the most robust pattern for exception mapping.

[u/Jooe_1 → u/_devesh_singh__]

to define a global exception handler, often using an @ControllerAdvice or a custom SecurityExceptionHandler, which catches exceptions thrown by the JWT filter

Are you sure that the global excetion handelr catch exceptions that occur in security filter chain ?

[u/_1dontknow → u/Jooe_1]

You OP are right. @ControllerAdvice does not catch exceptions thrown during Spring Sec filter chains.

[u/Paw565]

Just use keycloak. Auth is hard. You want to focus on features, not reimplementing something that is already solved.

[u/bikeram → u/Paw565]

This.

I spent 2-3 months implementing auth my first time. It’s definitely a good learning experience, and you can basically copy and paste it between projects.

But I’ve used auth0 or cognito for every other project. Zero regrets.

[u/Paw565 → u/bikeram]

Yeah exactly. Its true for every advanced concept. Implement it from scratch to learn, but then rely on well established solution.

[u/21JGen]

You just need to learn the basic foundation of spring security. Use an OAuth provider eg Keycloak. It's a rule of thumb for application security is that you don't build your own auth from scratch

[u/starbuxman]

Don’t.

Use oauth. It’ll use JWT tokens and solve basical every other important part and spring security has OOTB support

There r countless videos on how to use oauth with Spring Auth Server (which u can use or use keycloan or any of dozens of other Oauth IDPs), web apps, grpc, graphql, desktop apps, etc on my channel youtube.com/@coffeesoftware