title: Spring Security filters for JWT-based authentication, verification and authorization scheme, by example
body: <p>Java + Spring (and Spring Security) here, interested in implementing a JWT-based auth mechanism for my web service using bearer tokens. My <em>understanding</em> of the proper way of using Spring Security for authentication and authorization is through the use of provided (or custom) filters as follows:</p>
  <ul>
  <li>you specify which URLs in your app are authenticated (and thus require authenticated requests to access)
  <ul>
  <li>this is typically done in an <code>@EnableWebSecurity</code>-annotated web security class that extends <code>WebSecurityConfigurerAdapter</code></li>
  </ul>
  </li>
  <li>for any unauthenticated URLs, no filters should block access to the resources being requested</li>
  <li>an <strong>authentication filter</strong> effectively provides a &quot;sign in&quot; endpoint
  <ul>
  <li>request clients should hit this signin endpoint (authn filter) initially to obtain an auth token that can be used for making subsequent API calls</li>
  <li>this filter should receive a type of &quot;sign in request&quot; object that contains a principal (e.g. username) and credential (e.g. password)</li>
  <li>this authn filter should use the principal/credential contained in the sign in request to determine if they represents a valid user in the system
  <ul>
  <li>if so, an auth token (JWT, etc.) is generated and sent back to the requesters in the response somehow</li>
  <li>else, if the principal/credential don't match a valid user in the system, an error response is returned and authentication fails</li>
  </ul>
  </li>
  </ul>
  </li>
  <li>for authenticated URLs, a <strong>verification filter</strong> verifies that the request contains an auth token and that the auth token is valid (was signed correctly, contains user information such as JWT claims, is not expired, etc.)
  <ul>
  <li>if the auth token is valid, the request continues on to the authorization filter (see below)</li>
  <li>else if the auth token is not valid, verification fails and the filter sends an error response back to the client</li>
  </ul>
  </li>
  <li>finally, an <strong>authorization filter</strong> verifies that the user associated with the valid auth token has the ability/permission to make such a request
  <ul>
  <li>if they do, then the request is allowed to continue on to whatever resources/controller was written to handle it, and that resource/controller provides the response back to the requester</li>
  <li>if they don't, an error response is returned to the client</li>
  <li>ideally the logic (code) inside this authz filter would have access to the permission annotations added to the resource method, so that I can add endpoints and specify permissions on them without having to modify the code of the authz filter</li>
  </ul>
  </li>
  </ul>
  <p>So to begin with, if anything I have stated above is a Spring Security (or web security in general) anti-pattern or is misled, please begin by providing course correction and steering me in the right direction!</p>
  <p>Assuming I'm more or less understanding the &quot;auth flow&quot; above correctly...</p>
  <p>Are there any specific Spring Security filters that take care of <strong>all</strong> of this for me already, or that can be extended and have a few methods overridden to behave this way? Or anything that comes really close? Looking at the list of authentication-specific Spring Security filters I see:</p>
  <ul>
  <li><code>UsernamePasswordAuthenticationFilter</code> -&gt; looks like a decent candidate for the authn filter but expects a <code>username</code> and <code>password</code> parameter on the query string which is strange to me, and most importantly, does not generate a JWT</li>
  <li><code>CasAuthenticationFilter</code> -&gt; looks like its used for CAS-based SSO and is not appropriate for use in non-SSO contexts</li>
  <li><code>BasicAuthenticationFilter</code> -&gt; for HTTP basic authentication-based auth, not appropriate for more sophisticated setups</li>
  </ul>
  <p>As for token verification and authorization, I (much to my surprise) don't see <em>anything</em> in the Spring Security landscape that could qualify.</p>
  <p>Unless anyone knows of JWT-specific filters that I can use or subclass easily, I think I need to implement my own custom filters, in which case I'm wondering how to conigure Spring Security to use them and not use any of these other authentication filters (such as <code>UsernamePasswordAuthenticationFilter</code>) as part of the filter chain.</p>