spring-projects / spring-projects/spring-security

Built-in support for the creation and verification of JWT (No OAuth Involved)

Open
#17,752 2 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage type: enhancement
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Hi all,
Currently, spring security does not provide built-in support of creation of JWT out of the box.
Consequently, this would mean developers need to manually write tons of implementation code (including our own Filter, creating and verifying JWT), as evidenced from the below articles among many others
Article 1
Article 2

Our backend application would rely on username and password authentication (which thankfully Spring security has direct support to) and once authenticated succesfully, create JWT (yes, sessionless) and send to browser. For every subsequent page visited, backend will verify the JWT in the browser request.
To avoid over-bloating our application, we avoid include OAuth2 Resource Server and OAuth2 Authorization Server libraries as we are not dealing with Oauth mechanism.

For the above-mentioned scenarios, if spring security has built-in support for that, and with the autoconfiguration provided by spring boot, the above scenario's implementation would be a breeze.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No files or tests are identified in the issue. Start by reviewing Spring Security's existing authentication and OAuth2 resource and authorization server modules to define the intended JWT boundary and configuration surface; done would require an agreed scope for creation, verification, and autoconfiguration.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
authentication, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.