Resource Server: JWT

## What a Resource Server is In OAuth2, the **Resource Server** is the service that owns the protected APIs (your data/endpoints). It does NOT log users in — that's the **Authorization Server** (e.g. Keycloak, Auth0, Okta, Spring Authorization Server). Clients obtain an **access token** from the authorization server and send it to your resource server on each call in the HTTP header `Authorization: Bearer <token>`. Your job is only to *validate* that token and derive an authenticated principal + authorities from it. A **JWT** (JSON Web Token) is a self-contained, signed token with three base64url parts separated by dots: `header.payload.signature`. The header names the signing algorithm (e.g. `RS256`) and a key id (`kid`). The payload holds **claims** (`sub`, `iss`, `exp`, `nbf`, `scope`, etc.). The signature lets the resource server verify authenticity without calling the authorization server for each request. ## Dependency + config Add `org.springframework.boot:spring-boot-starter-oauth2-resource-server`. Then either: ```yaml spring: security: oauth2: resourceserver: jwt: issuer-uri: https://auth.example.com/realms/katajob ``` `issuer-uri` is the most robust: at startup Spring hits the well-known OpenID discovery document (`{issuer}/.well-known/openid-configuration`) to learn the `jwks_uri`, and it also adds an **issuer validator** that checks the `iss` claim. Alternatively `jwk-set-uri: https://.../jwks` points directly at the JSON Web Key Set (the public keys) — use it when there's no discovery endpoint. ## The security config ```java @Bean SecurityFilterChain api(HttpSecurity http) throws Exception { http .authorizeHttpRequests(a -> a.anyRequest().authenticated()) .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults())); return http.build(); } ``` `oauth2ResourceServer().jwt()` registers a `BearerTokenAuthenticationFilter` and, on the `jwt()` path, a `JwtAuthenticationProvider` backed by a `JwtDecoder`. When Boot sees the `jwt.*` properties it auto-creates a `NimbusJwtDecoder`; if you have neither property, `.jwt()` fails to start because there is no decoder. ## Request lifecycle 1. `BearerTokenAuthenticationFilter` pulls the token from the `Authorization` header (or a form/query param if configured). 2. `JwtAuthenticationProvider` calls `JwtDecoder.decode(token)`. Nimbus verifies the signature against the JWK matching the header `kid`, then runs claim validators (timestamp, issuer). 3. On success a `JwtAuthenticationToken` (an `AbstractOAuth2TokenAuthenticationToken`) is placed in the `SecurityContext`; its `getName()` is the `sub`, principal is the decoded `Jwt`, and authorities come from a `JwtAuthenticationConverter` (default: `SCOPE_` prefix over the `scope` claim). 4. On failure it returns 401 with a `WWW-Authenticate: Bearer error=...` header via `BearerTokenAuthenticationEntryPoint`. ## Stateless Resource-server JWT auth is inherently **stateless**: no `HttpSession`, no CSRF token needed for pure token APIs, every request is validated fresh. Revocation is a known limitation — a valid, unexpired JWT stays valid until `exp` unless you add token introspection or short lifetimes. ## Gotchas - Forgetting `authorizeHttpRequests` — `.jwt()` authenticates but does not authorize; without rules everything may be permitted or (with `anyRequest().authenticated()`) require a token. - Confusing `oauth2Login()` (a *login/client* flow that establishes a session) with `oauth2ResourceServer()` (validates bearer tokens). They are different features. - Missing the starter dependency → `oauth2ResourceServer` method not available. - `issuer-uri` requires the app to reach the auth server at startup; a locked-down/offline environment may need `jwk-set-uri` plus a public-key or a restart-tolerant setup.