JWT validation filter in Spring Boot - Deep Dive

Overview - JWT validation filter

What is it?

A JWT validation filter is a piece of code in a Spring Boot application that checks if incoming requests have a valid JSON Web Token (JWT). It reads the token from the request, verifies its signature and expiration, and decides if the request should proceed. This helps secure the app by ensuring only authenticated users access protected parts.

Why it matters

Without JWT validation filters, anyone could send requests pretending to be someone else, risking data leaks or unauthorized actions. The filter protects resources by confirming the token is genuine and not expired, making apps safer and trustworthy. It also automates security checks, so developers don't have to manually verify tokens everywhere.

Where it fits

Before learning JWT validation filters, you should understand HTTP requests, Spring Boot basics, and JWT structure. After mastering filters, you can explore advanced security topics like OAuth2, refresh tokens, and custom authentication providers.

Mental Model

Core Idea

A JWT validation filter acts like a security guard checking each request's token before letting it access protected resources.

Think of it like...

Imagine a concert where attendees must show a ticket at the entrance. The JWT validation filter is the guard who scans the ticket to confirm it's real and valid before allowing entry.

┌───────────────┐
│ Incoming HTTP │
│   Request     │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ JWT Validation│
│    Filter     │
│ - Extract JWT │
│ - Verify JWT  │
│ - Check Expiry│
└──────┬────────┘
       │
   Valid│Invalid
       ▼      ▼
┌───────────┐ ┌───────────────┐
│ Proceed   │ │ Reject Request│
│ to App    │ │ (401/403)     │
└───────────┘ └───────────────┘

Build-Up - 6 Steps

1

Foundation

Understanding JWT Basics

Concept: Learn what a JWT is and its parts: header, payload, and signature.

A JWT is a compact string made of three parts separated by dots. The header describes the token type and algorithm. The payload contains user data and claims like expiration. The signature ensures the token wasn't changed. JWTs are used to prove identity without storing session data on the server.

Result

You can recognize and decode a JWT string to see its contents.

Understanding JWT structure is essential because validation depends on checking each part correctly.

2

Foundation

Spring Boot Filters Explained

Concept: Learn what filters are in Spring Boot and how they intercept requests.

Filters are components that run before or after requests reach controllers. They can modify requests or responses, or block requests. Filters are useful for cross-cutting concerns like logging, security, or compression. You register filters in Spring Boot to apply them globally or selectively.

Result

You know how to create and register a filter that processes HTTP requests.

Filters provide a centralized place to handle tasks like JWT validation, avoiding repeated code in controllers.

3

Intermediate

Extracting JWT from HTTP Requests

🤔Before reading on: do you think JWTs are usually sent in the URL, headers, or body? Commit to your answer.

Concept: Learn how to get the JWT from the Authorization header in incoming requests.

JWTs are commonly sent in the Authorization header as 'Bearer '. The filter reads this header, checks if it starts with 'Bearer ', and extracts the token string. If missing or malformed, the filter rejects the request.

Result

Your filter can correctly find and isolate the JWT from requests.

Knowing the standard way JWTs are sent helps build filters that work with most clients and APIs.

4

Intermediate

Validating JWT Signature and Expiry

🤔Before reading on: do you think checking only the token's expiration is enough for security? Commit to your answer.

Concept: Learn to verify the JWT's signature and expiration date to ensure authenticity and freshness.

The filter uses a secret key or public key to verify the JWT signature matches the payload and header. It also checks the 'exp' claim to reject expired tokens. Libraries like jjwt or java-jwt simplify this process. If validation fails, the filter denies access.

Result

Only requests with valid, unexpired tokens proceed.

Validating both signature and expiry prevents attackers from using fake or old tokens.

5

Advanced

Integrating JWT Filter with Spring Security

🤔Before reading on: do you think the filter alone handles user roles and permissions? Commit to your answer.

Concept: Learn how to connect the JWT filter with Spring Security to set user authentication context.

After validating the JWT, the filter extracts user details and roles from the token claims. It creates an Authentication object and sets it in the SecurityContextHolder. This allows Spring Security to enforce authorization rules downstream. The filter must run before protected endpoints.

Result

Authenticated users gain access with proper roles enforced by Spring Security.

Integrating with Spring Security leverages its powerful authorization features, making JWT validation more useful.

6

Expert

Handling Token Revocation and Refresh

🤔Before reading on: do you think JWTs can be invalidated before expiry by default? Commit to your answer.

Concept: Explore strategies to handle JWT revocation and token refresh in production.

JWTs are stateless and can't be revoked by default. To handle revocation, systems keep a blacklist or use short-lived tokens with refresh tokens. The filter can check a token against a revocation list or validate refresh tokens separately. This adds complexity but improves security.

Result

Your system can reject tokens that were revoked or expired and issue fresh tokens securely.

Understanding JWT limitations and implementing revocation/refresh mechanisms is crucial for secure, real-world apps.

Under the Hood

When a request arrives, the filter intercepts it before the controller. It reads the Authorization header, extracts the JWT, and uses cryptographic algorithms to verify the signature against a secret or public key. It parses the token claims to check expiration and user data. If valid, it creates an authentication object and stores it in a thread-local security context. This context is then used by Spring Security to authorize access. If invalid, the filter stops the request and returns an error response.

Why designed this way?

JWT validation filters were designed to centralize token checks in one place, improving code reuse and security. Using stateless tokens avoids server-side session storage, making scaling easier. The filter pattern fits naturally in the HTTP request lifecycle, allowing early rejection of unauthorized requests. Alternatives like session-based auth require server memory and don't scale as well.

┌───────────────┐
│ HTTP Request  │
└──────┬────────┘
       │
       ▼
┌───────────────┐
│ JWT Validation│
│    Filter     │
│ ┌───────────┐ │
│ │ Extract   │ │
│ │ JWT       │ │
│ └────┬──────┘ │
│      │        │
│ ┌────▼──────┐ │
│ │ Verify    │ │
│ │ Signature │ │
│ └────┬──────┘ │
│      │        │
│ ┌────▼──────┐ │
│ │ Check     │ │
│ │ Expiry    │ │
│ └────┬──────┘ │
│      │        │
│ ┌────▼──────┐ │
│ │ Set Auth  │ │
│ │ Context   │ │
│ └────┬──────┘ │
└──────┴────────┘
       │
       ▼
┌───────────────┐
│ Controller or │
│ Spring Security│
│ Authorization │
└───────────────┘

Myth Busters - 4 Common Misconceptions

Quick: Do you think JWTs can be invalidated instantly after issuance by default? Commit to yes or no.

Common Belief: JWTs can be revoked immediately once issued, so no extra handling is needed.

Reality: JWTs are stateless and cannot be revoked until they expire unless you implement extra mechanisms like blacklists.

Why it matters: Assuming instant revocation leads to security holes where stolen tokens remain valid until expiry.

Quick: Do you think storing JWTs in local storage is always safe? Commit to yes or no.

Common Belief: Storing JWTs in browser local storage is safe and recommended.

Reality: Local storage is vulnerable to cross-site scripting (XSS) attacks; storing tokens in HTTP-only cookies is safer.

Why it matters: Improper storage exposes tokens to theft, risking user accounts and data.

Quick: Do you think the JWT validation filter handles user authorization automatically? Commit to yes or no.

Common Belief: Once the JWT is validated, the filter automatically manages user permissions.

Reality: The filter only authenticates the user; authorization requires additional role checks in Spring Security.

Why it matters: Confusing authentication with authorization can lead to unauthorized access.

Quick: Do you think the JWT payload is encrypted by default? Commit to yes or no.

Common Belief: JWT payloads are encrypted and private by default.

Reality: JWT payloads are only base64 encoded and visible to anyone with the token; encryption requires extra steps.

Why it matters: Sensitive data in payloads can be exposed if encryption is not applied.

Expert Zone

1

JWT validation filters must be stateless to scale horizontally without shared session storage.

2

The order of filters in Spring Security matters; JWT filters should run before authorization filters to set the security context properly.

3

Handling clock skew in token expiry checks prevents valid tokens from being rejected due to minor time differences.

When NOT to use

JWT validation filters are not ideal when you need immediate token revocation or complex session management; in such cases, use stateful session authentication or OAuth2 with introspection endpoints.

Production Patterns

In production, JWT filters often combine with refresh token mechanisms, use short-lived access tokens, and integrate with API gateways for centralized security enforcement.

Connections

OAuth2 Authorization Code Flow

Builds-on

Understanding JWT validation helps grasp how OAuth2 issues and validates tokens to secure APIs.

Stateless Session Management

Same pattern

JWT validation filters enable stateless sessions by embedding user info in tokens, avoiding server memory use.

Public Key Infrastructure (PKI)

Underlying principle

JWT signature verification relies on PKI concepts like asymmetric keys, showing how cryptography secures web apps.

Common Pitfalls

#1 Ignoring token expiration leads to accepting old tokens.

Wrong approach:

if (jwt.isSignatureValid()) { allowAccess(); }

Correct approach:

if (jwt.isSignatureValid() && !jwt.isExpired()) { allowAccess(); }

Root cause:

Forgetting to check the 'exp' claim causes security holes.

#2 Extracting JWT from wrong header or missing 'Bearer' prefix.

Wrong approach:

String token = request.getHeader("Authorization"); // no check for 'Bearer ' prefix

Correct approach:

String header = request.getHeader("Authorization");
if (header != null && header.startsWith("Bearer ")) {
String token = header.substring(7);
}

Root cause:

Not following standard token format causes parsing errors.

#3 Setting authentication context after response is committed.

Wrong approach:

chain.doFilter(request, response);
SecurityContextHolder.getContext().setAuthentication(auth);

Correct approach:

SecurityContextHolder.getContext().setAuthentication(auth);
chain.doFilter(request, response);

Root cause:

Misordering filter logic breaks security context propagation.

Key Takeaways

JWT validation filters act as gatekeepers, checking tokens before requests reach protected resources.

They extract tokens from the Authorization header, verify signatures, and check expiration to ensure security.

Integrating with Spring Security allows setting user authentication context for authorization decisions.

JWTs are stateless, so revocation requires extra mechanisms like blacklists or short-lived tokens.

Proper implementation prevents unauthorized access and scales well for modern web applications.