JWT validation filter in Spring Boot - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the main purpose of a JWT validation filter in a Spring Boot application?

A JWT validation filter checks the JSON Web Token in incoming requests to verify the user's identity and permissions before allowing access to protected resources.

beginner

Where in the request lifecycle does a JWT validation filter typically operate?

It operates before the request reaches the controller, intercepting the request to validate the token and set the security context if valid.

intermediate

Which Spring Boot class is commonly extended to create a JWT validation filter?

OncePerRequestFilter is commonly extended to create a JWT validation filter that runs once per request.

beginner

What happens if the JWT token is missing or invalid in the JWT validation filter?

The filter usually rejects the request by sending an unauthorized error response, preventing access to protected endpoints.

intermediate

How does the JWT validation filter set the user details for the rest of the application after validating the token?

It creates an Authentication object with user details and sets it in the SecurityContextHolder, so Spring Security knows the user is authenticated.

What does a JWT validation filter check in an HTTP request?

A The request body content

B The request URL path

C The HTTP method type

D The JSON Web Token in the Authorization header

The JWT validation filter looks for the JWT token in the Authorization header to verify the user's identity.

Which method is overridden in a Spring Boot JWT validation filter extending OncePerRequestFilter?

A doFilterInternal

B doFilter

C init

D destroy

doFilterInternal is the method to override for custom filtering logic in OncePerRequestFilter.

What happens if the JWT token is expired when validated by the filter?

A The filter refreshes the token automatically

B The filter ignores the token and allows access

C The filter rejects the request with an unauthorized error

D The filter redirects to the login page

Expired tokens are invalid, so the filter rejects the request to protect resources.

After validating the JWT, how does the filter inform Spring Security about the authenticated user?

A By setting an Authentication object in SecurityContextHolder

B By modifying the HTTP response headers

C By calling the controller directly

D By storing user info in a cookie

Setting the Authentication object in SecurityContextHolder tells Spring Security the user is authenticated.

Which header usually carries the JWT token in HTTP requests?

A Content-Type

B Authorization

C Accept

D User-Agent

The Authorization header typically carries the JWT token prefixed with 'Bearer '.

Explain how a JWT validation filter works in a Spring Boot application from receiving a request to setting authentication.

Think about the steps the filter takes to check the token and tell Spring Security about the user.

Describe why using a JWT validation filter improves security in a web application.

Consider how the filter controls who can use the app resources.