JWT validation filter in Spring Boot - Step-by-Step Execution

Concept Flow - JWT validation filter

Incoming HTTP Request

↓

JWT Validation Filter

↓

JWT Valid?

↓

Set User Auth

↓

Continue Filter Chain

↓

Controller

The filter intercepts each HTTP request, checks the JWT token, and either sets user authentication or rejects the request before passing control.

Execution Sample

Spring Boot

public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
  String token = extractToken((HttpServletRequest) req);
  if (validateToken(token)) {
    setAuthentication(token);
    chain.doFilter(req, res);
  } else {
    rejectRequest((HttpServletResponse) res);
  }
}

This filter extracts a JWT token, validates it, sets authentication if valid, or rejects the request if invalid.

Execution Table

Step	Action	Token Extracted	Token Valid?	Authentication Set	Filter Chain Called	Response Status
1	Extract token from header	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	N/A	No	No	N/A
2	Validate token	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	Yes	No	No	N/A
3	Set authentication in security context	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	Yes	Yes	No	N/A
4	Call next filter in chain	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	Yes	Yes	Yes	N/A
5	Request proceeds to controller	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	Yes	Yes	Yes	200 OK
6	If token invalid, reject request	invalid.token.value	No	No	No	401 Unauthorized

💡 Execution stops when token is invalid and request is rejected with 401, or continues if token is valid.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
token	null	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...	eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...
isValid	false	false	true	true	true
authenticationSet	false	false	false	true	true
responseStatus	null	null	null	null	200 OK or 401 Unauthorized

Key Moments - 2 Insights

Why does the filter reject the request immediately when the token is invalid?

Because the execution_table row 6 shows that when token validation fails, the filter does not call the next filter and sends a 401 response to stop unauthorized access.

When is the authentication set in the security context?

As shown in execution_table row 3, authentication is set only after the token is validated successfully, ensuring only valid users proceed.

Visual Quiz - 3 Questions

Look at the execution_table, what is the response status when the token is valid?

A 401 Unauthorized

B 200 OK

C 500 Internal Server Error

D No response sent yet

💡 Hint

Check the last row where token is valid and the response status column.

At which step does the filter call the next filter in the chain?

A Step 4

B Step 6

C Step 2

D Step 1

💡 Hint

Look at the 'Filter Chain Called' column in the execution_table.

If the token is invalid, what happens to the authenticationSet variable?

A It becomes null

B It becomes true

C It remains false

D It throws an error

💡 Hint

Refer to variable_tracker row for authenticationSet and execution_table row 6.

Concept Snapshot

JWT Validation Filter in Spring Boot:
- Intercepts HTTP requests
- Extracts JWT token from Authorization header
- Validates token signature and expiry
- If valid, sets user authentication in security context
- If invalid, rejects request with 401 Unauthorized
- Passes control to next filter or controller
- Ensures secure access to protected endpoints

Full Transcript

A JWT validation filter in Spring Boot intercepts incoming HTTP requests to check the JWT token in the Authorization header. It extracts the token, validates it for correctness and expiry, and if valid, sets the user authentication in the security context. This allows the request to continue to the next filter or controller. If the token is invalid, the filter immediately rejects the request by sending a 401 Unauthorized response, preventing access to protected resources. This process ensures only authenticated users can access secured endpoints.