Stateless authentication mental model in Spring Boot - Mini Project: Build & Apply

Stateless Authentication Mental Model with Spring Boot

📖 Scenario: You are building a simple web service that uses stateless authentication to verify users without storing session data on the server. This is common in modern web apps where each request carries its own authentication token.

🎯 Goal: Create a Spring Boot project that demonstrates the stateless authentication mental model by setting up a user data structure, configuring a secret key, implementing token validation logic, and completing the security filter to check tokens on incoming requests.

📋 What You'll Learn

Create a user data structure with fixed username and password

Add a secret key configuration for token signing

Implement a method to validate tokens against the secret key

Complete a security filter that checks the token on each request

💡 Why This Matters

🌍 Real World

Stateless authentication is used in modern web apps and APIs to avoid storing session data on the server, improving scalability and security.

💼 Career

Understanding stateless authentication is essential for backend developers working with REST APIs and microservices, especially using Spring Boot.

1

Create User Data Structure

Create a Map<String, String> called users with one entry: key "user1" and value "password123".

Spring Boot

// Your code here
// Create a Map called users with one user

Hint

Use a HashMap to store username and password pairs.

2

Add Secret Key Configuration

Add a String variable called SECRET_KEY with the value "mySecretKey123" inside the AuthData class.

Spring Boot

import java.util.Map;
import java.util.HashMap;

public class AuthData {
    public static final Map users = new HashMap() {{
        put("user1", "password123");
    }};

    // Your code here
    // Add a String SECRET_KEY with value "mySecretKey123"
}

Hint

This key will be used to sign and verify tokens.

3

Implement Token Validation Method

Inside a class called TokenUtil, write a static method boolean validateToken(String token) that returns true if the token equals AuthData.SECRET_KEY, otherwise false.

Spring Boot

import java.util.Map;
import java.util.HashMap;

public class AuthData {
    public static final Map users = new HashMap() {{
        put("user1", "password123");
    }};

    public static final String SECRET_KEY = "mySecretKey123";
}

public class TokenUtil {
    // Your code here
    // Write static boolean validateToken(String token) method
}

Hint

This simple check simulates token validation by comparing with the secret key.

4

Complete Security Filter to Check Token

In a class AuthFilter that extends OncePerRequestFilter, override doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain). Extract the Authorization header, validate it using TokenUtil.validateToken, and if valid, call filterChain.doFilter(request, response) to continue the request.

Spring Boot

import java.util.Map;
import java.util.HashMap;
import jakarta.servlet.FilterChain;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.filter.OncePerRequestFilter;

public class AuthData {
    public static final Map users = new HashMap() {{
        put("user1", "password123");
    }};

    public static final String SECRET_KEY = "mySecretKey123";
}

public class TokenUtil {
    public static boolean validateToken(String token) {
        return AuthData.SECRET_KEY.equals(token);
    }
}

public class AuthFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) {
        // Your code here
        // Extract Authorization header, validate token, and continue filter chain if valid
    }
}

Hint

This filter checks the token on every request and blocks unauthorized access.

Practice

1. What is the main idea behind stateless authentication in Spring Boot?

easy

A. The server does not keep user session data; clients send tokens each time.

B. The server stores all user sessions in memory for quick access.

C. The server uses cookies to remember users between requests.

D. The server requires users to log in for every single request manually.

Solution

1. Step 1: Understand stateless authentication concept

   Stateless means the server does not save any user session data between requests.

2. Step 2: Identify how user identity is maintained

   Clients send a token with each request to prove who they are without server memory.

3. Final Answer:

   The server does not keep user session data; clients send tokens each time. -> Option A

4. Quick Check:

   Stateless = No server session, token sent each time [OK]

Hint: Stateless means no server memory, token sent every request [OK]

Common Mistakes:

• Thinking server stores session data
• Confusing cookies with stateless tokens
• Assuming login required every request

2. Which of the following is the correct way to send a token in a stateless Spring Boot API request?

easy

A. Include the token in the request body as plain text.

B. Send the token in the Authorization header as a Bearer token.

C. Store the token in a server-side session variable.

D. Attach the token as a URL query parameter without encoding.

Solution

1. Step 1: Recall token transmission best practice

   Tokens are usually sent in the Authorization header using the Bearer scheme.

2. Step 2: Eliminate incorrect methods

   Request body is not standard for tokens; server-side session breaks statelessness; URL query parameters are insecure and not recommended.

3. Final Answer:

   Send the token in the Authorization header as a Bearer token. -> Option B

4. Quick Check:

   Token in Authorization header = correct [OK]

Hint: Tokens go in Authorization header as Bearer [OK]

Common Mistakes:

• Putting token in request body
• Using server session storage
• Sending token in URL query insecurely

3. Given this Spring Boot controller snippet using stateless authentication:

@GetMapping("/profile")
public ResponseEntity<String> getProfile(@RequestHeader("Authorization") String authHeader) {
    if (authHeader == null || !authHeader.startsWith("Bearer ")) {
        return ResponseEntity.status(401).body("Unauthorized");
    }
    String token = authHeader.substring(7);
    if (token.equals("valid-token")) {
        return ResponseEntity.ok("User Profile Data");
    } else {
        return ResponseEntity.status(403).body("Forbidden");
    }
}

What will be the response if the client sends header Authorization: Bearer valid-token?

medium

A. 401 Unauthorized

B. 403 Forbidden

C. 200 OK with 'User Profile Data'

D. 500 Internal Server Error

Solution

1. Step 1: Check Authorization header presence and format

   The header is present and starts with "Bearer ", so it passes the first check.

2. Step 2: Extract token and compare

   The token extracted is "valid-token", which matches the expected valid token.

3. Step 3: Determine response

   Since token is valid, the method returns 200 OK with "User Profile Data".

4. Final Answer:

   200 OK with 'User Profile Data' -> Option C

5. Quick Check:

   Valid token = 200 OK response [OK]

Hint: Valid Bearer token returns 200 OK [OK]

Common Mistakes:

• Confusing 401 and 403 status codes
• Ignoring token prefix check
• Assuming server stores session

4. Identify the bug in this stateless authentication filter code snippet:

public boolean isValidToken(String token) {
    if (token == null || token.isEmpty()) {
        return false;
    }
    // Token validation logic
    return token.equals("valid-token");
}

public void doFilter(HttpServletRequest req, HttpServletResponse res) {
    String auth = req.getHeader("Authorization");
    if (auth != null && auth.startsWith("Bearer ")) {
        String token = auth.substring(7);
        if (!isValidToken(token)) {
            res.setStatus(401);
        }
    }
    // Continue filter chain
}

What is the main issue?

medium

A. Possible NullPointerException if Authorization header is missing

B. Token validation logic is incorrect

C. Response status code should be 403 instead of 401

D. Filter does not extract token correctly

Solution

1. Step 1: Analyze header usage

   The original code calls auth.startsWith("Bearer ") without checking if auth is null.

2. Step 2: Identify risk

   If Authorization header is missing, auth is null, so calling startsWith causes NullPointerException.

3. Final Answer:

   Possible NullPointerException if Authorization header is missing -> Option A

4. Quick Check:

   Check null before startsWith to avoid error [OK]

Hint: Check for null before calling startsWith [OK]

Common Mistakes:

• Assuming header always present
• Mixing 401 and 403 status codes
• Ignoring null safety in Java

5. In a stateless Spring Boot app using JWT tokens, which approach best supports scaling across multiple servers?

hard

A. Store user sessions in a shared database accessed by all servers.

B. Cache user sessions in server memory for faster access.

C. Use sticky sessions to keep users on the same server.

D. Validate JWT tokens on each request without server session storage.

Solution

1. Step 1: Understand stateless scaling needs

   Scaling means any server can handle any request without shared session state.

2. Step 2: Evaluate options

   Storing sessions in DB or memory adds state and complexity; sticky sessions tie users to one server, limiting scaling.

3. Step 3: Identify best stateless method

   Validating JWT tokens on each request keeps servers stateless and allows easy scaling.

4. Final Answer:

   Validate JWT tokens on each request without server session storage. -> Option D

5. Quick Check:

   Stateless + JWT = validate token each request [OK]

Hint: Stateless scaling means no server session, validate tokens each time [OK]

Common Mistakes:

• Using sticky sessions limits scaling
• Storing sessions breaks statelessness
• Caching sessions in memory causes sync issues