Why JWT matters for APIs in Spring Boot - See It in Action

Why JWT matters for APIs

📖 Scenario: You are building a simple API for a book store. You want to make sure only authorized users can access certain API endpoints. To do this, you will use JWT (JSON Web Tokens) to securely identify users.

🎯 Goal: Build a Spring Boot API that uses JWT to protect an endpoint. You will create the data structure for a user, configure a secret key, implement JWT token creation, and secure an API endpoint using the JWT.

📋 What You'll Learn

Create a user data structure with username and password

Add a secret key configuration for signing JWT tokens

Implement JWT token creation logic

Secure an API endpoint to require a valid JWT token

💡 Why This Matters

🌍 Real World

APIs often need to verify who is calling them. JWT tokens let APIs check identity securely without storing session data.

💼 Career

Understanding JWT is essential for backend developers building secure APIs in Spring Boot or other frameworks.

1

Create User Data Structure

Create a record called User with two fields: username of type String and password of type String.

Spring Boot

// Your code here

Need a hint?

Use the record keyword in Java 17+ to create a simple data class.

2

Add Secret Key Configuration

Create a String variable called secretKey and set it to the exact value "mysecretkey12345".

Spring Boot

public record User(String username, String password) {}

// Your code here

Need a hint?

This key will be used to sign the JWT tokens.

3

Implement JWT Token Creation

Write a method called createToken that takes a User parameter and returns a String. Inside, return a dummy token string "token-for-" + user.username().

Spring Boot

public record User(String username, String password) {}

String secretKey = "mysecretkey12345";

// Your code here

Need a hint?

This simulates creating a JWT token for the user.

4

Secure API Endpoint with JWT

Create a Spring Boot @RestController class called BookController with a @GetMapping("/books") method called getBooks that takes a @RequestHeader("Authorization") String token parameter. Inside, return a List<String> with one book title "Spring Boot Guide" only if token.equals("token-for-admin"), else return an empty list.

Spring Boot

public record User(String username, String password) {}

String secretKey = "mysecretkey12345";

public String createToken(User user) {
    return "token-for-" + user.username();
}

// Your code here

Need a hint?

This endpoint only returns the book list if the JWT token matches the admin token.