Loading published curriculum…

16 · Spring Security in depth / LESSON 83 OF 102

OAuth2, OIDC, and JWT resource servers

OAuth2 delegates access; OIDC adds identity information; a resource server validates access tokens.

Before this lesson: Method authorization and object ownership

Understand the topic

A JWT is a token format, not proof of trust. Validate the signature with trusted keys, accepted algorithms, issuer, expiry, and the intended audience policy. Decoding a payload without verification permits attacker-controlled claims.

Use Spring’s resource-server support rather than inventing a custom JWT filter. An issuer URI enables issuer metadata and key discovery. Configure audience validation for your API and test key rotation, expiration, and invalid issuers. ID tokens are not general-purpose API access tokens.

EXAMPLE · TEXT

application.properties plus chain fragment

spring.security.oauth2.resourceserver.jwt.issuer-uri=https://identity.example.com/realms/study
spring.security.oauth2.resourceserver.jwt.audiences=study-api

// Inside SecurityFilterChain configuration:
http.oauth2ResourceServer(oauth -> oauth.jwt(org.springframework.security.config.Customizer.withDefaults()));

What to expect

Use the OAuth2 resource-server starter and a real configured issuer. This illustrative issuer will not authenticate users. Complete route authorization and the explicit credential/CSRF policy separately.

YOUR TURN

Put it into practice

  1. 01Configure a development identity provider and API audience.
  2. 02Test valid, expired, wrong-issuer, wrong-audience, and tampered tokens.
  3. 03Verify: Only correctly verified access tokens for this API are accepted.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

OAuth2 delegates access; OIDC adds identity information; a resource server validates access tokens.

  1. 01A JWT is a token format, not proof of trust. Validate the signature with trusted keys, accepted algorithms, issuer, expiry, and the intended audience policy. Decoding a payload without verification permits attacker-controlled claims.
  2. 02Use Spring’s resource-server support rather than inventing a custom JWT filter. An issuer URI enables issuer metadata and key discovery. Configure audience validation for your API and test key rotation, expiration, and invalid issuers. ID tokens are not general-purpose API access tokens.
  3. 03Trace the example: Use the OAuth2 resource-server starter and a real configured issuer. This illustrative issuer will not authenticate users. Complete route authorization and the explicit credential/CSRF policy separately.

A mistake worth avoiding

A token with an edited admin claim is accepted after simple Base64 decoding.

DEBUGGING ROOM

Something broke. Where do you look?

A token with an edited admin claim is accepted after simple Base64 decoding.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Does reading a JWT payload prove its claims are authentic?

Choose one answer

BUILD IT YOURSELF

Configure a development identity provider and API audience.

  1. 1.Configure a development identity provider and API audience.
  2. 2.Test valid, expired, wrong-issuer, wrong-audience, and tampered tokens.
  3. 3.Reproduce this failure, then repair it: A token with an edited admin claim is accepted after simple Base64 decoding.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Does reading a JWT payload prove its claims are authentic?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Only correctly verified access tokens for this API are accepted.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references