1.14 JWT Spring security - amresh087/Question GitHub Wiki

Last Updated: April 15, 2026

Version: 1.0

Status: ✅ Production Ready

The E-Kirana Store uses a microservices architecture with JWT (JSON Web Token)–based authentication. Authentication is centralized at the API Gateway, ensuring:

• Stateless microservices
• Secure request validation
• Scalable architecture

JWT (JSON Web Token)

A self-contained token that includes:

• Identity (username)
• Roles
• Expiration

Header.Payload.Signature

 {
   "alg": "HS256",
   "typ": "JWT"
 }

 {
   "sub": "username",
   "roles": ["CUSTOMER"],
   "iat": 1713180000,
   "exp": 1713183600
 }

   HMAC-SHA256(
      base64(header) + "." + base64(payload),
      secret
    )

POST /auth/login

  {
    "username": "john",
    "password": "password"
   }

/auth/** → No validation

Request forwarded to Auth-Service

• Fetch user
• Validate password
• Check active status
• Generate JWT

     Jwts.builder()
       .setSubject(username)
       .claim("roles", role)
       .setIssuedAt(new Date())
       .setExpiration(new Date(System.currentTimeMillis() + 3600000))
       .signWith(SignatureAlgorithm.HS256, secret)
       .compact();

     {
       "token": "jwt-token",
       "username": "john",
       "role": "CUSTOMER"
     }

• Stored in localStorage
• Auto-attached via Axios interceptor

• GET /inventory/items
• Authorization: Bearer

Checks:

• Signature ✅
• Expiration ✅
• Format ✅

Adds headers:

• X-Username: john
• X-Roles: CUSTOMER

• Trusts Gateway
• Processes request

     User → Gateway → Auth-Service → JWT → Frontend

   Frontend → Gateway → Auth-Service (validate) → Microservice

  Expired Token → 401 → Logout → Re-login

• AuthContext
• Manages login/logout

• Axios Interceptor
• Adds Authorization header
• Handles 401 errors

• Cloud Gateway (9090)
• JWT validation

• Auth-Service (2040)
• Token generation
• Token validation

• Business logic only
• No authentication logic

     auth:
       jwt:
         secret: your-secret-key
         expiration: 3600000

     routes:
       - id: auth-service
         uri: http://localhost:2040
         predicates:
           - Path=/auth/**

    const API_BASE_URL = "http://localhost:9090";

• JWT signing (HS256)
• Token expiration
• Stateless auth
• Role-based access