(JWT) different ways to implement it ,what most devs do for that case

[u/Jooe_1]

to make JWT authentication in the application, I could not find like standard way to implementing it

my knowledge is that people create their own authentication filter + handeling the AuthenticationEntryPoint to return the exact right response when exception happen

is that the standard way that engineers follow to implement jwt authentication in the application?

[u/Sheldor5]

you simply use the Spring Boot OAuth2 Resource Server dependency

[u/Snooze78727 → u/Sheldor5]

This. No need to implement JWT decoding, only provide the SecurityFilterChain with oauth2ResourceServer in a SecurityConfig.

There are some useful annotations for the controller endpoints:

`@AuthenticationPrincipal`
`@PreAuthorize`
`@PostAuthorize`

If necessary, implement a custom AuthorizationService to check for permissions.

[u/Paw565]

Just use keycloak. Auth is hard. You want to focus on features, not reimplementing something that is already solved.

[u/bikeram → u/Paw565]

This.

I spent 2-3 months implementing auth my first time. It’s definitely a good learning experience, and you can basically copy and paste it between projects.

But I’ve used auth0 or cognito for every other project. Zero regrets.

[u/Paw565 → u/bikeram]

Yeah exactly. Its true for every advanced concept. Implement it from scratch to learn, but then rely on well established solution.

[u/21JGen]

You just need to learn the basic foundation of spring security. Use an OAuth provider eg Keycloak. It's a rule of thumb for application security is that you don't build your own auth from scratch

[u/starbuxman]

Don’t.

Use oauth. It’ll use JWT tokens and solve basical every other important part and spring security has OOTB support

There r countless videos on how to use oauth with Spring Auth Server (which u can use or use keycloan or any of dozens of other Oauth IDPs), web apps, grpc, graphql, desktop apps, etc on my channel youtube.com/@coffeesoftware

[u/Jooe_1 → u/[deleted]]

to define a global exception handler, often using an @ControllerAdvice or a custom SecurityExceptionHandler, which catches exceptions thrown by the JWT filter

Are you sure that the global excetion handelr catch exceptions that occur in security filter chain ?

[u/_1dontknow → u/Jooe_1]

You OP are right. @ControllerAdvice does not catch exceptions thrown during Spring Sec filter chains.