In the previous video, we have made some changes inside our project, which will help us generating
the JWT token like importing the dependencies inside the bombed out example, disabling the CSR of making
the configurations inside cards along with the stopping the default generated token by leveraging session
creation policy.
So now in this video, let's try to create two filters.
One needs to generate the token and other one is to validate the JWT token for each and every request
that is coming from the client.
So to achieve this first, I create a folder with the name JWT Token Generator Filter.
So you can see here this filter extends once request filter, which indicates that this will that is
going to run only once per each request.
And at the same time, I also read the method should not filter and implement the logic that my filter
should be executed only during the login request, since inside my application slash user is a login
request.
But I have mentioned that whenever my part is not equal to slash user, then should not filter or should
not apply my filter, which will make sure that this filter will get executed only when the user trying
to login into my application.
So the logic of generating the token is present inside this matter.
Where I am going to configure this filter for authentication is successful inside spring security framework
and I'm going to configure this as an after filter.
So once authentication is successful, I can get the authentication values from the security contacts
holder.
And by leveraging a secret key that I'm maintaining inside my back and somewhere along with the algorithm,
I'm going to build a JWT token.
And inside that JWT token, I'm going to set a lot of information.
One is who is the issuer of that JWT token?
What is the subject of the token?
And at the same time claims we can set any number of claims.
Claim is a value that goes inside our payload.
And these are the information that you want to share to the other people.
Are you want to store for us and for future reference.
So one value that I'm going to put inside my token is the user name, which I get based upon the authentication
object.
And the other one is what are the authorities of the logged in user posts that I'm also going to set?
What is the issue at the time for the token?
And we can also set an expiration of that token to make it simple.
I'm going to give a smaller milliseconds value.
So thirty thousand milliseconds means this token will expire within 30 seconds and you can see the JWT
beauty while violating the token.
JWT will make sure that if the token is expires, it will throw an error to the user.
So lastly, we have to sign it with the key based upon our algorithm and secret key.
And at last we call compact matter to generate a JWT with header body and the signature key.
So once I had that JWT encoded values along with my signature key, I am going to set that inside my
response header with the value authorization.
So this is the header that we configure inside our cards configurations to allow to send it to the UI
application.
So this filter will make sure to generate the JWT token when our user tried to login into my application.
Next, I have to write one more filter to validate this data.
Token that card generator for all the requests other than the login.
The fact that I am going to write a new filter with the name JWT Token Validator Filter.
So as you can expect, this filter also extends once per request filter.
And I am going to configure this filter as a before authorization and authentication because since already
authentication is happening, we have to make sure the token is compromised.
We need to invalidate the request and send it to the UI application.
So the logic here, you can see I also have implemented should not filter, which indicates that this
filter should not be applied for the login request, which is user y for all other parts.
This filter has to be.
Apply when this filter is getting executed, are you?
The application has to send the token value inside the request header with the same name authorization.
So I'm going to populate that value from my header once I have the JWT token with the same secret key
and algorithm that we used before, we are going to generate a new hash value compared with the already
hash value present inside the JWT token to make sure that the values are not amper.
If there is any issue happens during this code of execution, I'll get an exception and I'm going to
return the invalid token received to the printer.
If everything goes well, what I'm going to do is I'm going to take the username and authorities from
the token and build the new authentication object and set it into the security context.
Holder, you can see here my back in server is not storing anything based upon the JWT token.
Every time I generally to authenticate an object without actually looking into the database for the
credentials and validating the user based upon the JWT token values.
And I think that integration object inside my security contacts.
Holder So once my code execution passes this filter, it will go to the business logic and my spring
security framework will make sure that if all the authorities associated to that user is proper, it
will allow the execution.
But if someone amperes this user name or authorities, obviously this code of execution will fail and
will get an exception.
And you can see this past clumsier method will throw exceptions related to expired JWT exception.
Like Venner, our token is expired.
This exception will come and support that MusclePharm signature illegal.
All these exceptions will be thrown in the case of AMPA.
So now we made the changes to create the filters.
Let's try to configure these filters inside spring security configurations for the same.
I go to the project security config and we already created previously some filters at the same place
and going to add the new regenerator filters.
And you can see here how are the newly generated filters?
JWT token generator filter will be used to generate the tokens and that will get executer after the
basic authentication filter completes and it will exist only during the logging operation.
And similarly, JWT token validator filter will be executed before the authentication for each request
other than the login to make sure the token validation is successful or not.
So now we have made all the required changes and the backend.
But on the front end also we have to capture this authentication at their value and we need to make
sure that every request that is coming to the backend as to how that value present inside the header
to achieve the same, let's try to make some changes on the inside code, also to send the authorization
JWT token as part of the header inside request every time my client application is making a request
to the back backend.
Thank you and see you in the next release by.