title: Spring security OpenID flow using JWT for authentication
body: <p>I am trying to do authentication for my web application using widely used <a href="http://openid.net/connect/" rel="nofollow noreferrer">OpenId Connect</a> flow. </p>
  
  <p>I understand that the user who wants to authenticate on <strong>example1.com</strong> will first be redirected to the <strong>authentication server</strong> (or <code>OP</code> : "OpenId Provider"). The user authenticates on that server which then redirects him back to the original <strong>example1.com</strong> site with a signed JWT token.</p>
  
  <p><strong>Technical challenges:</strong></p>
  
  <p>I am suing <strong>spring security</strong> as part of my web application. I took a custom filter to redirect the user to <strong>authentication server</strong> and then it redirects back to my <strong>example1.com</strong> with valid <code>JWT (Json Web Token)</code>.</p>
  
  <p><strong>My Custom Filter:</strong></p>
  
  <pre><code>public class MyCustomFilter extends AbstractAuthenticationProcessingFilter {
     @Override
  
       public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response)
          throws AuthenticationException, IOException, ServletException {
           //reading the AWT access token from reqest beahder
           String token = request.getHeader("Authorization");
  
           if(token == null){
              // redirecting user to authentication server
              String accessCodeUrl = "authentication.com?query string"
              response.sendRedirect(accessCodeUrl);
           } else{
              response.addHeader("Authorization", token);
           }
           //Now how can i inject the above received token to spring security
      }
  }
  </code></pre>
  
  <p><strong>My spring xml config:</strong></p>
  
  <pre><code>&lt;security:http auto-config="false" entry-point-ref="entryPoint" disable-url-rewriting="true"&gt;
      &lt;!-- set disabled to true to remove Cross Site Request Forger support --&gt;
      &lt;security:csrf disabled="true" /&gt;
      &lt;security:intercept-url pattern="/**" access="hasAnyRole('ROLE_USER','ROLE_ADMIN')" /&gt;
      &lt;security:custom-filter ref="${MyCustomFilter }" position="PRE_AUTH_FILTER" /&gt;
      &lt;security:access-denied-handler error-page="${security.accessDeniedPage}"/&gt;
      &lt;security:headers&gt;
          &lt;security:frame-options policy="SAMEORIGIN"/&gt;
      &lt;/security:headers&gt;        
  &lt;/security:http&gt;
  </code></pre>
  
  <p>My custom filter is extending <code>AbstractAuthenticationProcessingFilter</code>. is it good fit for my requirement or should i consider extending any other filter's like <code>BasicAuthenticationFilter</code> or <code>OncePerRequestFilter</code> or <code>GenericFilterBean</code>.</p>
  
  <p>I am confused here as to take 1 or 2 filters. because first time i am redirecting to <strong>authorization server</strong>, but from second time i should use the <code>JWT token</code> provided by <strong>authentication server</strong>.</p>
  
  <p>Since i am going with <code>stateless</code> approach. I need to exchange <code>JWT token</code> every time between <strong>example.com</strong> and <strong>browser</strong>. I am using <code>ExtJs</code> as front end, what is the best practice to exchange <code>JWT token</code> between <strong>browser</strong> and <strong>example.com</strong>.</p>
  
  <p>As per my understanding i should send <code>JWT token</code> every time from <strong>browser</strong> along with every request. Does that mean should i manually inject every time <code>JWT token</code> as part of <code>Ajax request</code> or Do we have some approach to append to all the outgoing <code>Ajax requests</code>.</p>