title: JWT with spring-boot and spring-security
body: <p>I am very new to Spring-Security. I am trying to implement <code>JWT</code> in my <code>spring-boot</code> application to perform <code>authentication</code>. I followed on example code and I am able to generate <code>jwt</code>. But as per the configurations done in the example files, I can validate the input in the <code>HttpRequest</code> with the in-memory data set in the configuration. But, I am not understanding how to check the <code>username</code> and <code>password</code> sent in the <code>request</code> with the values present in my <code>database</code>. Please guide me. My Configuration classes are</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
      http.csrf().disable().authorizeRequests()
              .antMatchers("/").permitAll()
              .antMatchers(HttpMethod.POST, "/login").permitAll()
              .anyRequest().authenticated()
              .and()
              // We filter the api/login requests
              .addFilterBefore(new JWTLoginFilter("/login", authenticationManager()),
                      UsernamePasswordAuthenticationFilter.class)
              // And filter other requests to check the presence of JWT in header
              .addFilterBefore(new JWTAuthenticationFilter(),
                      UsernamePasswordAuthenticationFilter.class);
  }
  
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
      // Create a default account
      auth.inMemoryAuthentication()
              .withUser("admin")
              .password("password")
              .roles("ADMIN");
  }
  }
  </code></pre>
  
  <p>Here in the overrided <code>configure(AuthenticationManagerBuilder auth) throws Exception</code>, I am able to set the credentials which will be compared with the credentials present in the <code>request</code> for <code>/login</code> path</p>
  
  <pre><code>public class TokenAuthenticationService {
  
  static final long EXPIRATIONTIME = 864_000_000; // 10 days
  static final String SECRET = "ThisIsASecret";
  static final String TOKEN_PREFIX = "Bearer";
  static final String HEADER_STRING = "Authorization";
  
  static void addAuthentication(HttpServletResponse res, String username)     {
      String JWT = Jwts.builder()
              .setSubject(username)
              .setExpiration(new Date(System.currentTimeMillis() + EXPIRATIONTIME))
              .signWith(SignatureAlgorithm.HS512, SECRET)
              .compact();
      res.addHeader(HEADER_STRING, TOKEN_PREFIX + " " + JWT);
  }
  
  static Authentication getAuthentication(HttpServletRequest request) {
      String token = request.getHeader(HEADER_STRING);
      if (token != null) {
          // parse the token.
          String user = Jwts.parser()
                  .setSigningKey(SECRET)
                  .parseClaimsJws(token.replace(TOKEN_PREFIX, ""))
                  .getBody()
                  .getSubject();
  
          return user != null ?
                  new UsernamePasswordAuthenticationToken(user, null, Collections.emptyList()) :
                  null;
      }
      return null;
  }
  }
  
  public class JWTLoginFilter extends AbstractAuthenticationProcessingFilter {
  
  public JWTLoginFilter(String url, AuthenticationManager authManager) {
  super(new AntPathRequestMatcher(url));
  setAuthenticationManager(authManager);
  }
  
  @Override
  public Authentication attemptAuthentication(
          HttpServletRequest req, HttpServletResponse res)
          throws AuthenticationException, IOException, ServletException {
      AccountCredentials creds = new ObjectMapper()
              .readValue(req.getInputStream(), AccountCredentials.class);
      return getAuthenticationManager().authenticate(
              new UsernamePasswordAuthenticationToken(
                      creds.getUsername(),
                      creds.getPassword(),
                      Collections.emptyList()
              )
      );
  }
  
  @Override
  protected void successfulAuthentication(
          HttpServletRequest req,
          HttpServletResponse res, FilterChain chain,
          Authentication auth) throws IOException, ServletException {
      TokenAuthenticationService
              .addAuthentication(res, auth.getName());
  }
  }
  
  public class JWTAuthenticationFilter extends GenericFilterBean{
  
  @Override
  public void doFilter(ServletRequest request,
                       ServletResponse response,
                       FilterChain filterChain)
          throws IOException, ServletException {
      Authentication authentication = TokenAuthenticationService
              .getAuthentication((HttpServletRequest)request);
  
      SecurityContextHolder.getContext()
              .setAuthentication(authentication);
      filterChain.doFilter(request,response);
  }
  }
  </code></pre>