title: Spring boot security for standalone rest services
body: <p>Let's say I'm building a Spring Boot REST service which has endpoints</p>
  
  <pre><code>/users/myself
  /users/myself/books
  </code></pre>
  
  <p>and I have users and books stored in the DB.</p>
  
  <p>Of course you need to be authenticated to access these resources, but whenever I search for "Spring Rest security" it gives you basically three options</p>
  
  <ol>
  <li>Basic Auth</li>
  <li>OAuth2</li>
  <li>JWT tokens</li>
  </ol>
  
  <p>And you barely see anyone proposing using sessions for authentication, which doesn't make sense to me, especially in small standalone services. And here is why:</p>
  
  <ol>
  <li>Basic auth is never good idea for authentication, because that would require storing username:password in some storage to keep user authenticated.</li>
  <li>OAuth2 seems to be unusable for this use case where we don't have a dedicated authorization server. And having a built-in authorization server in a spring boot app seems an overkill to me and serves no advantage over sessions.</li>
  <li>If you really create a stateless JWT token, then that brings a ton of security issues - not able to revoke the token. If you keep a list of tokens in DB then it's no longer a stateless REST service and essentially acts like sessions, except you have to build ton of custom logic to make it work while session handling comes OOTB in Spring.</li>
  </ol>
  
  <p>So why the heck not use sessions for authentication?</p>