Mastering Stateless Authentication with Spring Security 6 and JWT

The Shift to Stateless Architectures

When architecting scalable SaaS platforms, managing user sessions in server memory becomes a massive bottleneck. Stateless authentication via JSON Web Tokens (JWT) solves this by pushing the session state to the client, perfectly complementing modular, containerized backend services.

Why Spring Security 6?

With the release of Spring Boot 3, Spring Security 6 introduced major architectural changes. The deprecated WebSecurityConfigurerAdapter is gone, replaced by a component-based configuration utilizing the SecurityFilterChain bean. This forces a cleaner, more modular approach to defining access rules.

The Authentication Flow

A standard JWT flow in a Spring Boot application involves several customized layers:

• Authentication Endpoint: The client sends credentials. The AuthenticationManager verifies them against the database.
• Token Generation: Upon success, a utility class signs a JWT using a secure secret key (HS256 or RS256), embedding the user's roles as claims.
• The JWT Filter: A custom OncePerRequestFilter intercepts every incoming request, extracts the Bearer token from the Authorization header, validates the signature, and populates the SecurityContextHolder.

Configuring the Security Filter Chain

Here is a conceptual look at how you secure endpoints in Spring Security 6 while leaving auth routes open:

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http.csrf(AbstractHttpConfigurer::disable)
        .cors(Customizer.withDefaults())
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/api/auth/**").permitAll()
            .requestMatchers("/api/admin/**").hasRole("ADMIN")
            .anyRequest().authenticated()
        )
        .sessionManagement(session -> session
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        )
        .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

    return http.build();
}
      

"Security is not a feature you bolt on at the end; it is the foundation of your API architecture."

By enforcing role-based access control directly in the filter chain, we guarantee that our RESTful APIs remain locked down, scalable, and entirely stateless.

Image credit: Unsplash