I'm working on a Spring Boot application with Thymeleaf for the front end and want to implement JWT authentication using only spring-boot-starter-security without any external JWT libraries.

Requirements:

The JWT should be generated and validated manually using Base64 and HMAC SHA256.

The token should be stored in an HTTP-only cookie for security.

The application should have login and logout functionality with Thymeleaf templates.

Current Setup:

I'm using the following dependencies:

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-security</artifactId>

<groupId>org.springframework.boot</groupId>

<artifactId>spring-boot-starter-thymeleaf</artifactId>

Spring Security is configured to handle authentication and authorization.

Thymeleaf is used for rendering the login and home pages.

What I've Tried: I implemented a utility class to generate and validate JWTs using Base64 encoding and HMAC SHA256, a login controller to authenticate users and generate tokens, and a logout mechanism. However, I'm unsure how to structure my security configuration and validate the JWT on each request while keeping it secure.

Questions:

1. How do I validate the JWT on each request and associate it with the current user session?

2. Is storing the JWT in an HTTP-only cookie sufficient for security?

3. Are there any improvements to this approach while still using only Spring Security and Thymeleaf?

Code Snippets:

Here’s my JWT utility class:

public class JwtUtil {

private static final String SECRET_KEY = "your-256-bit-secret";

private static final String ALGORITHM = "HmacSHA256";



public String generateToken(String username) {

    // Generate token logic

}



public String extractUsername(String token) {

    // Extract username logic

}



public boolean validateToken(String token) {

    // Validate token logic

}

}

Here’s my login controller:

@Controller

public class LoginController {

@PostMapping("/login")

public String login(String username, String password, HttpServletResponse response) {

    // Authenticate user and generate JWT

}



@GetMapping("/home")

public String home() {

    return "home";

}

}

Expected Behavior:

1. Users should log in through a Thymeleaf login page.

2. A JWT token should be generated and stored in an HTTP-only cookie upon successful login.

3. The application should validate the token on every request and restrict access to authenticated users.

Any guidance, corrections, or suggestions would be appreciated!

Let me know if you want to modify this further before postin g!