[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"question-spring-kak-nastroit-autentifikatsiyu-na-osnove-jwt-v-spring-security":3},{"id":4,"slug":5,"topicId":6,"topicSlug":7,"topicName":8,"topicEmoji":9,"question":10,"answer":11,"codeLang":12,"codeSrc":12,"important":12,"commonMistakes":12,"modernUsage":12,"difficulty":13,"tags":14,"related":15,"progress":16,"seo":17},650,"kak-nastroit-autentifikatsiyu-na-osnove-jwt-v-spring-security",14,"spring","Spring","🌱","Как настроить аутентификацию на основе JWT в Spring Security?","JWT (JSON Web Token) -- компактный самодостаточный формат токена для аутентификации в REST API. Структура: `HEADER.PAYLOAD.SIGNATURE`.\n\n\u003Cdetails>\n\u003Csummary>JwtTokenProvider -- генерация и валидация токенов\u003C\u002Fsummary>\n\n```java\n@Component\npublic class JwtTokenProvider {\n\n    @Value(\"${jwt.secret}\")\n    private String secret;\n\n    @Value(\"${jwt.expiration-ms}\")\n    private long expirationMs;\n\n    private SecretKey getSigningKey() {\n        return Keys.hmacShaKeyFor(Decoders.BASE64.decode(secret));\n    }\n\n    public String generateToken(UserDetails userDetails) {\n        Map\u003CString, Object> claims = new HashMap\u003C>();\n        claims.put(\"roles\", userDetails.getAuthorities().stream()\n                .map(GrantedAuthority::getAuthority).collect(Collectors.toList()));\n        return Jwts.builder()\n                .claims(claims)\n                .subject(userDetails.getUsername())\n                .issuedAt(new Date())\n                .expiration(new Date(System.currentTimeMillis() + expirationMs))\n                .signWith(getSigningKey())\n                .compact();\n    }\n\n    public String getUsernameFromToken(String token) {\n        return Jwts.parser().verifyWith(getSigningKey()).build()\n                .parseSignedClaims(token).getPayload().getSubject();\n    }\n\n    public boolean validateToken(String token) {\n        try {\n            Jwts.parser().verifyWith(getSigningKey()).build().parseSignedClaims(token);\n            return true;\n        } catch (JwtException | IllegalArgumentException e) {\n            return false;\n        }\n    }\n}\n```\n\n\u003C\u002Fdetails>\n\n\u003Cdetails>\n\u003Csummary>JwtAuthenticationFilter\u003C\u002Fsummary>\n\n```java\n@Component\npublic class JwtAuthenticationFilter extends OncePerRequestFilter {\n\n    @Autowired private JwtTokenProvider tokenProvider;\n    @Autowired private UserDetailsService userDetailsService;\n\n    @Override\n    protected void doFilterInternal(HttpServletRequest request,\n                                     HttpServletResponse response,\n                                     FilterChain filterChain) throws ServletException, IOException {\n        String token = extractToken(request);\n        if (token != null && tokenProvider.validateToken(token)) {\n            String username = tokenProvider.getUsernameFromToken(token);\n            UserDetails userDetails = userDetailsService.loadUserByUsername(username);\n            UsernamePasswordAuthenticationToken authentication =\n                    new UsernamePasswordAuthenticationToken(\n                            userDetails, null, userDetails.getAuthorities());\n            SecurityContextHolder.getContext().setAuthentication(authentication);\n        }\n        filterChain.doFilter(request, response);\n    }\n\n    private String extractToken(HttpServletRequest request) {\n        String header = request.getHeader(\"Authorization\");\n        if (header != null && header.startsWith(\"Bearer \")) {\n            return header.substring(7);\n        }\n        return null;\n    }\n}\n```\n\n\u003C\u002Fdetails>\n\n### Контроллер аутентификации\n\n```java\n@RestController\n@RequestMapping(\"\u002Fapi\u002Fauth\")\npublic class AuthController {\n    @PostMapping(\"\u002Flogin\")\n    public ResponseEntity\u003CAuthResponse> login(@RequestBody @Valid LoginRequest request) {\n        Authentication auth = authenticationManager.authenticate(\n                new UsernamePasswordAuthenticationToken(request.getUsername(), request.getPassword()));\n        String token = tokenProvider.generateToken((UserDetails) auth.getPrincipal());\n        return ResponseEntity.ok(new AuthResponse(token));\n    }\n}\n```\n\n> **На собеседовании:** покажите понимание полного flow: логин -> генерация токена -> фильтр извлекает и проверяет токен -> установка SecurityContext. Частая ошибка -- хранить JWT-секрет в коде, делать слишком долгий TTL access-токена (рекомендуется 15-30 минут), не обрабатывать истечение токена (500 вместо 401).","","senior",[7],[],null,{"title":18,"description":19,"ogTitle":18,"ogDescription":20,"keywords":21,"schemaAnswer":19,"featuredSnippetReady":22},"Как настроить аутентификацию на основе JWT в Spring Security — Gymterview","JWT (JSON Web Token) -- компактный самодостаточный формат токена для аутентификации в REST API. Структура: `HEADER.PAYLOAD.SIGNATURE`.","JWT (JSON Web Token) -- компактный самодостаточный формат токена для аутентификации в REST API. Структура: `HEADER.PAYLO",[7,13],true]