11.
Validating Token
How to validate a JWT (JSON Web Token) in a Spring-based application using a
JwtService class. Below is a detailed breakdown of the code and its components,
with theoretical explanations for each object and method.
Purpose of JWT Validation
JWT validation is crucial in securing APIs and ensuring that only authenticated
users with valid tokens can access protected resources. It involves:
1. Decoding the token to extract claims (e.g., username).
2. Verifying the token's signature to ensure its authenticity.
3. Checking the token's expiration and other validity criteria.
Code Breakdown and Explanation
1. Extracting the Username
Example:
public String extractUserName(String token) {
return extractClaim(token, Claims::getSubject);
}
Explanation:
● The extractUserName method retrieves the subject field from the JWT. This
typically contains the username or the unique identifier of the user.
● The Claims::getSubject is a functional reference to extract the subject claim
from the token.
2. Generic Claim Extraction
Example:
private <T> T extractClaim(String token, Function<Claims, T> claimResolver) {
final Claims claims = extractAllClaims(token);
return [Link](claims);
}
Explanation:
● This generic method extracts a specific claim from the token using a
Function to resolve the desired claim.
● It takes:
○ token: The JWT string.
○ claimResolver: A functional interface used to extract a specific claim,
such as the subject or expiration time.
3. Extracting All Claims
Example:
private Claims extractAllClaims(String token) {
return [Link]()
.setSigningKey(getKey())
.build()
.parseClaimsJws(token)
.getBody();
}
Explanation:
● [Link]():
○ Used to create a JWT parser.
● setSigningKey(getKey()):
○ Sets the signing key used to validate the token's signature. The
getKey() method provides the secret or public key for validation.
● parseClaimsJws(token):
○ Parses the JWT and verifies its signature.
● getBody():
○ Extracts the claims (payload) from the token.
4. Validating the Token
Example:
public boolean validateToken(String token, UserDetails userDetails) {
final String userName = extractUserName(token);
return ([Link]([Link]()) &&
!isTokenExpired(token));
}
Explanation:
● Steps in Token Validation:
○ Extracts the username from the token using the extractUserName
method.
○ Compares the extracted username with the UserDetails object's
username to ensure the token belongs to the correct user.
○ Calls isTokenExpired to ensure the token has not expired.
● Returns:
○ true if:
■ The token username matches the UserDetails username.
■ The token is not expired.
○ false otherwise.
5. Checking Token Expiration
Example:
private boolean isTokenExpired(String token) {
return extractExpiration(token).before(new Date());
}
Explanation:
● extractExpiration(token):
○ Retrieves the token's expiration date from its claims.
● before(new Date()):
○ Checks if the expiration date is earlier than the current date, indicating
that the token has expired.
6. Extracting Expiration Date
Example:
private Date extractExpiration(String token) {
return extractClaim(token, Claims::getExpiration);
}
Explanation:
● Uses the extractClaim method to retrieve the expiration claim from the JWT.
● The Claims::getExpiration functional reference is used to access the
expiration field in the claims.
Supporting Method: getKey
While not explicitly shown in the provided code, the getKey method is assumed to
provide the key (either a secret key or public key) used for signing the JWT. For
example:
Example:
private Key getKey() {
byte[] keyBytes = [Link](secretKey);
return [Link](keyBytes);
}
Explanation:
● Decodes a Base64-encoded secret key into bytes.
● Converts the byte array into an HMAC-SHA key using
[Link].
Workflow Summary
1. Extract Username:
○ The extractUserName method decodes the token and retrieves the
subject field, which represents the username.
2. Validate Token:
○ Checks that the token belongs to the correct user and that it has not
expired.
3. Verify Signature:
○ The extractAllClaims method ensures the token's integrity by
verifying its signature with the signing key.
4. Expiration Check:
○ Ensures the token has not exceeded its validity period.
Key Objects and Concepts
● JWT (JSON Web Token):
○ A compact, URL-safe token format used for securely transmitting
information between parties.
● Claims:
○ The payload of the JWT, which contains user-specific data (e.g.,
username) and metadata (e.g., expiration time).
● Signature:
○ Ensures the token has not been tampered with by verifying it using the
signing key.
● Jwts Class:
○ Part of the JJWT library, it provides utilities for parsing and
generating JWTs.
Practical Use Case
● The validateToken method ensures that only requests with valid, unexpired
JWTs are processed further.
● If validation fails (e.g., due to token tampering or expiration), the user is
denied access.
This design ensures robust, stateless security for APIs using JWT authentication.