Software Requirement Document (SRD)
Task 4 : JWT-Based Authentication & Authorization System
1. Introduction
Purpose:
The purpose of this document is to define the functional and non-functional requirements
for implementing a secure JWT-based authentication and authorization system for an e-
commerce backend application.
Scope:
The system will allow users to register and login, generate JWT access and refresh tokens,
protect APIs using role-based authorization, support logout functionality, and prevent token
misuse.
2. System Overview
Supported Roles:
- CUSTOMER
- SELLER
- ADMIN
3. Functional Requirements
3.1 User Registration
Endpoint: POST /api/auth/register
Input: Email (unique), Password, Role
Rules:
- Email must be unique
- Password must be encrypted using BCrypt
- Role must be validated against predefined roles
3.2 User Login
Endpoint: POST /api/auth/login
Input: Email, Password
Process:
- Validate credentials
- Generate access token (15 minutes expiry)
- Generate refresh token (7 days expiry)
- Store refresh token in database
Output: accessToken, refreshToken, expiresIn
3.3 Refresh Token
Endpoint: POST /api/auth/refresh
Rules:
- Refresh token must exist in database
- Must not be expired
- Must belong to a valid user
- Should NOT generate new refresh token
3.4 Logout
Endpoint: POST /api/auth/logout
Rules:
- Remove refresh token from database
- Add access token to blacklist table
- Prevent further usage of the token
3.5 Role-Based Authorization
Protected APIs:
- CUSTOMER: GET /api/customer/orders
- SELLER: POST /api/seller/products
- ADMIN: DELETE /api/admin/users/{id}
4. Database Requirements
Users Table: id, email (unique), password, role, created_at
Refresh Tokens Table: id, user_id (FK), token, expiry_date (Only one active per user)
Blacklisted Tokens Table: id, token, expiry_date
5. Security Requirements
- Password must be stored encrypted (BCrypt)
- JWT secret must not be hardcoded
- Access tokens must expire
- Refresh tokens must expire
- Use SecurityFilterChain (no deprecated configurations)
- Implement custom JWT filter using OncePerRequestFilter
6. Advanced Requirements
- Single active session per user
- Token blacklisting on logout
- Account lock after 5 failed login attempts (temporary lock)
7. Non-Functional Requirements
- API response time under 200ms under normal load
- Proper exception handling
- Consistent JSON response format
- Safe handling of concurrent login attempts
8. Acceptance Criteria
- Successful registration
- Valid JWT token generation
- Proper role-based access control
- Correct refresh token flow
- Logout invalidates tokens
- Multiple sessions prevented