Spring Security & JWT
Securing Spring Boot REST APIs: password hashing with PasswordEncoder and BCrypt, JWT structure and signing algorithms, a complete JWT authentication filter and Spring Security 6 configuration, JJWT 0.12, refresh tokens, logout and the security pitfalls interviewers ask about.
Password Encoding with PasswordEncoder
Why passwords must be hashed, how PasswordEncoder's encode() and matches() work at registration and login, salting, how Spring Security authenticates a username and password, and choosing an encoder.
BCrypt Password Hashing in Java
Encoding and verifying passwords with BCryptPasswordEncoder, why the same password gives different hashes, the structure of a BCrypt hash, the cost factor, and why BCrypt beats SHA-256 for passwords.
JWT Structure & Signing Algorithms
Header, payload and signature, Base64URL and standard claims, how HS256 / HMAC signing and verification work, HS256 vs RS256 vs ES256, and why a JWT is signed but not encrypted.
JWT Authentication in Spring Boot
Sessions vs JWT, the login and request flow end to end, a custom OncePerRequestFilter, wiring it into a Spring Security 6 SecurityFilterChain, role-based access with @PreAuthorize, refresh tokens, and how to explain it in an interview.
Implementing JWT with JJWT
The JJWT 0.12 dependencies, a complete thread-safe token provider for generating and validating tokens, what happens under the hood during creation and parsing, the exceptions to handle, and the old API you will still see in tutorials.
JWT Security & Interview Scenarios
The pros and cons of JWT, logout and revocation, refresh-token rotation, XSS vs CSRF and where to store tokens, the alg-none and algorithm-confusion attacks, best practices, and the senior-level questions interviewers ask.