diff --git a/README.md b/README.md index 06368f7..e68d8be 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,3 @@ # springboot-security-jwt -Secure your API with JWT Tokens + +This repository is created as an example for post I wrote on my blog: [JWT Authentication Tutorial: An example using Spring Boot](http://svlada.com/jwt-token-authentication-with-spring-boot/) diff --git a/etc/blog.md b/etc/blog.md index be32910..8de6d0d 100644 --- a/etc/blog.md +++ b/etc/blog.md @@ -709,14 +709,12 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { @Autowired private ObjectMapper objectMapper; - @Bean protected AjaxLoginProcessingFilter buildAjaxLoginProcessingFilter() throws Exception { AjaxLoginProcessingFilter filter = new AjaxLoginProcessingFilter(FORM_BASED_LOGIN_ENTRY_POINT, successHandler, failureHandler, objectMapper); filter.setAuthenticationManager(this.authenticationManager); return filter; } - @Bean protected JwtTokenAuthenticationProcessingFilter buildJwtTokenAuthenticationProcessingFilter() throws Exception { List pathsToSkip = Arrays.asList(TOKEN_REFRESH_ENTRY_POINT, FORM_BASED_LOGIN_ENTRY_POINT); SkipPathRequestMatcher matcher = new SkipPathRequestMatcher(pathsToSkip, TOKEN_BASED_AUTH_ENTRY_POINT); @@ -732,6 +730,7 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { return super.authenticationManagerBean(); } + @Override protected void configure(AuthenticationManagerBuilder auth) { auth.authenticationProvider(ajaxAuthenticationProvider); auth.authenticationProvider(jwtAuthenticationProvider); @@ -767,6 +766,21 @@ public class WebSecurityConfig extends WebSecurityConfigurerAdapter { } } ``` + +#### PasswordEncoderConfig + +BCrypt encoder that is in AjaxAuthenticationProvider. + +```language-java +@Configuration +public class PasswordEncoderConfig { + @Bean + protected BCryptPasswordEncoder passwordEncoder() { + return new BCryptPasswordEncoder(); + } +} +``` + #### BloomFilterTokenVerifier This is dummy class. You should ideally implement your own TokenVerifier to check for revoked tokens.