Yaya authentication da authorization ke aiki da Spring Security da JWT?

Question

IT Interview Practice · Accepted Answer

Spring Security wani **filter chain** ne na servlet da yake kama kowace buƙata kafin ta kai ga controller ɗinka. **Authentication** yana amsa "wanene kai?"; **authorization** yana amsa "an ba ka izinin yin wannan?". Don stateless REST APIs, hanyar da aka saba ita ce **JWT** (JSON Web Token) maimakon sessions na gefen uwar garke.

## Kwararar JWT

```text
POST /login (user+pass) ──▶ AuthController verifies ──▶ signs JWT ──▶ returns token
                                                                          │
Client stores it, then sends on every call:                              ▼
GET /api/orders  Authorization: Bearer <jwt> ──▶ JwtFilter validates ──▶ controller
```

Uwar garke tana sa hannu kan token, don haka a buƙatun baya wani filter na iya tabbatar da shi *ba tare da neman database ba* — wannan ne abin da ke sanya shi stateless kuma mai iya-sikeli a kwance.

## Saita filter chain

```java
@Configuration
@EnableMethodSecurity // enables @PreAuthorize on methods
public class SecurityConfig {

@Bean
    SecurityFilterChain chain(HttpSecurity http) throws Exception {
        http
          .csrf(csrf -> csrf.disable())                 // stateless API: no CSRF cookie
          .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
          .authorizeHttpRequests(auth -> auth
              .requestMatchers("/login").permitAll()    // open endpoint
              .requestMatchers("/api/admin/**").hasRole("ADMIN") // role check
              .anyRequest().authenticated())            // everything else needs a token
          .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}
```

## Authorization a matakin hanya

```java
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
public UserDto get(@PathVariable String userId) { /* ... */ }
```

## Me ya sa yake da muhimmanci

Auth shi ne inda abubuwan tsaro ke faruwa, don haka masu tambayoyin hira suna saurara don ilhamai daidai: **hash passwords da BCrypt** (kada ka taɓa adana plaintext), ajiye JWTs masu ɗan gajeren rayuwa da refresh tokens, kuma fifita stateless tokens don iya-sikeli amma san cinikin — ba za ka iya soke JWT nan take ba tare da denylist ba. Sanin *dalilin* da ya sa aka kashe CSRF don token APIs yana nuna fahimta ta gaske, ba configuration na kwafa-liƙawa ba.

Kwararar JWT

Saita filter chain

Authorization a matakin hanya

Me ya sa yake da muhimmanci

Tambayoyi masu alaƙa