How do authentication and authorization work with Spring Security and JWT?

Question

IT Interview Practice · Accepted Answer

Spring Security is a servlet **filter chain** that intercepts every request before it reaches your controller. **Authentication** answers "who are you?"; **authorization** answers "are you allowed to do this?". For stateless REST APIs, the common approach is **JWT** (JSON Web Token) instead of server-side sessions.

## The JWT flow

```text
POST /login (user+pass) ──▶ AuthController verifies ──▶ signs JWT ──▶ returns token
                                                                          │
Client stores it, then sends on every call:                              ▼
GET /api/orders  Authorization: Bearer <jwt> ──▶ JwtFilter validates ──▶ controller
```

The token is signed by the server, so on later requests a filter can verify it *without a database lookup* — that is what makes it stateless and horizontally scalable.

## Configuring the filter chain

```java
@Configuration
@EnableMethodSecurity // enables @PreAuthorize on methods
public class SecurityConfig {

@Bean
    SecurityFilterChain chain(HttpSecurity http) throws Exception {
        http
          .csrf(csrf -> csrf.disable())                 // stateless API: no CSRF cookie
          .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
          .authorizeHttpRequests(auth -> auth
              .requestMatchers("/login").permitAll()    // open endpoint
              .requestMatchers("/api/admin/**").hasRole("ADMIN") // role check
              .anyRequest().authenticated())            // everything else needs a token
          .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}
```

## Method-level authorization

```java
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
public UserDto get(@PathVariable String userId) { /* ... */ }
```

## Why it matters

Auth is where security incidents happen, so interviewers listen for correct instincts: **hash passwords with BCrypt** (never store plaintext), keep JWTs short-lived with refresh tokens, and prefer stateless tokens for scalability but know the trade-off — you cannot instantly revoke a JWT without a denylist. Knowing *why* CSRF is disabled for token APIs shows real understanding, not copy-paste config.

The JWT flow

Configuring the filter chain

Method-level authorization

Why it matters

Related questions