Kepiye carane autentikasi lan otorisasi mlaku karo Spring Security lan JWT?

Question

IT Interview Practice · Accepted Answer

Spring Security iku **rantai filter** servlet sing nyegat saben request sadurunge tekan controller-mu. **Autentikasi** mangsuli "sapa kowe?"; **otorisasi** mangsuli "apa kowe diijini nglakoni iki?". Kanggo REST API sing stateless, pendekatan umume yaiku **JWT** (JSON Web Token) tinimbang session sisih server.

## Alur JWT

```text
POST /login (user+pass) ──▶ AuthController verifies ──▶ signs JWT ──▶ returns token
                                                                          │
Client stores it, then sends on every call:                              ▼
GET /api/orders  Authorization: Bearer <jwt> ──▶ JwtFilter validates ──▶ controller
```

Token ditandhatangani server, mula ing request sabanjure filter bisa verifikasi *tanpa pencarian database* — iku sing gawe iku stateless lan bisa diskalakan sacara horizontal.

## Ngonfigurasi rantai filter

```java
@Configuration
@EnableMethodSecurity // enables @PreAuthorize on methods
public class SecurityConfig {

@Bean
    SecurityFilterChain chain(HttpSecurity http) throws Exception {
        http
          .csrf(csrf -> csrf.disable())                 // stateless API: no CSRF cookie
          .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
          .authorizeHttpRequests(auth -> auth
              .requestMatchers("/login").permitAll()    // open endpoint
              .requestMatchers("/api/admin/**").hasRole("ADMIN") // role check
              .anyRequest().authenticated())            // everything else needs a token
          .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}
```

## Otorisasi tingkat metode

```java
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
public UserDto get(@PathVariable String userId) { /* ... */ }
```

## Kenapa iki penting

Auth iku papan kedadeyan insiden keamanan, mula pewawancara ngrungokake insting sing bener: **hash sandhi nganggo BCrypt** (aja tau nyimpen teks polos), njaga JWT umure cendhak kanthi refresh token, lan luwih becik token stateless kanggo skalabilitas nanging ngerti trade-off-e — kowe ora bisa langsung nyabut JWT tanpa denylist. Ngerti *kenapa* CSRF dipateni kanggo API token nuduhake pangerten nyata, dudu konfig copy-paste.

Alur JWT

Ngonfigurasi rantai filter

Otorisasi tingkat metode

Kenapa iki penting

Pitakon sing gegandhengan