Authentication na authorization hufanyaje kazi kwa Spring Security na JWT?

Question

IT Interview Practice · Accepted Answer

Spring Security ni **filter chain** ya servlet inayozuia kila ombi kabla halijafika kwa controller yako. **Authentication** hujibu "wewe ni nani?"; **authorization** hujibu "unaruhusiwa kufanya hili?". Kwa REST APIs zisizo na state (stateless), njia ya kawaida ni **JWT** (JSON Web Token) badala ya sessions za upande wa server.

## Mtiririko wa JWT

```text
POST /login (user+pass) ──▶ AuthController verifies ──▶ signs JWT ──▶ returns token
                                                                          │
Client stores it, then sends on every call:                              ▼
GET /api/orders  Authorization: Bearer <jwt> ──▶ JwtFilter validates ──▶ controller
```

Token hutiwa saini na server, hivyo kwenye maombi ya baadaye filter inaweza kuithibitisha *bila kutafuta database* — hilo ndilo linalofanya iwe stateless na inayopanuka kwa usawa (horizontally scalable).

## Kusanidi filter chain

```java
@Configuration
@EnableMethodSecurity // enables @PreAuthorize on methods
public class SecurityConfig {

@Bean
    SecurityFilterChain chain(HttpSecurity http) throws Exception {
        http
          .csrf(csrf -> csrf.disable())                 // stateless API: no CSRF cookie
          .sessionManagement(s -> s.sessionCreationPolicy(STATELESS))
          .authorizeHttpRequests(auth -> auth
              .requestMatchers("/login").permitAll()    // open endpoint
              .requestMatchers("/api/admin/**").hasRole("ADMIN") // role check
              .anyRequest().authenticated())            // everything else needs a token
          .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);
        return http.build();
    }
}
```

## Authorization ya ngazi ya method

```java
@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
public UserDto get(@PathVariable String userId) { /* ... */ }
```

## Kwa nini ni muhimu

Auth ndipo matukio ya usalama hutokea, hivyo wahoji husikiliza silika sahihi: **hash passwords kwa BCrypt** (usihifadhi kamwe plaintext), weka JWTs za muda mfupi zenye refresh tokens, na pendelea stateless tokens kwa upanuzi lakini ujue maafikiano — huwezi kufuta JWT papo hapo bila denylist. Kujua *kwa nini* CSRF imezimwa kwa token APIs kunaonyesha uelewa halisi, si config ya kunakili-kubandika.

Mtiririko wa JWT

Kusanidi filter chain

Authorization ya ngazi ya method

Kwa nini ni muhimu

Maswali yanayohusiana