Authentication

Overview

EduTec Backend implements a stateless authentication system using JSON Web Tokens (JWT). This approach eliminates the need for server-side session storage, making the API scalable and suitable for distributed environments.

The application uses jjwt library version 0.11.5 for JWT operations, providing modern cryptographic standards and comprehensive token management.

Authentication Flow

The authentication process follows these steps:

┌──────────┐                  ┌──────────────┐                  ┌────────────┐
│  Client  │                  │ AuthController│                  │ JwtService │
└─────┬────┘                  └──────┬───────┘                  └─────┬──────┘
      │                              │                                 │
      │  POST /auth/login            │                                 │
      │  {username, password}        │                                 │
      ├─────────────────────────────>│                                 │
      │                              │                                 │
      │                              │  generateToken(username)        │
      │                              ├────────────────────────────────>│
      │                              │                                 │
      │                              │         JWT Token               │
      │                              │<────────────────────────────────┤
      │                              │                                 │
      │         JWT Token            │                                 │
      │<─────────────────────────────┤                                 │
      │                              │                                 │

Client sends credentials to /auth/login
Controller receives and extracts the LoginRequest DTO
Controller delegates token generation to JwtService
Service creates a signed JWT with username and expiration
Token is returned to the client as a plain string
Client includes token in subsequent requests via Authorization header

The current implementation does not validate credentials against the database. The login endpoint generates tokens for any username without password verification. This should be enhanced with proper authentication logic before production deployment.

JWT Service Implementation

The JwtService class handles all token operations using the JJWT library.

Service Configuration

// src/main/java/com/tecmilenio/edutec/security/JwtService.java:1-13
package com.tecmilenio.edutec.security;

import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import io.jsonwebtoken.security.Keys;
import org.springframework.stereotype.Service;

import java.util.Date;
import java.security.Key;

@Service
public class JwtService {
    // Clave de al menos 32 caracteres
    private static final String SECRET_KEY = "12345678910111213141516171819200";
    // pre-generando la llave criptográfica solo cuando inicia la aplicación
    private static final Key KEY = Keys.hmacShaKeyFor(SECRET_KEY.getBytes());

@Service Annotation
SECRET_KEY
KEY

Marks this class as a Spring-managed service component, making it available for dependency injection throughout the application.

A pre-computed cryptographic Key object generated using HMAC-SHA algorithm. Computing this once at class initialization improves performance by avoiding repeated key generation.

Token Generation

The generateToken() method creates a signed JWT containing the username and expiration time:

// src/main/java/com/tecmilenio/edutec/security/JwtService.java:19-27
public String generateToken(String username) {
    return Jwts.builder()
            .setSubject(username)
            .setIssuedAt(new Date(System.currentTimeMillis()))
            .setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10))
            // Fíjate en el orden: primero la llave, luego el algoritmo
            .signWith(KEY, SignatureAlgorithm.HS256)
            .compact();
}

Token Claims

Subject (sub)

Value: Username provided during loginPurpose: Identifies the user this token belongs to

.setSubject(username)

The subject is the primary identifier stored in the token. Subsequent requests can extract this to determine which user is making the request.

Issued At (iat)

Value: Current timestamp in millisecondsPurpose: Records when the token was created

.setIssuedAt(new Date(System.currentTimeMillis()))

Useful for auditing, token refresh logic, and debugging authentication issues.

Expiration (exp)

Value: Current time + 10 hours (36,000,000 milliseconds)Purpose: Defines token validity period

.setExpiration(new Date(System.currentTimeMillis() + 1000 * 60 * 60 * 10))

Calculation breakdown:

1000 ms = 1 second
* 60 = 1 minute
* 60 = 1 hour
* 10 = 10 hours

Tokens automatically become invalid after 10 hours, requiring users to re-authenticate. This balance between convenience and security can be adjusted based on your requirements.

Signature

Algorithm: HMAC-SHA256 (HS256)Key: Pre-computed KEY from the secret

.signWith(KEY, SignatureAlgorithm.HS256)

The signature ensures:

Integrity: Token data hasn’t been modified
Authenticity: Token was issued by this server
Non-repudiation: Only holders of the secret key can create valid tokens

HMAC-SHA256 is a symmetric algorithm, meaning the same key signs and verifies tokens. For asymmetric scenarios (microservices, distributed systems), consider RSA or ECDSA algorithms.

Token Format

Generated tokens follow the standard JWT format:

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqb2huZG9lIiwiaWF0IjoxNzA5MjQwMDAwLCJleHAiOjE3MDkyNzYwMDB9.signature
│─────── Header ──────│──────────────────── Payload ────────────────────────│─ Signature ─│

Header: Algorithm and token type (Base64 encoded)
Payload: Claims including subject, issued at, expiration (Base64 encoded)
Signature: HMAC-SHA256 signature to verify integrity

You can decode tokens at jwt.io for debugging (never share tokens containing sensitive data).

Auth Controller

The AuthController provides the public API endpoint for authentication.

// src/main/java/com/tecmilenio/edutec/controller/AuthController.java:1-21
package com.tecmilenio.edutec.controller;

import com.tecmilenio.edutec.dto.LoginRequest;
import com.tecmilenio.edutec.security.JwtService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.*;

@RestController
@RequestMapping("/auth")
public class AuthController {
    @Autowired
    private JwtService jwtService;

    @PostMapping("/login")
    public String login(@RequestBody LoginRequest loginRequest) {
        System.out.println("El usuario " + loginRequest.getUsername() + " está intentando entrar");
        return jwtService.generateToken(loginRequest.getUsername());
    }
}

Endpoint: POST /auth/login Request Body:

{
  "username": "string",
  "password": "string"
}

Response: Plain text JWT string

eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqb2huZG9lIiwiaWF0IjoxNzA5MjQwMDAwLCJleHAiOjE3MDkyNzYwMDB9.KqJ8z9X...

Status Code: 200 OK

The controller currently logs authentication attempts to the console. Consider using a proper logging framework (SLF4J/Logback) for production applications.

The LoginRequest class structures incoming authentication requests:

// src/main/java/com/tecmilenio/edutec/dto/LoginRequest.java:1-31
package com.tecmilenio.edutec.dto;

public class LoginRequest {
    private String username;
    private String password;

    public LoginRequest() {
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

Fields:

username - User’s unique identifier
password - User’s password (currently not validated)

Design Pattern: Plain Old Java Object (POJO) with getter/setter methods

Spring automatically deserializes JSON request bodies into this DTO using Jackson. The empty constructor is required for this process.

Security Best Practices

Current Implementation Gaps

The following security measures are missing from the current implementation:

Password Verification: Credentials are not validated against the database
Password Hashing: No BCrypt or similar hashing for stored passwords
Token Validation: No middleware to verify tokens on protected endpoints
Secret Management: Hardcoded secret key in source code
HTTPS Enforcement: No SSL/TLS configuration specified
Rate Limiting: No protection against brute force attacks
Input Validation: No checks for empty/null username or password

Recommended Enhancements

1. Implement Password Verification

Add a UserService to authenticate credentials:

@Service
public class AuthService {
    @Autowired
    private UserRepository userRepository;
    
    @Autowired
    private PasswordEncoder passwordEncoder;
    
    public boolean authenticate(String username, String password) {
        User user = userRepository.findByUsername(username)
            .orElseThrow(() -> new UnauthorizedException("Invalid credentials"));
        
        return passwordEncoder.matches(password, user.getPassword());
    }
}

2. Add Token Validation Filter

Create a filter to verify JWTs on protected endpoints:

@Component
public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Autowired
    private JwtService jwtService;
    
    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                  HttpServletResponse response,
                                  FilterChain filterChain) {
        String token = extractToken(request);
        if (token != null && jwtService.validateToken(token)) {
            String username = jwtService.extractUsername(token);
            // Set authentication in SecurityContext
        }
        filterChain.doFilter(request, response);
    }
}

Add validation methods to JwtService:

public boolean validateToken(String token) {
    try {
        Jwts.parserBuilder()
            .setSigningKey(KEY)
            .build()
            .parseClaimsJws(token);
        return true;
    } catch (JwtException e) {
        return false;
    }
}

public String extractUsername(String token) {
    return Jwts.parserBuilder()
        .setSigningKey(KEY)
        .build()
        .parseClaimsJws(token)
        .getBody()
        .getSubject();
}

3. Externalize Secret Key

Move the secret to application.properties:

jwt.secret=${JWT_SECRET:default-dev-secret-change-in-production}
jwt.expiration=36000000

Update JwtService:

@Value("${jwt.secret}")
private String secretKey;

@Value("${jwt.expiration}")
private long expirationTime;

@PostConstruct
public void init() {
    this.key = Keys.hmacShaKeyFor(secretKey.getBytes());
}

4. Add Input Validation

Use Bean Validation annotations:

public class LoginRequest {
    @NotBlank(message = "Username is required")
    @Size(min = 3, max = 50)
    private String username;
    
    @NotBlank(message = "Password is required")
    @Size(min = 8, message = "Password must be at least 8 characters")
    private String password;
}

Update controller:

@PostMapping("/login")
public String login(@Valid @RequestBody LoginRequest loginRequest) {
    // Validation happens automatically
}

5. Use BCrypt for Passwords

Hash passwords before storing in the database:

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder(12);
}

Update User entity:

@PrePersist
@PreUpdate
private void encryptPassword() {
    if (this.password != null && !this.password.startsWith("$2a$")) {
        this.password = passwordEncoder.encode(this.password);
    }
}

Token Usage Example

Once implemented, clients should include tokens in the Authorization header:

GET /api/users/profile
Authorization: Bearer eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJqb2huZG9lIi...

Dependencies

The JWT implementation relies on these libraries from pom.xml:109-125:

<!-- Dependencias JWT-->
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-api</artifactId>
    <version>0.11.5</version>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-impl</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>
<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt-jackson</artifactId>
    <version>0.11.5</version>
    <scope>runtime</scope>
</dependency>

jjwt-api: Core JWT API and interfaces
jjwt-impl: Implementation of JWT specification
jjwt-jackson: JSON processing using Jackson library

Spring Security starter (spring-boot-starter-security) is commented out in the POM file, indicating a lightweight custom authentication approach without the full Spring Security framework.

Next Steps

Database - Learn about the User entity and data persistence
Architecture - Understand the overall system design
API Reference - Explore all available endpoints

Get Started

Core Concepts

Development

Overview

Authentication Flow

JWT Service Implementation

Service Configuration

Token Generation

Token Claims

Token Format

Auth Controller

Security Best Practices

Current Implementation Gaps

Recommended Enhancements

Token Usage Example

Dependencies

Next Steps

Build docs developers (and LLMs) love

Get Started

Core Concepts

Development

Documentation Index

​Overview

​Authentication Flow

​JWT Service Implementation

​Service Configuration

​Token Generation

​Token Claims

​Token Format

​Auth Controller

​Login Endpoint

​Login Request DTO

​Security Best Practices

​Current Implementation Gaps

​Recommended Enhancements

​Token Usage Example

​Dependencies

​Next Steps

Build docs developers (and LLMs) love

Overview

Authentication Flow

JWT Service Implementation

Service Configuration

Token Generation

Token Claims

Token Format

Auth Controller

Login Endpoint

Login Request DTO

Security Best Practices

Current Implementation Gaps

Recommended Enhancements

Token Usage Example

Dependencies

Next Steps