Secure your REST APIs with Spring Security & Symmetric Key Encryption

In this video, we will be discussing the process of securing your REST APIs using Spring Security JWT and Symmetric Encryption. JWT (JSON Web Token) is a standard for creating secure access tokens that can be used to authenticate and authorize users, while symmetric encryption is a method of encrypting data using a secret key. We will be showing how to use these technologies in combination with Spring Security to create a secure and efficient authentication and authorization system for your REST APIs. This video is ideal for developers who are looking to secure their REST APIs and want to learn more about JWT and symmetric encryption.
🔗Resources & Links mentioned in this video:
Github Repository: github.com/dan...
Previous JWT Tutorial: www.danvega.de...
👋🏻Connect with me:
Website: www.danvega.dev
Twitter: / therealdanvega
Github: github.com/dan...
LinkedIn: / danvega
Newsletter: www.danvega.de...
SUBSCRIBE TO MY CHANNEL: bit.ly/2re4GH0 ❤️

[@pedjango]

Absolutely in love with this Spring Security series. It would be awesome to expand these lessons with the utilization of refresh tokens.

[@famoniri]

Hi Dan, thank you for your useful video. In the "SecurityConfig" class, the `jwt()` method in `OAuth2ResourceServerConfigurer` has been deprecated since version 6.1. To resolve this, I used the `.oauth2ResourceServer(oauth2 -> oauth2.jwt(Customizer.withDefaults()))` configuration and it worked for me.

[@EasyGist]

Thanks buddy! It helped.

[@pejko89]

Great timing! Just got instructions from my mentor to learn about JWT tomorrow, and implement it in my project! Thank you!

[@minilord11]

A followup video about refresh token would be awesome.

[@jackla84]

Great tutorial. Could you expand on this topic and demonstrate how to implement logout functionality and refresh tokens?

[@AleksandarT10]

Great video, this is what we needed.
It would be great if you can build on top of this one so UsernamePasswordAuthenticationFilter is used along with PostgresDB!

[@markostrisko2370]

Hi Dan, great video as always.
I have one question though.
At 17:00, when creating a @Bean for JwtDecoder, in SecretKeySpec constructor, you are setting "RSA" as alghoritm.
Correct me if I'm wrong, but isn't that an asymmetric key encription?
Shouldn't we pass something like HmacSHA512?
Thanks in advance

[@alexandroslekkas]

Very cool, thank you!

[@javohirsayfullayevich7127]

Well done, Thanks Dan

[@void_star_void]

Nicely done, may I know your IDE theme?

[@devforlife5696]

He's using new beta layout in appearence. Enable beta will give new appearence to IDE just like this. Wanna know his theme also ;)

[@sergiopuccini]

Thanks for video! But how to refresh key?

[@ram0973]

Nice shirt. And lesson of course 👍

[@shahinit]

Thanks

[@joachimdietl6737]

Nice video!

[@anuragreddy9177]

Could you please make a video on common exception library for Spring Webflux projects

[@derBobby2]

What is the advantage of the JWT over just using basic auth here if both endpoints are in the same application?

[@blacky8986]

And how to use the symmetric key If i have auth server and resource server in one app :) ?

[@ayushjaiswal4449]

In the given implementation we are using basic login where credential is supplied using authorize header but if we want to do so by using a rest end point how can I do that, anyone please guide.

[@mrowox]

Thank you so much for this short and concise tutorial Dan. However, I encountered an error while following along with the tutorial. I get an error when I try to encode with HS512 algorithm. HS256 works fine. The error is below
[Request processing failed: org.springframework.security.oauth2.jwt.JwtEncodingException: An error occurred while attempting to encode the Jwt: Failed to sign the JWT -> The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]] with root cause
com.nimbusds.jose.JOSEException: The HS512 algorithm is not allowed or supported by the JWS signer: Supported algorithms: [HS256]

[@hschaeufler]

Had the same issue. Your key is probably not long enough.

[@mrowox]

Wow thanks for pointing that out

[@balaji3229]

@@hschaeufler How do we generate the correct key?

[@alexgutjahr]

Probably longer than needed, but with the openssl utility you can do the following
openssl rand -base64 64

[@AwkwardFX]

Hey Dan, what is securityMatcher? How is that different from requestMatcher?

[@mlensment]

Nicely done, Dan! Can you do a tutorial about oauth2Client + JWT?

[@ilyatemnikov9624]

Hi Dan! (sorry for my bad English). I have watched carefully some of your videos about security, there is one small problem: when restarting the application all the tokens previously issued become invalid. I will be very glad and grateful if you tell me how to solve this problem or make a video like "jwt for production"! I am immensely grateful for your channel, thank you!

[@nb-th7kr]

you would probably need to store your active tokens in a persistent data storage

[@wagnerfaria1601]

How would you write a refresh token method for that application?

[@doh2535]

What's going on with ur teeth? Why are they so white?))