Securing Enterprise REST APIs with Spring Security 6 & Stateless JWT Authentication

Security is non-negotiable in production enterprise applications. In modern microservices and React single-page application (SPA) architectures, stateless JWT (JSON Web Token) authentication is the industry standard.

Spring Security 6 (introduced with Spring Boot 3) removed many deprecated configuration adapters like WebSecurityConfigurerAdapter. In this article, I will walk you through setting up a modern, security-hardened JWT authentication filter from scratch.

Key Architecture Overview

1. Authentication Endpoint (/api/auth/login): Validates credentials, issues short-lived Access Token (15 mins) and HTTP-Only Refresh Token (7 days).
2. JwtAuthenticationFilter: Intercepts incoming HTTP requests, validates the Authorization: Bearer <token> header, and populates the SecurityContextHolder.
3. SecurityFilterChain Configuration: Defines public vs authenticated endpoints using method-chaining Lambda DSL.

1. Implementing the SecurityFilterChain Bean

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthFilter;
    private final AuthenticationProvider authenticationProvider;

    public SecurityConfig(JwtAuthenticationFilter jwtAuthFilter, AuthenticationProvider authenticationProvider) {
        this.jwtAuthFilter = jwtAuthFilter;
        this.authenticationProvider = authenticationProvider;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)
            .cors(Customizer.withDefaults())
            .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**", "/swagger-ui/**", "/v3/api-docs/**").permitAll()
                .requestMatchers("/api/admin/**").hasRole("ADMIN")
                .anyRequest().authenticated()
            )
            .authenticationProvider(authenticationProvider)
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}

Conclusion

With Spring Security 6, writing clean, maintainable, and stateless security configurations is straightforward. By combining Spring Security with JWT tokens, we build robust APIs ready for horizontal scaling!