How to Secure a Spring Boot REST API: Roles, Endpoints & JWT

// Role enum - defines available roles in the system
public enum Role {
    ROLE_USER,    // standard authenticated user
    ROLE_ADMIN,   // full administrative access
    ROLE_MANAGER  // intermediate access level
}
// User entity - maps to "users" table
@Entity
@Table(name = "users")
public class User {
@Id
@GeneratedValue(strategy = GenerationType.IDENTITY)
private Long   id;

@Column(unique = true, nullable = false)
private String email;

@Column(nullable = false)
private String password; // BCrypt hash - never plain text

@Enumerated(EnumType.STRING)
@Column(nullable = false)
private Role   role;

@Column(nullable = false)
private boolean enabled = true; // allows account deactivation

// getters, setters, constructors...
}
// UserDetailsService - bridges your User entity and Spring Security
@Service
public class UserDetailsServiceImpl implements UserDetailsService {
private final UserRepository userRepository;

public UserDetailsServiceImpl(UserRepository userRepository) {
    this.userRepository = userRepository;
}

@Override
public UserDetails loadUserByUsername(String email)
        throws UsernameNotFoundException {

    User user = userRepository.findByEmail(email)
        .orElseThrow(() ->
            new UsernameNotFoundException("User not found: " + email));

    // Convert your User entity to Spring Security's UserDetails
    return org.springframework.security.core.userdetails.User
        .withUsername(user.getEmail())
        .password(user.getPassword())        // BCrypt hash from DB
        .roles(user.getRole().name()
            .replace("ROLE_", ""))           // Spring adds ROLE_ prefix back
        .accountExpired(false)
        .accountLocked(false)
        .credentialsExpired(false)
        .disabled(!user.isEnabled())
        .build();
}
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity // enables @PreAuthorize on methods
public class SecurityConfig {
private final JwtAuthFilter          jwtAuthFilter;
private final UserDetailsServiceImpl  userDetailsService;

public SecurityConfig(JwtAuthFilter jwtFilter,
                       UserDetailsServiceImpl uds) {
    this.jwtAuthFilter     = jwtFilter;
    this.userDetailsService = uds;
}

@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http)
        throws Exception {

    return http
        // Disable CSRF - REST APIs use JWT tokens, not cookies
        .csrf(csrf -> csrf.disable())

        // Stateless - no sessions created or used
        .sessionManagement(sm -> sm
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS))

        // Route-level authorization rules - evaluated TOP TO BOTTOM
        .authorizeHttpRequests(auth -> auth

            // Open to everyone - no token required
            .requestMatchers("/api/auth/**").permitAll()
            .requestMatchers("/actuator/health").permitAll()
            .requestMatchers(HttpMethod.GET, "/api/products/**").permitAll()

            // ADMIN only - requires ROLE_ADMIN in JWT
            .requestMatchers("/api/admin/**").hasRole("ADMIN")
            .requestMatchers(HttpMethod.DELETE, "/api/**").hasRole("ADMIN")

            // MANAGER or ADMIN
            .requestMatchers("/api/reports/**").hasAnyRole("ADMIN", "MANAGER")

            // Everything else requires valid JWT (any role)
            .anyRequest().authenticated()
        )

        // Register JWT filter before Spring's default auth filter
        .addFilterBefore(jwtAuthFilter,
            UsernamePasswordAuthenticationFilter.class)

        .build();
}

@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

@Bean
public AuthenticationManager authenticationManager(
        AuthenticationConfiguration config) throws Exception {
    return config.getAuthenticationManager();
}
}

@Component
public class JwtUtils {
@Value("${app.jwt.secret}")
private String secret;

@Value("${app.jwt.expiry-ms}")
private long expiryMs;

public String generateToken(UserDetails userDetails) {
    return Jwts.builder()
        .subject(userDetails.getUsername())
        .claim("roles", userDetails.getAuthorities().stream()
            .map(GrantedAuthority::getAuthority)
            .collect(Collectors.toList()))
        .issuedAt(new Date())
        .expiration(new Date(System.currentTimeMillis() + expiryMs))
        .signWith(getKey())
        .compact();
}

public String  extractUsername(String token) {
    return claims(token).getSubject();
}

public boolean isValid(String token, UserDetails user) {
    try {
        return extractUsername(token).equals(user.getUsername())
            && !claims(token).getExpiration().before(new Date());
    } catch (JwtException e) {
        return false; // expired, malformed, invalid signature
    }
}

private Claims claims(String token) {
    return Jwts.parser().verifyWith(getKey()).build()
        .parseSignedClaims(token).getPayload();
}

private SecretKey getKey() {
    return Keys.hmacShaKeyFor(Decoders.BASE64.decode(secret));
}
}
// Login endpoint - returns token on success
@RestController
@RequestMapping("/api/auth")
public class AuthController {
private final AuthenticationManager authManager;
private final UserDetailsService   userDetailsService;
private final JwtUtils             jwtUtils;

public AuthController(AuthenticationManager am,
                       UserDetailsService uds,
                       JwtUtils ju) {
    this.authManager        = am;
    this.userDetailsService = uds;
    this.jwtUtils           = ju;
}

@PostMapping("/login")
public ResponseEntity<Map<String, String>> login(
        @Valid @RequestBody LoginRequest req) {

    // Throws BadCredentialsException if invalid - returns 401 via exception handler
    authManager.authenticate(
        new UsernamePasswordAuthenticationToken(req.email(), req.password()));

    UserDetails user  = userDetailsService.loadUserByUsername(req.email());
    String      token = jwtUtils.generateToken(user);

    return ResponseEntity.ok(Map.of(
        "token",  token,
        "email",  req.email(),
        "type",   "Bearer"
    ));
}
}

@Component
public class JwtAuthFilter extends OncePerRequestFilter {
private final JwtUtils           jwtUtils;
private final UserDetailsService userDetailsService;

public JwtAuthFilter(JwtUtils ju, UserDetailsService uds) {
    this.jwtUtils           = ju;
    this.userDetailsService = uds;
}

@Override
protected void doFilterInternal(HttpServletRequest req,
                                   HttpServletResponse res,
                                   FilterChain chain)
        throws ServletException, IOException {

    final String header = req.getHeader("Authorization");

    // No token - continue without authenticating
    if (header == null || !header.startsWith("Bearer ")) {
        chain.doFilter(req, res);
        return;
    }

    final String token    = header.substring(7);
    final String username = jwtUtils.extractUsername(token);

    // Only process if username found and no existing auth in context
    if (username != null &&
            SecurityContextHolder.getContext().getAuthentication() == null) {

        UserDetails user = userDetailsService.loadUserByUsername(username);

        if (jwtUtils.isValid(token, user)) {
            UsernamePasswordAuthenticationToken authToken =
                new UsernamePasswordAuthenticationToken(
                    user, null, user.getAuthorities());
            authToken.setDetails(
                new WebAuthenticationDetailsSource().buildDetails(req));

            SecurityContextHolder.getContext().setAuthentication(authToken);
        }
    }
    chain.doFilter(req, res);
}
}

@RestController
@RequestMapping("/api/users")
public class UserController {
private final UserService userService;

public UserController(UserService userService) {
    this.userService = userService;
}

// Any authenticated user can view their own profile
@GetMapping("/me")
@PreAuthorize("isAuthenticated()")
public UserDto getMyProfile(Authentication auth) {
    return userService.findByEmail(auth.getName()); // auth.getName() = email from JWT
}

// Only ADMIN can list all users
@GetMapping
@PreAuthorize("hasRole('ADMIN')")
public Page<UserDto> getAllUsers(Pageable pageable) {
    return userService.findAll(pageable);
}

// User can only update their own data; admins can update anyone's
@PutMapping("/{id}")
@PreAuthorize("@userService.isOwner(#id, authentication.name) or hasRole('ADMIN')")
public UserDto updateUser(@PathVariable Long id,
                           @Valid @RequestBody UpdateUserRequest req) {
    return userService.update(id, req);
}

// Only ADMIN can delete users
@DeleteMapping("/{id}")
@PreAuthorize("hasRole('ADMIN')")
@ResponseStatus(HttpStatus.NO_CONTENT)
public void deleteUser(@PathVariable Long id) {
    userService.delete(id);
}
}
// The isOwner() method referenced in @PreAuthorize SpEL expression
@Service
public class UserService {
private final UserRepository userRepository;

public boolean isOwner(Long userId, String email) {
    return userRepository.findById(userId)
        .map(u -> u.getEmail().equals(email))
        .orElse(false);
}
}