Introduction to JWT Authentication with Java's HttpClient and Gson

Introduction to JWTs: Authenticate and Access Protected Endpoints

Welcome to this lesson on JWT Authentication . Building on what we learned about session-based authentication, where the server retained user sessions, we now delve into a more stateless form of authentication using JSON Web Tokens (JWTs). JWT authentication is popular because it offers a decentralized and scalable approach, which is crucial for modern applications needing to handle numerous requests efficiently. By the end of this lesson, you will understand how JWTs work and how to use them to securely authenticate API requests, enhancing your capability in managing API interactions. Let's dive into JWT authentication and explore its significance in securing endpoints.

How JWT Works: A Client-Side Perspective

From a client-side perspective, using JWTs involves several steps to ensure secure and authenticated interactions with the API. Here’s a breakdown of the JWT process: User Authentication : The client initiates user authentication with a POST request using Java's HttpClient . The request includes the user's credentials (username and password) directed to the API's login endpoint. Token Issuance : Upon successful authentication, the API responds with two tokens: Access Token : A short-lived credential used to access protected API endpoints. It contains encoded data such as user ID and expiration timestamp. Refresh Token : A longer-lived token used to acquire a new access token without requiring the user to log in again. Token Utilization : The client stores these tokens and utilizes the access token to make requests to protected resources. This involves adding the access token to the HTTP request headers as a "Bearer" token. In Java, this can be done by setting the Authorization header like this: Authorization: Bearer YOUR_ACCESS_TOKEN . Access Token Expiration : When the access token expires, the client can use the refresh token to request a new one, maintaining a seamless user experience. In this unit, we'll focus on the access token, understanding its role in securing requests to protected endpoints. Later, we will delve into managing the refresh token, which plays a critical part in sustaining sessions when access tokens expire. By grasping the client-side workflow of JWTs, you can efficiently manage authenticated API interactions in a secure, scalable manner.

Join the 1M+ learners on CodeSignal

Be a part of our community of 1M+ users who develop and demonstrate their skills on CodeSignal

import java.net.URI; import java.net.http.HttpClient; import java.net.http.HttpRequest; import java.net.http.HttpResponse; import com.google.gson.Gson; import java.net.http.HttpRequest.BodyPublishers; public class APISignup { private static final String BASE_URL = "http://localhost:8000"; public static void main(String[] args) { signUpUser("testuser", "testpass123"); } public static void signUpUser(String username, String password) { HttpClient client = HttpClient.newHttpClient(); Gson gson = new Gson(); UserCredentials userCredentials = new UserCredentials(username, password); String requestBody = gson.toJson(userCredentials); HttpRequest request = HttpRequest.newBuilder() .uri(URI.create(BASE_URL + "/auth/signup")) .header("Content-Type", "application/json") .POST(BodyPublishers.ofString(requestBody)) .build(); try { HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString()); if (response.statusCode() == 200) { System.out.println("Signed up successfully!"); System.out.println(response.body()); } else { System.out.println("Failed to sign up: " + response.body()); } } catch (Exception e) { System.out.println("An HTTP error occurred: " + e.getMessage()); } } }

With the user now registered, the next crucial step is to log in with these credentials and begin the JWT retrieval. This process involves sending another POST request using Java:

Java

public static void loginUser(String username, String password) {
    HttpClient client = HttpClient.newHttpClient();
    Gson gson = new Gson();
    
    UserCredentials userCredentials = new UserCredentials(username, password);
    String requestBody = gson.toJson(userCredentials);

    HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(BASE_URL + "/auth/login"))
            .header("Content-Type", "application/json")
            .POST(BodyPublishers.ofString(requestBody))
            .build();

    try {
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        if (response.statusCode() == 200) {
            System.out.println("Logged in successfully!");
            System.out.println(response.body());
        } else {
            System.out.println("Failed to log in: " + response.body());
        }
    } catch (Exception e) {
        System.out.println("An HTTP error occurred: " + e.getMessage());
    }
}

public static void loginUser(String username, String password) {
    HttpClient client = HttpClient.newHttpClient();
    Gson gson = new Gson();
    
    UserCredentials userCredentials = new UserCredentials(username, password);
    String requestBody = gson.toJson(userCredentials);

    HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(BASE_URL + "/auth/login"))
            .header("Content-Type", "application/json")
            .POST(BodyPublishers.ofString(requestBody))
            .build();

    try {
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        if (response.statusCode() == 200) {
            System.out.println("Logged in successfully!");
            System.out.println(response.body());
        } else {
            System.out.println("Failed to log in: " + response.body());
        }
    } catch (Exception e) {
        System.out.println("An HTTP error occurred: " + e.getMessage());
    }
}

In this login step, we submit a POST request with user credentials. Unlike the session-based method, which used cookies to maintain sessions, this server returns JWTs that provide secure and efficient access to API resources.

Here's how the output might look like after a successful login:

text

Logged in successfully!
{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0dXNlciIsImlhdCI6MTczNzcyNzM5NSwiZXhwIjoxNzM3NzI4Mjk1fQ.3Rl8910TwYHjUPsjx4ql7XLfSHuzsQzCPYyzPe204po",
    "refresh_token": "15c8cbda2d99307391c160de1b8f2f687c620dc7626c7f7b80ef10ca72ceab80",
    "message": "Login successful"
}

Logged in successfully!
{
    "access_token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJ0ZXN0dXNlciIsImlhdCI6MTczNzcyNzM5NSwiZXhwIjoxNzM3NzI4Mjk1fQ.3Rl8910TwYHjUPsjx4ql7XLfSHuzsQzCPYyzPe204po",
    "refresh_token": "15c8cbda2d99307391c160de1b8f2f687c620dc7626c7f7b80ef10ca72ceab80",
    "message": "Login successful"
}

In this response, the access_token is a JWT utilized for authorizing requests, containing encoded information such as the user ID and token timestamps. The refresh_token, on the other hand, serves as a secure token to renew the access token without requiring the user to log in again. Lastly, the message confirms the successful login and issuance of the tokens.

Extracting Access and Refresh Tokens

Once you've successfully logged in, it's essential to extract the JWT tokens from the login response to use them in your application. For that we'll create a POJO:

Java

import com.google.gson.annotations.SerializedName;

public class AuthTokens {
    @SerializedName("access_token") // Mapps `accessToken` to JSON's `access_token` and vice-versa
    public String accessToken;
    @SerializedName("refresh_token")
    public String refreshToken;
}

import com.google.gson.annotations.SerializedName;

public class AuthTokens {
    @SerializedName("access_token") // Mapps `accessToken` to JSON's `access_token` and vice-versa
    public String accessToken;
    @SerializedName("refresh_token")
    public String refreshToken;
}

Now we can get the auth tokens:

Java

public static void extractTokens(String loginResponse) {
    Gson gson = new Gson();
    AuthTokens authTokens = gson.fromJson(loginResponse, AuthTokens.class);
    
    try {
        System.out.println("Access Token: " + authTokens.accessToken);
        System.out.println("Refresh Token: " + authTokens.refreshToken);
    } catch (Exception e) {
        System.out.println("An error occurred during token extraction: " + e.getMessage());
    }
}

public static void extractTokens(String loginResponse) {
    Gson gson = new Gson();
    AuthTokens authTokens = gson.fromJson(loginResponse, AuthTokens.class);
    
    try {
        System.out.println("Access Token: " + authTokens.accessToken);
        System.out.println("Refresh Token: " + authTokens.refreshToken);
    } catch (Exception e) {
        System.out.println("An error occurred during token extraction: " + e.getMessage());
    }
}

In this Java code, we extract the access_token and refresh_token from the server's response. These tokens enable you to authenticate API requests and manage sessions in a stateless manner. The access token facilitates immediate request authentication, while the refresh token ensures the continuity of the session by allowing the renewal of access tokens without requiring user reauthentication. By efficiently handling these tokens, we embrace a scalable and secure method for managing authenticated interactions with the API.

Making Requests to Protected Endpoints with JWT

With the access token in hand, we can now authenticate requests to protected API endpoints. This is done by including the JWT in the HTTP request headers, ensuring that the API recognizes and allows the request. Here’s how you can make a request to a secured endpoint using the access token in Java:

Java

public static void accessProtectedEndpoint(String accessToken) {
    HttpClient client = HttpClient.newHttpClient();

    HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(BASE_URL + "/todos"))
            .header("Authorization", "Bearer " + accessToken)
            .build();

    try {
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        if (response.statusCode() == 200) {
            System.out.println("Accessed todos successfully!");
            System.out.println(response.body());
        } else {
            System.out.println("Failed to access todos: " + response.body());
        }
    } catch (Exception e) {
        System.out.println("An HTTP error occurred: " + e.getMessage());
    }
}

public static void accessProtectedEndpoint(String accessToken) {
    HttpClient client = HttpClient.newHttpClient();

    HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(BASE_URL + "/todos"))
            .header("Authorization", "Bearer " + accessToken)
            .build();

    try {
        HttpResponse<String> response = client.send(request, HttpResponse.BodyHandlers.ofString());
        if (response.statusCode() == 200) {
            System.out.println("Accessed todos successfully!");
            System.out.println(response.body());
        } else {
            System.out.println("Failed to access todos: " + response.body());
        }
    } catch (Exception e) {
        System.out.println("An HTTP error occurred: " + e.getMessage());
    }
}

In this example, the access token is included in the Authorization header as a Bearer token. This header signals to the API that the request is properly authenticated, granting access to the protected resources. For instance, the /todos endpoint in this snippet is accessed securely, and if successful, the protected data is printed in the output.

By making requests in this manner, you ensure that sensitive operations and data retrievals are secure, leveraging the JWT approach for stateless, scalable, and flexible interaction with the API.

Introduction to JWTs: Authenticate and Access Protected Endpoints

How JWT Works: A Client-Side Perspective

Join the 1M+ learners on CodeSignal

Signup Recap

Login for JWT Retrieval

Extracting Access and Refresh Tokens

Making Requests to Protected Endpoints with JWT

Summary and Preparing for Practice