1
1
.
.
1
1
1
1
.
.
4
4
S
S
t
t
e
e
p
p
4
4
-
-
S
S
e
e
n
n
d
d
T
T
o
o
k
k
e
e
n
n
-
-
I
I
n
n
A
A
u
u
t
t
h
h
o
o
r
r
i
i
z
z
a
a
t
t
i
i
o
o
n
n
H
H
e
e
a
a
d
d
e
e
r
r
-
-
G
G
e
e
t
t
U
U
s
s
e
e
r
r
n
n
a
a
m
m
e
e
I
I
n
n
f
f
o
o
[
[
G
G
]
]
This tutorial shows how to get Username from JWT.
Application Schema [Results]
O
O
v
v
e
e
r
r
v
v
i
i
e
e
w
w
JWTController.java
@ResponseBody
@RequestMapping("/GetUsername")
public String getUsername(@RequestHeader("Authorization") String authorization) {
String jwt = jwtUtil.extractJWTFromAuthorizationHeader(authorization);
return jwtUtil.getUsername(jwt);
}
POST http://localhost:8080/GetUsername (JWT in Authorization Header)
admin
JWTUtil
http://localhost:8080/GetUsername
Tomcat
getUsername()
Browser
JWTController
getUsername()
getUsername()
P
P
r
r
o
o
c
c
e
e
d
d
u
u
r
r
e
e
Edit Class: JWTController.java (Add Method getUsername())
Edit Class: JWTUtil.java (Add Method getUsername())
JWTController.java
package com.ivoronline.springboot_security_jwt.controllers;
import com.ivoronline.springboot_security_jwt.config.JWTUtil;
import io.jsonwebtoken.Claims;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestHeader;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.ResponseBody;
@Controller
public class JWTController {
@Autowired JWTUtil jwtUtil;
//=============================================================
// CREATE JWT
//=============================================================
@ResponseBody
@RequestMapping("/CreateJWT")
public String createJWT() {
//CREATE JWT
String jwt = jwtUtil.createJWT("admin", "[book.create, book.delete]");
//RETURN JWT
return jwt;
}
//=============================================================
// GET CLAIMS
//=============================================================
@ResponseBody
@RequestMapping("/GetClaims")
public Claims getClaims(@RequestHeader("Authorization") String authorization) {
//EXTRACT JWT FROM AUTHORIZATION HEADER
String jwt = jwtUtil.extractJWTFromAuthorizationHeader(authorization);
//GET CLAIMS
Claims claims = jwtUtil.getClaims(jwt);
//RETURN CLAIMS
return claims;
}
//=============================================================
// GET USERNAME
//=============================================================
@ResponseBody
@RequestMapping("/GetUsername")
public String getUsername(@RequestHeader("Authorization") String authorization) {
//EXTRACT JWT FROM AUTHORIZATION HEADER
String jwt = jwtUtil.extractJWTFromAuthorizationHeader(authorization);
//GET USERNAME
String username = jwtUtil.getUsername(jwt);
//RETURN USERNAME
return username;
}
}
JWTUtil.java
package com.ivoronline.springboot_security_jwt.config;
import io.jsonwebtoken.Claims;
import io.jsonwebtoken.JwtBuilder;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureAlgorithm;
import org.springframework.stereotype.Component;
import javax.crypto.spec.SecretKeySpec;
import javax.xml.bind.DatatypeConverter;
import java.security.Key;
import java.util.HashMap;
import java.util.Map;
@Component
public class JWTUtil {
//USED TO CREATE & DECODE JWT
public final static String SECRET_KEY = "mysecretkey";
//========================================================================
// CREATE JWT
//========================================================================
public String createJWT(String username, String authorities) {
//HEADER (SPECIFY ALGORITHM)
SignatureAlgorithm signatureAlgorithm = SignatureAlgorithm.HS256;
//PAYLOAD (SPECIFY CLAIMS)
Map<String, Object> customClaims = new HashMap<>();
customClaims.put("username" , username);
customClaims.put("authorities", authorities);
JwtBuilder builder = Jwts.builder()
.setClaims (customClaims) //Place them first not to override subsequent Claims
.setId ("1")
.setSubject("TestJWT")
.setIssuer ("ivoronline");
//SIGNATURE (SPECIFY SECRET KEY)
byte[] apiKeySecretBytes = DatatypeConverter.parseBase64Binary(SECRET_KEY);
Key signingKey = new SecretKeySpec(apiKeySecretBytes, signatureAlgorithm.getJcaName());
//EXTRACT JWT
String jwt = builder.signWith(signatureAlgorithm, signingKey).compact();
//RETURN JWT
return jwt;
}
//========================================================================
// EXTRACT JWT FROM AUTHORIZATION HEADER
//========================================================================
public String extractJWTFromAuthorizationHeader(String authorization) {
//GET AUTHORIZATION HEADER
if (authorization == null || !authorization.startsWith("Bearer ")) {
System.out.println("Authorization Header not found");
return null;
}
//EXTRACT JWT
String jwt = authorization.substring(7);
//RETURN JWT
return jwt;
}
//========================================================================
// GET CLAIMS
//========================================================================
public Claims getClaims(String jwt) {
//GET CLAIMS
Claims claims = Jwts.parser()
.setSigningKey(DatatypeConverter
.parseBase64Binary(SECRET_KEY))
.parseClaimsJws(jwt)
.getBody();
//RETURN CLAIMS
return claims;
}
//========================================================================
// GET USERNAME
//========================================================================
public String getUsername(String jwt) {
Claims claims = getClaims(jwt);
String username = (String) claims.get("username");
return username;
}
}
R
R
e
e
s
s
u
u
l
l
t
t
s
s
http://localhost:8080/CreateJWT
Start Postman
– POST: http://localhost:8080/GetUsername
– Headers: (copy from below)
– Send
http://localhost:8080/CreateJWT
Headers (add Key-Value)
Authorize: Bearer
eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJUZXN0SldUIiwicm9sZSI6IlJPTEVfVVNFUiIsImlzcyI6Iml2b3JvbmxpbmUiLCJqdGkiOiIxIiwi
dXNlcm5hbWUiOiJteXN1c2VyIn0.sEkZCMuot76lWjsuYfp5cU4IqB-ykzb5jaiobH84Bmg
Postman
