Login system with JWT token and email reset password

Introduction

The Spring Login Application is a secure and robust user management system built using Spring Boot. This project demonstrates modern approaches to implementing authentication, authorization, and user account functionalities. Key features include user registration, secure password handling with BCrypt, email-based password reset, and JWT (JSON Web Token) authentication. Designed with extensibility and scalability in mind, this application serves as an excellent foundation for projects requiring user management and role-based access control.

By leveraging Spring's powerful tools such as Spring Security, Spring Data JPA, and JavaMailSender, this project ensures best practices in security, maintainability, and ease of integration. Whether you're building a small web application or a large enterprise system, this project provides a practical, well-structured starting point for managing user accounts securely.

---

Configuration

Pom.xml dependencies

<dependencies>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-data-jpa</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-oauth2-resource-server</artifactid>
        </dependency>


        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-security</artifactid>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-web</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-validation</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-mail</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-devtools</artifactid>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupid>org.postgresql</groupid>
            <artifactid>postgresql</artifactid>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-test</artifactid>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.security</groupid>
            <artifactid>spring-security-test</artifactid>
            <scope>test</scope>
        </dependency>
    </dependencies>

---

Docker

To run the PostgreSQL database, create a docker-compose.yaml file:

services:
  postgres:
    image: postgres:latest
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_DB=database
      - POSTGRES_USER=admin
      - POSTGRES_PASSWORD=admin
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:

Run:

docker compose up -d

---

application.properties

spring.application.name=login_app

spring.datasource.url=jdbc:postgresql://localhost:5432/database
spring.datasource.username=admin
spring.datasource.password=admin

spring.mail.host=sandbox.smtp.mailtrap.io
spring.mail.port=2525


spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.starttls.enable=true
spring.mail.properties.mail.smtp.starttls.required=true
spring.mail.default-encoding=UTF-8


spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true

spring.config.import=classpath:env.properties

jwt.public.key=classpath:public.key
jwt.private.key=classpath:private.key

---

env.properties

spring.mail.username=<get in your mailtrap account>
spring.mail.password=<get in your mailtrap account>
</get></get>

---

How to create an asymmetric keys ?

See in this post how to generate asymmetric keys

---

Project Structure

login_app/
├── .mvn/                       # Maven folder (Maven configurations)
├── src/
│   ├── main/
│   │   ├── java/
│   │   │   └── dev/
│   │   │       └── mspilari/
│   │   │           └── login_app/
│   │   │               ├── configs/           # Security, authentication, and other configurations
│   │   │               ├── domains/           # Main application domains
│   │   │               │   ├── email/         # Email-related logic
│   │   │               │   └── user/          # User-related logic
│   │   │               ├── exceptions/        # Custom exceptions and error handling
│   │   │               └── utils/             # Utilities and helpers
│   │   └── resources/                         # Resources (e.g., configuration files)
│   └── test/                                  # Application tests
├── target/                                    # Build folder generated by Maven
├── .gitattributes                             # Git attributes configuration
├── .gitignore                                 # Git ignore file
├── docker-compose.yaml                        # Docker Compose configuration
├── HELP.md                                    # Project help documentation
├── mvnw                                       # Maven Wrapper script for Linux
├── mvnw.cmd                                   # Maven Wrapper script for Windows
└── pom.xml                                    # Maven configuration file

---

Features

• User registration with email and password validation
• Login with JWT authentication
• Password recovery with email link delivery
• Password reset via link with temporary token
• Field validation and error handling

---

Code

Config directory

BCryptPasswordConfig.java

package dev.mspilari.login_app.configs;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
public class BCryptPasswordConfig {

    @Bean
    public BCryptPasswordEncoder bPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

Code Breakdown

1. @Configuration

   • This annotation tells Spring that the class contains bean definitions.
   • Classes annotated with @Configuration are processed during application startup, and any methods annotated with @Bean will have their return values added to the Spring application context as managed beans.

2. @Bean

   • The @Bean annotation on the bPasswordEncoder() method indicates that this method returns an object that should be registered as a bean in the Spring application context.
   • This allows the BCryptPasswordEncoder object to be injected wherever it's needed in the application.

3. BCryptPasswordEncoder

   • This is a utility class provided by Spring Security for encoding passwords.
   • It uses the BCrypt hashing algorithm, which is considered a strong and secure way to hash passwords. The algorithm automatically adds a "salt" to the password before hashing, making it resistant to dictionary attacks and rainbow table attacks.

4. Method bPasswordEncoder()

   • When this method is called by the Spring framework, it creates a new instance of BCryptPasswordEncoder and makes it available in the application context.
   • Other classes in the application can then autowire this bean to encode or match passwords.

---

JwtConfig.java

<dependencies>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-data-jpa</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-oauth2-resource-server</artifactid>
        </dependency>


        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-security</artifactid>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-web</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-validation</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-mail</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-devtools</artifactid>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupid>org.postgresql</groupid>
            <artifactid>postgresql</artifactid>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-test</artifactid>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.security</groupid>
            <artifactid>spring-security-test</artifactid>
            <scope>test</scope>
        </dependency>
    </dependencies>

Code Breakdown

1. Class-Level Annotations

services:
  postgres:
    image: postgres:latest
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_DB=database
      - POSTGRES_USER=admin
      - POSTGRES_PASSWORD=admin
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:

• Indicates this is a Spring configuration class where beans (Spring-managed components) are defined.
• The beans defined here will be available in the Spring Application Context for dependency injection.

---

2. Injecting RSA Keys from Configuration

docker compose up -d

• @Value is used to inject the public key and private key from the application's properties file (e.g., application.yml or application.properties).
• These keys are expected to be in the properties as:

spring.application.name=login_app

spring.datasource.url=jdbc:postgresql://localhost:5432/database
spring.datasource.username=admin
spring.datasource.password=admin

spring.mail.host=sandbox.smtp.mailtrap.io
spring.mail.port=2525


spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.starttls.enable=true
spring.mail.properties.mail.smtp.starttls.required=true
spring.mail.default-encoding=UTF-8


spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true

spring.config.import=classpath:env.properties

jwt.public.key=classpath:public.key
jwt.private.key=classpath:private.key

---

3. JWT Encoder Bean

spring.mail.username=<get in your mailtrap account>
spring.mail.password=<get in your mailtrap account>
</get></get>

• Purpose: Creates a bean for encoding (generating) JWT tokens.
• Steps:
  1. Build RSA Key:
     • RSAKey.Builder creates a JWK (JSON Web Key) representation of the public/private RSA key pair.
  2. Create JWK Set:
     • ImmutableJWKSet stores the key in a set. This set is used by Nimbus JOSE libraries for signing tokens.
  3. NimbusJwtEncoder:
     • This encoder uses the ImmutableJWKSet to encode and sign tokens using the private key.

---

4. JWT Decoder Bean

login_app/
├── .mvn/                       # Maven folder (Maven configurations)
├── src/
│   ├── main/
│   │   ├── java/
│   │   │   └── dev/
│   │   │       └── mspilari/
│   │   │           └── login_app/
│   │   │               ├── configs/           # Security, authentication, and other configurations
│   │   │               ├── domains/           # Main application domains
│   │   │               │   ├── email/         # Email-related logic
│   │   │               │   └── user/          # User-related logic
│   │   │               ├── exceptions/        # Custom exceptions and error handling
│   │   │               └── utils/             # Utilities and helpers
│   │   └── resources/                         # Resources (e.g., configuration files)
│   └── test/                                  # Application tests
├── target/                                    # Build folder generated by Maven
├── .gitattributes                             # Git attributes configuration
├── .gitignore                                 # Git ignore file
├── docker-compose.yaml                        # Docker Compose configuration
├── HELP.md                                    # Project help documentation
├── mvnw                                       # Maven Wrapper script for Linux
├── mvnw.cmd                                   # Maven Wrapper script for Windows
└── pom.xml                                    # Maven configuration file

• Purpose: Creates a bean for decoding and verifying JWT tokens.
• Steps:
  1. Public Key Verification:
     • NimbusJwtDecoder.withPublicKey() is configured with the RSA public key. It verifies the signature of tokens.
  2. Build Decoder:
     • The build() method creates the decoder instance.

---

How JWT Encoding and Decoding Work

1. JWT Encoding (Token Generation):

   • The JwtEncoder bean is used to create a signed JWT token. This token typically contains user information (e.g., username, roles, etc.) as claims and is signed using the RSA private key.
   • Example:

   package dev.mspilari.login_app.configs;
   
   import org.springframework.context.annotation.Bean;
   import org.springframework.context.annotation.Configuration;
   import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
   
   @Configuration
   public class BCryptPasswordConfig {
   
       @Bean
       public BCryptPasswordEncoder bPasswordEncoder() {
           return new BCryptPasswordEncoder();
       }
   }
   
   

2. JWT Decoding (Token Verification):

   • The JwtDecoder bean is used to decode and verify the token using the RSA public key. This ensures the token:
     • Was issued by the server (signature verification).
     • Has not been tampered with.
   • Example:

   package dev.mspilari.login_app.configs;
   
   import java.security.interfaces.RSAPrivateKey;
   import java.security.interfaces.RSAPublicKey;
   
   import org.springframework.beans.factory.annotation.Value;
   import org.springframework.context.annotation.Bean;
   import org.springframework.context.annotation.Configuration;
   import org.springframework.security.oauth2.jwt.JwtDecoder;
   import org.springframework.security.oauth2.jwt.JwtEncoder;
   import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
   import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
   
   import com.nimbusds.jose.jwk.JWKSet;
   import com.nimbusds.jose.jwk.RSAKey;
   import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
   
   @Configuration
   public class JwtConfig {
       @Value("${jwt.public.key}")
       private RSAPublicKey publicKey;
   
       @Value("${jwt.private.key}")
       private RSAPrivateKey privateKey;
   
       @Bean
       public JwtEncoder jwtEncoder() {
           var jwk = new RSAKey.Builder(this.publicKey).privateKey(this.privateKey).build();
   
           var jwks = new ImmutableJWKSet(new JWKSet(jwk));
   
           return new NimbusJwtEncoder(jwks);
       }
   
       @Bean
       public JwtDecoder jwtDecoder() {
           return NimbusJwtDecoder.withPublicKey(this.publicKey).build();
       }
   }
   

---

SecurityConfig.java

<dependencies>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-data-jpa</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-oauth2-resource-server</artifactid>
        </dependency>


        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-security</artifactid>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-web</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-validation</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-mail</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-devtools</artifactid>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupid>org.postgresql</groupid>
            <artifactid>postgresql</artifactid>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-test</artifactid>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.security</groupid>
            <artifactid>spring-security-test</artifactid>
            <scope>test</scope>
        </dependency>
    </dependencies>

1. Class-Level Annotations

services:
  postgres:
    image: postgres:latest
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_DB=database
      - POSTGRES_USER=admin
      - POSTGRES_PASSWORD=admin
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:

• @Configuration: Marks this class as a Spring configuration that defines beans.
• @EnableWebSecurity: Enables Spring Security's web security features.
• @EnableMethodSecurity: Activates method-level security annotations like @PreAuthorize or @Secured. This allows you to control access to specific methods in your application based on roles, permissions, or conditions.

---

2. SecurityFilterChain Bean

docker compose up -d

• Defines the security filter chain for the application. A filter chain is a sequence of security filters applied to incoming HTTP requests.

---

3. CSRF Protection

spring.application.name=login_app

spring.datasource.url=jdbc:postgresql://localhost:5432/database
spring.datasource.username=admin
spring.datasource.password=admin

spring.mail.host=sandbox.smtp.mailtrap.io
spring.mail.port=2525


spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.starttls.enable=true
spring.mail.properties.mail.smtp.starttls.required=true
spring.mail.default-encoding=UTF-8


spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true

spring.config.import=classpath:env.properties

jwt.public.key=classpath:public.key
jwt.private.key=classpath:private.key

• CSRF (Cross-Site Request Forgery) protection is disabled.
  • CSRF protection is often unnecessary for stateless APIs, as tokens (like JWT) already provide a way to prevent unauthorized requests.
  • Disabling it simplifies the security configuration for this JWT-based API.

---

4. Authorization Rules

spring.mail.username=<get in your mailtrap account>
spring.mail.password=<get in your mailtrap account>
</get></get>

• Configures which endpoints require authentication:
  • Permit All:
  • POST requests to endpoints like /user/register, /user/login, /user/redeem-password, and /user/reset-password are open to everyone (no authentication required).
  • These endpoints are likely used for user registration, login, and password recovery/reset, which are typically accessible without logging in.
  • Authenticate Other Requests:
  • All other endpoints (anyRequest) require authentication.

---

5. JWT Validation

login_app/
├── .mvn/                       # Maven folder (Maven configurations)
├── src/
│   ├── main/
│   │   ├── java/
│   │   │   └── dev/
│   │   │       └── mspilari/
│   │   │           └── login_app/
│   │   │               ├── configs/           # Security, authentication, and other configurations
│   │   │               ├── domains/           # Main application domains
│   │   │               │   ├── email/         # Email-related logic
│   │   │               │   └── user/          # User-related logic
│   │   │               ├── exceptions/        # Custom exceptions and error handling
│   │   │               └── utils/             # Utilities and helpers
│   │   └── resources/                         # Resources (e.g., configuration files)
│   └── test/                                  # Application tests
├── target/                                    # Build folder generated by Maven
├── .gitattributes                             # Git attributes configuration
├── .gitignore                                 # Git ignore file
├── docker-compose.yaml                        # Docker Compose configuration
├── HELP.md                                    # Project help documentation
├── mvnw                                       # Maven Wrapper script for Linux
├── mvnw.cmd                                   # Maven Wrapper script for Windows
└── pom.xml                                    # Maven configuration file

• Configures the application as an OAuth 2.0 resource server that validates requests using JWT tokens.
• JWT Decoder:
  • The JwtDecoder bean (provided by JwtConfig) is used to verify incoming JWT tokens for requests to secure endpoints.

---

How This Works

1. CSRF Disabled: Since this is an API relying on stateless JWT authentication, disabling CSRF is common practice.
2. Authorization Rules:
   • Unauthenticated users can only access the explicitly permitted endpoints (e.g., /user/register or /user/login).
   • Any other request requires a valid JWT token.
3. JWT Validation:
   • Spring Security automatically extracts the Authorization header from incoming requests.
   • If the header contains a valid JWT token, the request is authenticated, and the user context is established.
   • If the token is invalid or missing, the request is rejected.

---

Domains directory

Email directory

Services directory

<dependencies>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-data-jpa</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-oauth2-resource-server</artifactid>
        </dependency>


        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-security</artifactid>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-web</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-validation</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-mail</artifactid>
        </dependency>

        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-devtools</artifactid>
            <scope>runtime</scope>
            <optional>true</optional>
        </dependency>

        <dependency>
            <groupid>org.postgresql</groupid>
            <artifactid>postgresql</artifactid>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.boot</groupid>
            <artifactid>spring-boot-starter-test</artifactid>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupid>org.springframework.security</groupid>
            <artifactid>spring-security-test</artifactid>
            <scope>test</scope>
        </dependency>
    </dependencies>

---

User directory

Controllers directory

services:
  postgres:
    image: postgres:latest
    ports:
      - "5432:5432"
    environment:
      - POSTGRES_DB=database
      - POSTGRES_USER=admin
      - POSTGRES_PASSWORD=admin
    volumes:
      - postgres_data:/var/lib/postgresql/data

volumes:
  postgres_data:

---

DTO directory

UserDto.java

docker compose up -d

---

UserRedeemPasswordDto.java

spring.application.name=login_app

spring.datasource.url=jdbc:postgresql://localhost:5432/database
spring.datasource.username=admin
spring.datasource.password=admin

spring.mail.host=sandbox.smtp.mailtrap.io
spring.mail.port=2525


spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.starttls.enable=true
spring.mail.properties.mail.smtp.starttls.required=true
spring.mail.default-encoding=UTF-8


spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true

spring.config.import=classpath:env.properties

jwt.public.key=classpath:public.key
jwt.private.key=classpath:private.key

---

UserResetPasswordDto.java

spring.mail.username=<get in your mailtrap account>
spring.mail.password=<get in your mailtrap account>
</get></get>

---

Entity directory

UserEntity.java

login_app/
├── .mvn/                       # Maven folder (Maven configurations)
├── src/
│   ├── main/
│   │   ├── java/
│   │   │   └── dev/
│   │   │       └── mspilari/
│   │   │           └── login_app/
│   │   │               ├── configs/           # Security, authentication, and other configurations
│   │   │               ├── domains/           # Main application domains
│   │   │               │   ├── email/         # Email-related logic
│   │   │               │   └── user/          # User-related logic
│   │   │               ├── exceptions/        # Custom exceptions and error handling
│   │   │               └── utils/             # Utilities and helpers
│   │   └── resources/                         # Resources (e.g., configuration files)
│   └── test/                                  # Application tests
├── target/                                    # Build folder generated by Maven
├── .gitattributes                             # Git attributes configuration
├── .gitignore                                 # Git ignore file
├── docker-compose.yaml                        # Docker Compose configuration
├── HELP.md                                    # Project help documentation
├── mvnw                                       # Maven Wrapper script for Linux
├── mvnw.cmd                                   # Maven Wrapper script for Windows
└── pom.xml                                    # Maven configuration file

---

Enums directory

Role.java

package dev.mspilari.login_app.configs;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

@Configuration
public class BCryptPasswordConfig {

    @Bean
    public BCryptPasswordEncoder bPasswordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

---

Repositories directory

UserRepository.java

package dev.mspilari.login_app.configs;

import java.security.interfaces.RSAPrivateKey;
import java.security.interfaces.RSAPublicKey;

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;

import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.RSAKey;
import com.nimbusds.jose.jwk.source.ImmutableJWKSet;

@Configuration
public class JwtConfig {
    @Value("${jwt.public.key}")
    private RSAPublicKey publicKey;

    @Value("${jwt.private.key}")
    private RSAPrivateKey privateKey;

    @Bean
    public JwtEncoder jwtEncoder() {
        var jwk = new RSAKey.Builder(this.publicKey).privateKey(this.privateKey).build();

        var jwks = new ImmutableJWKSet(new JWKSet(jwk));

        return new NimbusJwtEncoder(jwks);
    }

    @Bean
    public JwtDecoder jwtDecoder() {
        return NimbusJwtDecoder.withPublicKey(this.publicKey).build();
    }
}

---

Services directory

UserService.java

@Configuration

---

Exceptions directory

GlobalException.java

@Value("${jwt.public.key}")
private RSAPublicKey publicKey;

@Value("${jwt.private.key}")
private RSAPrivateKey privateKey;

---

Utils directory

JwtActions.java

  jwt.public.key=<your-public-key>
  jwt.private.key=<your-private-key>
</your-private-key></your-public-key>

Conclusion

In this project, we successfully implemented a secure and feature-rich user authentication system using Spring Boot. Beyond the core functionalities like user registration, login, and JWT-based authentication, the application also incorporates a password recovery system. Users can reset their passwords through an email link, ensuring a smooth and secure recovery process.

To facilitate email-based password recovery, we integrated Spring Email with Mailtrap, a safe and efficient email testing service. This allows the application to send password reset links with temporary tokens while ensuring that emails are sent securely and tested in a controlled environment. This setup demonstrates how to handle sensitive workflows like password recovery without exposing real users to potential issues during development and testing.

The combination of secure authentication practices, robust password management, and seamless email integration makes this application a reliable foundation for any modern web system. Developers can adapt these practices to suit their specific requirements, ensuring both scalability and user trust. By leveraging best practices and tools like Spring Security and Mailtrap, we have demonstrated how to build secure, user-focused applications with ease.

---

? Reference

• Spring Security
• MailTrap
• Spring Email

? Project Repository

• Project Repository on Github

? Talk to me

• LinkedIn
• Github
• Portfolio

The above is the detailed content of Login system with JWT token and email reset password. For more information, please follow other related articles on the PHP Chinese website!