Styjun

As I understand a JWT contains a header, a payload and a signature.

The signature ensures the JWT integrity by encrypting the header and the payload with a secret.

Consequently, if the authentication (token) server and a resource server share the same secret the resource server should be able to validate the token by himself, and that's the purpose of these tokens.

Consequently I have two questions:

• why does Spring provides a RemoteTokenServices, isn't it an anti-pattern ?

[EDIT] Answered this one myself:

In fact, the main issue using JWT without checking them against a token store is that we cannot revoke them. Using only the signature to check its authenticity, any token stays valid until it expires.

Checking the JWT against a token store allows us to revoke tokens and in this case, a valid JWT that has been revoked won't be accepted to authenticate a request.

Consequently, the only case it can be safe to use self-authenticating JWT is with very short expiration times.

• if I don't use this service, how can I achieve the token validation locally using only the secret ?

My current config of a resource server consulting a remote token service:

@Configuration
@EnableResourceServer
@EnableGlobalMethodSecurity(prePostEnabled = true)
@Profile("!test")
public class ResourceServerConfiguration extends ResourceServerConfigurerAdapter 

 @Value("$auth-server.url")
 private String authEndpoint;

 @Value("$security.oauth2.client.client-id")
 private String clientId;

 @Value("$security.oauth2.client.client-secret")
 private String clientSecret;

 @Override
 public void configure(ResourceServerSecurityConfigurer resources) throws Exception 
 resources.resourceId("ms/legacy");
 

 @Override
 public void configure(HttpSecurity http) throws Exception 
 http.authorizeRequests().anyRequest().permitAll().and().cors().disable().csrf().disable().httpBasic().disable()
 .exceptionHandling()
 .authenticationEntryPoint(
 (request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED))
 .accessDeniedHandler(
 (request, response, authException) -> response.sendError(HttpServletResponse.SC_UNAUTHORIZED));
 

 @Override
 public void configure(ResourceServerSecurityConfigurer resources) throws Exception 
 resources.resourceId("ms/legacy");
 

 @Bean
 public ResourceServerTokenServices tokenService() 
 RemoteTokenServices tokenServices = new RemoteTokenServices();
 tokenServices.setClientId(clientId);
 tokenServices.setClientSecret(clientSecret);
 tokenServices.setCheckTokenEndpointUrl(authEndpoint + "/uaa/oauth/check_token");
 return tokenServices;
 

• why does Spring provides a RemoteTokenServices, isn't it an anti-pattern ?

Spring is a flexible framework that will offer to you different implementations
, it give you the choice to choose what the best implementation to fit your needs

• if I don't use this service, how can I achieve the token validation locally using only the secret ?

token validation locally :

 @Configuration
 @EnableResourceServer
 public class ResourceServerConfig extends ResourceServerConfigurerAdapter 

 @Override
 public void configure(ResourceServerSecurityConfigurer config) 
 config.tokenServices(tokenServices());
 

 @Bean
 public TokenStore tokenStore() 
 return new JwtTokenStore(accessTokenConverter());
 

 @Bean
 public JwtAccessTokenConverter accessTokenConverter() 
 JwtAccessTokenConverter converter = new JwtAccessTokenConverter();
 converter.setSigningKey("123");
 return converter;
 

 @Bean
 @Primary
 public DefaultTokenServices tokenServices() 
 DefaultTokenServices defaultTokenServices = new DefaultTokenServices();
 defaultTokenServices.setTokenStore(tokenStore());
 return defaultTokenServices;