Spring Security JWT for Spring Boot 4

Security implementation plan

The agent first inspects the existing authentication model, dependency management, controllers, and security tests. It distinguishes a first-party token service from an external OAuth2 issuer and preserves the project's current account and role model.

Deliverables

• A Spring Security 7 SecurityFilterChain using the lambda DSL and current request-matcher APIs.
• A JwtService that validates signature, issuer, audience, expiration, and token type before trusting claims.
• A once-per-request authentication filter that rejects malformed credentials cleanly and does not authenticate disabled or missing accounts.
• Access and refresh token separation, bounded expiration, password encoding, role mapping, and method-security support.
• Focused tests for public routes, missing tokens, invalid signatures, expired tokens, role restrictions, and refresh-token misuse.

Review findings

The skill flags obsolete Spring Security APIs, hard-coded signing secrets, unvalidated claims, refresh tokens accepted as access tokens, broad permit rules, incorrect filter ordering, and exception handling that leaks internal details. It adapts templates to the repository rather than replacing established contracts.

Next steps

Run the project's authentication and authorization tests, verify key rotation and secret delivery in the deployment environment, and confirm that logs and telemetry never contain raw tokens.