Issue, refresh và revoke JWT — vòng đời token trong production

import org.springframework.beans.factory.annotation.Value;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.oauth2.jwt.JwtEncoder;
import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
import com.nimbusds.jose.jwk.OctetSequenceKey;
import com.nimbusds.jose.jwk.JWKSet;
import com.nimbusds.jose.jwk.source.ImmutableJWKSet;
import com.nimbusds.jose.proc.SecurityContext;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.nio.charset.StandardCharsets;

@Configuration
public class JwtEncoderConfig {

    @Value("${app.jwt.secret}")
    private String secret;        // from env, never hardcode

    @Bean
    public JwtEncoder jwtEncoder() {
        SecretKey key = new SecretKeySpec(
            secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
        OctetSequenceKey jwk = new OctetSequenceKey.Builder(key).build();
        JWKSource<SecurityContext> jwkSource =
            new ImmutableJWKSet<>(new JWKSet(jwk));
        return new NimbusJwtEncoder(jwkSource);
    }
}

# application.yml
app:
  jwt:
    secret: ${JWT_SECRET}   # set trong env hoặc secret manager

# Tao key 32 bytes = 256 bit, encode base64
openssl rand -base64 32
# Vi du output: G3wKf9XzN2pQ8vL6tH4mR1yE5sD7uA0bC9wY3jK7iN8=

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.oauth2.jwt.*;
import org.springframework.stereotype.Service;
import lombok.RequiredArgsConstructor;
import java.time.Duration;
import java.time.Instant;
import java.util.List;
import java.util.UUID;

@Service
@RequiredArgsConstructor
public class JwtIssuer {

    private final JwtEncoder encoder;

    public String issueAccessToken(UserDetails user) {
        Instant now = Instant.now();
        List<String> roles = user.getAuthorities().stream()
            .map(GrantedAuthority::getAuthority)
            .map(a -> a.replaceFirst("^ROLE_", ""))   // strip prefix: ROLE_USER -> USER
            .toList();

        JwtClaimsSet claims = JwtClaimsSet.builder()
            .issuer("olhub.org")
            .subject(user.getUsername())
            .audience(List.of("olhub-api"))
            .issuedAt(now)
            .expiresAt(now.plus(Duration.ofHours(1)))
            .id(UUID.randomUUID().toString())          // jti -- for revocation
            .claim("roles", roles)
            .build();

        return encoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
    }

    public String issueRefreshToken(UserDetails user) {
        Instant now = Instant.now();
        JwtClaimsSet claims = JwtClaimsSet.builder()
            .issuer("olhub.org")
            .subject(user.getUsername())
            .issuedAt(now)
            .expiresAt(now.plus(Duration.ofDays(30)))
            .id(UUID.randomUUID().toString())
            .claim("type", "refresh")   // marker -- filter request dung access token lam refresh
            .build();

        return encoder.encode(JwtEncoderParameters.from(claims)).getTokenValue();
    }
}

import org.springframework.security.authentication.AuthenticationManager;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.web.bind.annotation.*;
import jakarta.validation.Valid;
import lombok.RequiredArgsConstructor;

@RestController
@RequestMapping("/api/auth")
@RequiredArgsConstructor
public class AuthController {

    private final AuthenticationManager authManager;
    private final JwtIssuer jwtIssuer;

    @PostMapping("/login")
    public TokenResponse login(@Valid @RequestBody LoginRequest req) {
        Authentication auth = authManager.authenticate(
            new UsernamePasswordAuthenticationToken(req.email(), req.password())
        );
        UserDetails user = (UserDetails) auth.getPrincipal();

        String accessToken  = jwtIssuer.issueAccessToken(user);
        String refreshToken = jwtIssuer.issueRefreshToken(user);

        return new TokenResponse(accessToken, refreshToken, "Bearer", 3600L);
    }
}

public record LoginRequest(
    @NotBlank @Email String email,
    @NotBlank String password) {}

public record TokenResponse(
    String accessToken,
    String refreshToken,
    String tokenType,
    Long expiresIn) {}

@PostMapping("/refresh")
public TokenResponse refresh(@Valid @RequestBody RefreshRequest req) {
    // validate signature + expiry -- throw JwtException neu sai
    Jwt jwt = refreshTokenDecoder.decode(req.refreshToken());

    // Guard: chi chap nhan refresh token, khong chap nhan access token bi gui nham
    if (!"refresh".equals(jwt.getClaim("type"))) {
        throw new InvalidBearerTokenException("Not a refresh token");
    }

    String username = jwt.getSubject();
    UserDetails user = userDetailsService.loadUserByUsername(username);

    // Revoke token cu (DB store -- xem section 5)
    refreshTokenStore.revoke(jwt.getId());

    // Issue cap moi
    String newAccess  = jwtIssuer.issueAccessToken(user);
    String newRefresh = jwtIssuer.issueRefreshToken(user);

    // Luu refresh token moi vao DB
    refreshTokenStore.save(username, jwt.getId(), jwt.getExpiresAt());

    return new TokenResponse(newAccess, newRefresh, "Bearer", 3600L);
}

public record RefreshRequest(@NotBlank String refreshToken) {}

.expiresAt(now.plus(Duration.ofMinutes(15)))   // access token

@Service
@RequiredArgsConstructor
public class TokenDenylistService {

    private final StringRedisTemplate redis;

    public void revoke(String jti, Instant expiresAt) {
        Duration remaining = Duration.between(Instant.now(), expiresAt);
        if (!remaining.isNegative()) {
            redis.opsForValue().set("revoked:" + jti, "1", remaining);
        }
    }

    public boolean isRevoked(String jti) {
        return Boolean.TRUE.equals(redis.hasKey("revoked:" + jti));
    }
}

@Component
@RequiredArgsConstructor
public class JwtRevocationFilter extends OncePerRequestFilter {

    private final TokenDenylistService denylist;
    private final JwtDecoder jwtDecoder;

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain)
            throws ServletException, IOException {

        String header = request.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            String token = header.substring(7);
            try {
                Jwt jwt = jwtDecoder.decode(token);
                if (denylist.isRevoked(jwt.getId())) {
                    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
                    return;
                }
            } catch (JwtException ignored) {
                // JwtAuthenticationProvider xu ly loi nay sau trong chain
            }
        }
        chain.doFilter(request, response);
    }
}

@Entity
@Table(name = "refresh_tokens")
public class RefreshToken {
    @Id
    private String id;          // jti

    private String username;
    private Instant issuedAt;
    private Instant expiresAt;
    private boolean revoked;
}

@Service
@RequiredArgsConstructor
public class RefreshTokenStore {

    private final RefreshTokenRepository repo;

    public void save(String username, String jti, Instant expiresAt) {
        RefreshToken token = new RefreshToken();
        token.setId(jti);
        token.setUsername(username);
        token.setIssuedAt(Instant.now());
        token.setExpiresAt(expiresAt);
        token.setRevoked(false);
        repo.save(token);
    }

    public boolean isValid(String jti) {
        return repo.findById(jti)
            .filter(t -> !t.isRevoked() && t.getExpiresAt().isAfter(Instant.now()))
            .isPresent();
    }

    public void revoke(String jti) {
        repo.findById(jti).ifPresent(t -> {
            t.setRevoked(true);
            repo.save(t);
        });
    }

    public void revokeAllForUser(String username) {
        // Dung khi doi mat khau hoac phat hien bi tan cong
        repo.revokeAllByUsername(username);
    }
}

@Scheduled(cron = "0 0 3 * * *")   // 3am moi ngay
public void cleanupExpiredTokens() {
    int deleted = repo.deleteByExpiresAtBefore(Instant.now());
    log.info("Cleaned up {} expired refresh tokens", deleted);
}

// SAI -- secret trong source code = ai clone repo cung co key
private String secret = "my-super-secret-key-for-jwt-signing";

// DUNG -- lay tu bien moi truong
@Value("${app.jwt.secret}")
private String secret;

// SAI -- payload la base64 ai cung giai ma duoc
{
  "sub": "[email protected]",
  "ssn": "123-45-6789",
  "creditCard": "4111-1111-1111-1111"
}

// DUNG -- chi luu identifier va role
{
  "sub": "[email protected]",
  "roles": ["USER"],
  "exp": 1713792400
}

// SAI -- token khong co expiry = permanent breach neu bi leak
JwtClaimsSet.builder()
    .subject(user.getUsername())
    .claim("roles", roles)
    .build();

// DUNG -- luon set expiresAt
JwtClaimsSet.builder()
    .subject(user.getUsername())
    .expiresAt(now.plus(Duration.ofHours(1)))
    .claim("roles", roles)
    .build();

// SAI -- platform default charset: Mac dev la UTF-8, container prod co the khac
SecretKey key = new SecretKeySpec(secret.getBytes(), "HmacSHA256");

// DUNG -- charset tuong minh, byte array giong nhau moi moi truong
SecretKey key = new SecretKeySpec(
    secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");