Planned lessonJNR-038-L06

Demo: issuing and validating JWTs

On This Lesson 3 topics

This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.

In this lesson

issue and validate signed JWTs in Shop. Prepares JNR-038-LAB1.

Draft outline details

Add a POST /api/auth/login that checks credentials and builds a JWT with sub, iss, aud, short exp.
Sign it with a key read from configuration (not from source code).
Configure the API as a resource server: oauth2ResourceServer(o -> o.jwt(...)) with a JwtDecoder that checks issuer and audience.
Call the API with the token and see 200.
Planned mistake: putting the user's email and phone in the claims. Fix: keep only the ID and roles.
Decode the token on a debugger site and point out the readable payload.

Apply this lesson with the module's lab, exercises and quiz.

Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.