Spring Security with JWT: JWT filter which validates the token is not invoked

Question

I am using Spring Security with JWT for authenticating rest apis. On login, the JWT token is generated and shared to the mobile client. But, the token in the subsequent requests are not been validated. Is there anything wrong in the security configuration ?

Spring security version - 5.1.6.RELEASE

// Security Configuration

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private JwtAuthenticationEntryPoint jwtAuthenticationEntryPoint;

    @Autowired
    private JwtTokenAuthenticationFilter jwtTokenAuthenticationFilter;

    @Autowired
    private CustomUserDetailsService customUserDetailsService;

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return super.authenticationManagerBean();
    }

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(customUserDetailsService).passwordEncoder(passwordEncoder());
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        httpSecurity.
            httpBasic().disable().
            csrf().disable().
            exceptionHandling().authenticationEntryPoint(jwtAuthenticationEntryPoint).
            and().
                addFilterBefore(jwtTokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class).
                sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS).
            and().
                authorizeRequests().antMatchers("/user/login").permitAll().
                antMatchers("/user/test").authenticated().
                anyRequest().authenticated();
    }

}

// JWT Token Auth Filter - This is never invoked

@Component
public class JwtTokenAuthenticationFilter extends GenericFilterBean {

    @Autowired
    private JwtTokenProvider jwtTokenProvider;

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain filterChain) throws IOException, ServletException {
        String token = jwtTokenProvider.resolveToken((HttpServletRequest) req);
        if (null != token && jwtTokenProvider.validateToken(token)) {
            Authentication auth = jwtTokenProvider.getAuthentication(token);
            if (null != auth) {
                SecurityContextHolder.getContext().setAuthentication(auth);
            }
        }
        filterChain.doFilter(req, res);
    }
}

I was expecting that all the requests after login will be authenticated against the JWT token. I tried putting the name of the service to be authenticated as below:

antMatchers("/user/test").authenticated().

Also, any request authenticated is also added, but neither of them worked.

anyRequest().authenticated();

Answer 1

Try to replace

addFilterBefore(jwtTokenAuthenticationFilter, UsernamePasswordAuthenticationFilter.class).

by

addFilterBefore(jwtTokenAuthenticationFilter), BasicAuthenticationFilter.class);

If not runs, change jwtTokenAuthenticationFilter class to avoid to be a Spring bean and use like this:

addFilterBefore(new JwtTokenAuthenticationFilter(jwtTokenProvider)), BasicAuthenticationFilter.class);

And add the following code on Security Class:

@Autowired
private JwtTokenProvider jwtTokenProvider;