0Pricing
Clojure Functional Programming & JVM Backend Development · Lesson

Authentication & Authorization

Secure your Clojure backend with token-based authentication and role-based authorization using Ring middleware.

Authentication & Authorization is a free Clojure Functional Programming & JVM Backend Development lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Clojure Functional Programming & JVM Backend Development learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

AuthN vs AuthZ

Two distinct concerns:

  • Authentication (AuthN): who are you?
  • Authorization (AuthZ): what are you allowed to do?

You must verify identity before checking permissions.

Hashing Passwords

Never store plain passwords. Use a slow, salted hash like bcrypt via the buddy library.

(require '[buddy.hashers :as hashers])

(def stored (hashers/derive "secret123"))
(hashers/check "secret123" stored) ; => true

What Is a JWT?

A JSON Web Token is a signed, self-contained token holding claims (user id, roles, expiry). The server can verify it without a database lookup.

Issuing a Token

On successful login, sign a token containing the user's claims with a secret key.

(require '[buddy.sign.jwt :as jwt])

(defn make-token [user]
  (jwt/sign {:user-id (:id user) :role (:role user)}
            secret-key))

Verifying a Token

On each request, read the token from the Authorization header and verify the signature. An invalid or expired token throws.

(defn verify [token]
  (jwt/unsign token secret-key))

Authentication Middleware

Wrap handlers so the verified identity is attached to the request, or a 401 is returned.

(defn wrap-auth [handler]
  (fn [request]
    (if-let [token (bearer-token request)]
      (handler (assoc request :identity (verify token)))
      {:status 401 :body "Unauthorized"})))

Role-Based Authorization

Once identity is known, check roles before allowing an action.

(defn require-role [role handler]
  (fn [request]
    (if (= role (get-in request [:identity :role]))
      (handler request)
      {:status 403 :body "Forbidden"})))

401 vs 403

Use the right status:

  • 401 Unauthorized: not authenticated (no/invalid token)
  • 403 Forbidden: authenticated but lacks permission

Protecting Routes

Combine middleware with Compojure to guard specific endpoints while leaving public ones open.

(defroutes app
  (GET "/health" [] ok)
  (-> (GET "/admin" [] admin-page)
      (#(require-role :admin %))
      wrap-auth))

Token Expiry & Refresh

Set short expiry on access tokens to limit damage if leaked, and issue long-lived refresh tokens to get new ones without re-login.

(jwt/sign {:user-id 1 :exp (+ (now) 900)} secret-key)

Security Best Practices

Key rules:

  • Always serve auth over HTTPS
  • Store secrets in environment variables, not code
  • Hash passwords with bcrypt/argon2
  • Keep access tokens short-lived

Quick Check

Test your security knowledge.

Recap

You learned to secure a Clojure backend.

  • Hash passwords with bcrypt
  • Issue and verify JWTs for stateless auth
  • Use middleware for AuthN and role checks for AuthZ
  • Return 401 vs 403 correctly

Frequently asked questions

Is the “Authentication & Authorization” lesson free?

Yes — the full text of “Authentication & Authorization” is free to read here on the web, and the Clojure Functional Programming & JVM Backend Development course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Clojure Functional Programming & JVM Backend Development course, upgrade to CoddyKit PRO.

What will I learn in “Authentication & Authorization”?

Secure your Clojure backend with token-based authentication and role-based authorization using Ring middleware. You practise Clojure Functional Programming & JVM Backend Development with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Clojure Functional Programming & JVM Backend Development?

No prior experience is required. Clojure Functional Programming & JVM Backend Development on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Authentication & Authorization” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Clojure Functional Programming & JVM Backend Development lesson?

Yes. Every Clojure Functional Programming & JVM Backend Development lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Building a RESTful API
  2. Event-Driven Architectures
  3. System Design & Scalability Patterns
  4. Authentication & Authorization
← Back to Clojure Functional Programming & JVM Backend Development