Resource Server Setup
Configure a Spring Boot application as an OAuth2 Resource Server to protect its API endpoints.
Resource Server Setup is a free Spring Security 6 & JWT Authentication lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Spring Security 6 & JWT Authentication learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is a Resource Server?
Welcome to configuring a Spring Security OAuth2 Resource Server! This is a crucial component in modern secure applications.
- A Resource Server hosts protected resources, like your API endpoints.
- It receives access tokens from clients and validates them.
- If a token is valid, it grants access to the requested resource.
Think of it as the bouncer at a club, checking tickets (access tokens) before letting anyone in.
Role in OAuth2 Flow
In the OAuth2 flow, the Resource Server works hand-in-hand with an Authorization Server.
- The client first gets an access token from the Authorization Server.
- Then, the client sends this token to the Resource Server when requesting a protected resource.
- The Resource Server doesn't issue tokens; it only validates them.
This separation of concerns makes your application more secure and scalable.
Essential Dependencies
To turn your Spring Boot application into an OAuth2 Resource Server, you need a specific dependency.
The key dependency is spring-boot-starter-oauth2-resource-server. This starter brings in all the necessary Spring Security components to handle OAuth2 access tokens.
It simplifies the setup process by providing auto-configuration for common scenarios.
Adding the Dependency
Let's add the required dependency to your project's pom.xml (for Maven users) or build.gradle (for Gradle users).
For Maven, place this inside your <dependencies> block:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>Enabling Resource Server Security
With the dependency in place, we need to configure Spring Security. In Spring Security 6, this is typically done using a SecurityFilterChain bean.
This configuration tells Spring Security to treat incoming requests as if they might contain an OAuth2 access token.
Basic Security Filter Chain
Here's a minimal Java configuration for enabling the Resource Server:
The oauth2ResourceServer().jwt() part tells Spring Security to expect JWTs (JSON Web Tokens) as access tokens.
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
public class SecurityConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2ResourceServer(oauth2 -> oauth2.jwt());
return http.build();
}
}Configuring JWT Source
For the Resource Server to validate JWTs, it needs to know where to find the public keys or how to introspect the token.
You configure this in your application.properties or application.yml file. The most common way is to provide the JWK Set URI or the Issuer URI.
- JWK Set URI (
jwk-set-uri): Points to an endpoint where the Authorization Server publishes its public keys (JSON Web Key Set). - Issuer URI (
issuer-uri): Points to the Authorization Server's base URL, from which the JWK Set URI can be discovered.
Setting JWK Set URI
Let's add the jwk-set-uri to our application.properties. This URI is provided by your Authorization Server.
Replace http://auth-server/realms/master/protocol/openid-connect/certs with the actual URI from your Authorization Server.
spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://auth-server/realms/master/protocol/openid-connect/certsCreating a Protected Endpoint
Now, let's create a simple REST endpoint that our Resource Server will protect. Only requests with a valid access token will be able to reach this endpoint.
We'll use a basic @RestController for this.
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class ProtectedController {
@GetMapping("/api/hello")
public String hello() {
return "Hello, secured world!";
}
}Putting It All Together
Here's a full, runnable Spring Boot application demonstrating a minimal Resource Server setup with a protected endpoint. Remember to update the jwk-set-uri in application.properties!
When you run this, try accessing /api/hello without a token (you'll get 401 Unauthorized).
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@SpringBootApplication
public class ResourceServerApplication {
public static void main(String[] args) {
SpringApplication.run(ResourceServerApplication.class, args);
}
@Configuration
public static class SecurityConfig {
@Bean
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http
.authorizeHttpRequests(authorize -> authorize
.anyRequest().authenticated()
)
.oauth2ResourceServer(oauth2 -> oauth2.jwt());
return http.build();
}
}
@RestController
public static class ProtectedController {
@GetMapping("/api/hello")
public String hello() {
return "Hello, secured world!";
}
}
}Resource Server Purpose Check
Which of the following best describes the primary role of an OAuth2 Resource Server?
Recap: Resource Server Setup
Great job! You've learned the fundamentals of setting up an OAuth2 Resource Server.
- We understood that a Resource Server protects APIs by validating access tokens.
- We added the
spring-boot-starter-oauth2-resource-serverdependency. - We configured a
SecurityFilterChainto enable JWT-based resource server security. - We learned how to specify the JWT source (e.g.,
jwk-set-uri) inapplication.properties.
Next, we'll dive deeper into how the Resource Server decodes and validates these JWTs.
Frequently asked questions
Is the “Resource Server Setup” lesson free?
Yes — the full text of “Resource Server Setup” is free to read here on the web, and the Spring Security 6 & JWT Authentication course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Spring Security 6 & JWT Authentication course, upgrade to CoddyKit PRO.
What will I learn in “Resource Server Setup”?
Configure a Spring Boot application as an OAuth2 Resource Server to protect its API endpoints. You practise Spring Security 6 & JWT Authentication with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Spring Security 6 & JWT Authentication?
No prior experience is required. Spring Security 6 & JWT Authentication on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Resource Server Setup” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Spring Security 6 & JWT Authentication lesson?
Yes. Every Spring Security 6 & JWT Authentication lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.