Spring Boot 4 Microservices & REST APIs · レッスン

OAuth2とJWTの基礎

認可に用いるOAuth2の基本概念と、安全な情報交換に用いるJSON Web Token（JWT）を理解します。

「OAuth2とJWTの基礎」はCoddyKit上の無料Spring Boot 4 Microservices & REST APIsレッスンです。これはレッスン1/3です。下記で完全なレッスンを無料で読むことができます。その後、ブラウザ内の組み込みコードエディタと24時間対応のAIチューターでハンズオン演習できます。これはSpring Boot 4 Microservices & REST APIs学習パスの一部であり、ウェブとCoddyKitアプリ全体で進捗が同期されます。 Spring Boot 4 Microservices & REST APIsコースには全3レッスンが含まれています。

このレッスンの一部はまだ翻訳されておらず、英語で表示されています。

Why API Security Matters

When building applications, especially those with REST APIs, security is paramount. You're exposing data and functionality that needs protection.

Without proper security, your API could be vulnerable to unauthorized access, data breaches, or malicious attacks. This lesson lays the groundwork for understanding how to secure your services.

AuthN vs. AuthZ: Key Differences

Before diving in, let's clarify two critical terms:

Authentication (AuthN): Verifying who a user or client is. Think of it as showing your ID to prove your identity.
Authorization (AuthZ): Determining what an authenticated user or client is allowed to do. This is like a bouncer checking your ticket to see if you can enter a specific area.

OAuth2 primarily focuses on authorization.

Meet OAuth2: The Authorization Standard

OAuth2 (Open Authorization 2.0) is an industry-standard protocol for authorization. It allows a third-party application (the 'client') to obtain limited access to an HTTP service (the 'resource server') on behalf of a user (the 'resource owner').

Crucially, OAuth2 enables this access without the user having to share their credentials (username and password) directly with the client application.

Roles in OAuth2

OAuth2 defines four main roles that interact in the authorization process:

Resource Owner: The user who owns the protected resources.
Client: The application requesting access to the resource owner's protected resources.
Authorization Server: The server that authenticates the resource owner and issues access tokens to the client.
Resource Server: The server hosting the protected resources, capable of accepting and responding to protected resource requests using access tokens.

How OAuth2 Grants Access

OAuth2 uses different 'grant types' (also known as flows) to issue an access token. An access token is a credential that grants the client access to specific resources on the resource server.

The choice of grant type depends on the client's type (e.g., web application, mobile app, server-side application) and its security requirements. The Authorization Code Flow is widely used for traditional web applications.

Introducing JWTs: Secure Information

A JSON Web Token (JWT), pronounced 'jot', is a compact, URL-safe means of representing claims to be transferred between two parties. These claims are pieces of information about an entity (typically, the user) and additional metadata.

JWTs are often used as the format for access tokens in OAuth2, providing a self-contained way to securely transmit information about the user and their permissions.

Anatomy of a JWT

A JWT consists of three parts, separated by dots (.):

Header: Contains metadata about the token itself, like the type of token (JWT) and the signing algorithm used (e.g., HMAC SHA256 or RSA).
Payload: Contains the 'claims' – statements about an entity (like a user) and additional data. Claims can be registered (standardized), public, or private.
Signature: Used to verify that the sender of the JWT is who it says it is and that the message hasn't been tampered with. It's created using the header, the payload, and a secret key.

JWT Structure: A Closer Look

Here's what a typical JWT might look like. Each part is Base64Url encoded:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9
.
eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ
.
SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c

The first part is the Header.
The second part is the Payload.
The third part is the Signature.

These parts are encoded separately and joined by dots.

Decoding JWT Parts (Concept)

The header and payload of a JWT are simply Base64Url encoded JSON. This means anyone can easily decode them to read their contents. The security comes from the signature, which verifies the token's integrity and authenticity.

Try decoding a sample Base64Url string in Java:

import java.util.Base64;

public class Main {
  public static void main(String[] args) {
    String encodedHeader = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9";
    String encodedPayload = "eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ";

    System.out.println("Decoded Header:");
    decodeAndPrint(encodedHeader);

    System.out.println("\nDecoded Payload:");
    decodeAndPrint(encodedPayload);
  }

  private static void decodeAndPrint(String encodedString) {
    try {
      byte[] decodedBytes = Base64.getUrlDecoder().decode(encodedString);
      String decodedString = new String(decodedBytes, "UTF-8");
      System.out.println(decodedString);
    } catch (Exception e) {
      System.out.println("Error decoding: " + e.getMessage());
    }
  }
}

Why Use JWTs?

JWTs offer several advantages, especially in distributed systems like microservices:

Statelessness: The server doesn't need to store session information. Each JWT contains all necessary user data.
Scalability: Since tokens are self-contained, any service can validate them without a central session store, simplifying scaling.
Compact & URL-Safe: They are small and can be easily transmitted in URL parameters, POST requests, or HTTP headers.
Self-Contained: They contain all the information about the user, reducing the need for database lookups on every request.

Check Your Understanding

Which of the following statements best describes the primary purpose of OAuth2?

Lesson Summary

In this lesson, you've gained a foundational understanding of API security principles. We distinguished between Authentication (who you are) and Authorization (what you can do).

You learned about OAuth2 as a standard for secure authorization, allowing controlled access to resources. We also explored JSON Web Tokens (JWTs), understanding their structure and benefits as a compact, self-contained way to transmit information, often used as access tokens within OAuth2.

よくある質問

「OAuth2とJWTの基礎」レッスンは無料ですか？

はい。「OAuth2とJWTの基礎」の完全なテキストはこのウェブで無料で読めます。インタラクティブに演習し（組み込みコードエディタと24時間対応のAIチューター）、Spring Boot 4 Microservices & REST APIsコースの残りをアンロックするには、CoddyKit PROにアップグレードしてください。 Spring Boot 4 Microservices & REST APIsコースには全3レッスンが含まれています。

「OAuth2とJWTの基礎」で何を学びますか？

認可に用いるOAuth2の基本概念と、安全な情報交換に用いるJSON Web Token（JWT）を理解します。ブラウザで直接実行するハンズオンコードでSpring Boot 4 Microservices & REST APIsを演習し、24時間対応のAIチューターがレッスンを進める中での質問に答えます。

Spring Boot 4 Microservices & REST APIsを始めるのに経験は必要ですか？

事前経験は必要ありません。CoddyKitのSpring Boot 4 Microservices & REST APIsは初級者から上級者向けに構成されているため、ここから始めるか最初から始めて、自分のペースで進むことができます。これはレッスン1/3です。

「OAuth2とJWTの基礎」レッスンにはどのくらい時間がかかりますか？

ほとんどのCoddyKitレッスンは約5～10分かかります。各レッスンはコンパクトでインタラクティブなので、着実に進歩し、ウェブとアプリ全体で正確に前回の場所から再開できます。

このSpring Boot 4 Microservices & REST APIsレッスンでコードを書いて実行できますか？

はい。すべてのSpring Boot 4 Microservices & REST APIsレッスンに組み込みコードエディタが含まれているため、ブラウザでリアルコードを書いて実行し、即座のAIフィードバックを取得できます。ローカル設定は不要です。

このコースのすべてのレッスン

← Spring Boot 4 Microservices & REST APIsに戻る