Spring Security 6 & JWT Authentication · 강의

리소스 서버 설정

Spring Boot 애플리케이션을 OAuth2 리소스 서버로 구성하여 API 엔드포인트를 보호합니다.

리소스 서버 설정은(는) CoddyKit의 무료 Spring Security 6 & JWT Authentication 강의입니다. 이것은 4개 중 1번째 강의입니다. 아래에서 전체 강의를 무료로 읽을 수 있으며, 내장 코드 에디터와 24/7 AI 튜터와 함께 브라우저에서 직접 실습할 수 있습니다. 이 강의는 Spring Security 6 & JWT Authentication 학습 경로의 일부이며, 진행 상황이 웹과 CoddyKit 앱에 동기화됩니다. Spring Security 6 & JWT Authentication 강의에는 총 4개의 강의가 포함되어 있습니다.

이 강의의 일부는 아직 번역되지 않았으며 영어로 표시됩니다.

What is a Resource Server?

Welcome to configuring a Spring Security OAuth2 Resource Server! This is a crucial component in modern secure applications.

A Resource Server hosts protected resources, like your API endpoints.
It receives access tokens from clients and validates them.
If a token is valid, it grants access to the requested resource.

Think of it as the bouncer at a club, checking tickets (access tokens) before letting anyone in.

Role in OAuth2 Flow

In the OAuth2 flow, the Resource Server works hand-in-hand with an Authorization Server.

The client first gets an access token from the Authorization Server.
Then, the client sends this token to the Resource Server when requesting a protected resource.
The Resource Server doesn't issue tokens; it only validates them.

This separation of concerns makes your application more secure and scalable.

Essential Dependencies

To turn your Spring Boot application into an OAuth2 Resource Server, you need a specific dependency.

The key dependency is spring-boot-starter-oauth2-resource-server. This starter brings in all the necessary Spring Security components to handle OAuth2 access tokens.

It simplifies the setup process by providing auto-configuration for common scenarios.

Adding the Dependency

Let's add the required dependency to your project's pom.xml (for Maven users) or build.gradle (for Gradle users).

For Maven, place this inside your <dependencies> block:

<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-oauth2-resource-server</artifactId>
</dependency>

Enabling Resource Server Security

With the dependency in place, we need to configure Spring Security. In Spring Security 6, this is typically done using a SecurityFilterChain bean.

This configuration tells Spring Security to treat incoming requests as if they might contain an OAuth2 access token.

Basic Security Filter Chain

Here's a minimal Java configuration for enabling the Resource Server:

The oauth2ResourceServer().jwt() part tells Spring Security to expect JWTs (JSON Web Tokens) as access tokens.

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;

@Configuration
public class SecurityConfig {

  @Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    http
      .authorizeHttpRequests(authorize -> authorize
        .anyRequest().authenticated()
      )
      .oauth2ResourceServer(oauth2 -> oauth2.jwt());
    return http.build();
  }
}

Configuring JWT Source

For the Resource Server to validate JWTs, it needs to know where to find the public keys or how to introspect the token.

You configure this in your application.properties or application.yml file. The most common way is to provide the JWK Set URI or the Issuer URI.

JWK Set URI (jwk-set-uri): Points to an endpoint where the Authorization Server publishes its public keys (JSON Web Key Set).
Issuer URI (issuer-uri): Points to the Authorization Server's base URL, from which the JWK Set URI can be discovered.

Setting JWK Set URI

Let's add the jwk-set-uri to our application.properties. This URI is provided by your Authorization Server.

Replace http://auth-server/realms/master/protocol/openid-connect/certs with the actual URI from your Authorization Server.

spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://auth-server/realms/master/protocol/openid-connect/certs

Creating a Protected Endpoint

Now, let's create a simple REST endpoint that our Resource Server will protect. Only requests with a valid access token will be able to reach this endpoint.

We'll use a basic @RestController for this.

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class ProtectedController {

  @GetMapping("/api/hello")
  public String hello() {
    return "Hello, secured world!";
  }
}

Putting It All Together

Here's a full, runnable Spring Boot application demonstrating a minimal Resource Server setup with a protected endpoint. Remember to update the jwk-set-uri in application.properties!

When you run this, try accessing /api/hello without a token (you'll get 401 Unauthorized).

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@SpringBootApplication
public class ResourceServerApplication {

  public static void main(String[] args) {
    SpringApplication.run(ResourceServerApplication.class, args);
  }

  @Configuration
  public static class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
      http
        .authorizeHttpRequests(authorize -> authorize
          .anyRequest().authenticated()
        )
        .oauth2ResourceServer(oauth2 -> oauth2.jwt());
      return http.build();
    }
  }

  @RestController
  public static class ProtectedController {
    @GetMapping("/api/hello")
    public String hello() {
      return "Hello, secured world!";
    }
  }
}

Resource Server Purpose Check

Which of the following best describes the primary role of an OAuth2 Resource Server?

Recap: Resource Server Setup

Great job! You've learned the fundamentals of setting up an OAuth2 Resource Server.

We understood that a Resource Server protects APIs by validating access tokens.
We added the spring-boot-starter-oauth2-resource-server dependency.
We configured a SecurityFilterChain to enable JWT-based resource server security.
We learned how to specify the JWT source (e.g., jwk-set-uri) in application.properties.

Next, we'll dive deeper into how the Resource Server decodes and validates these JWTs.

자주 묻는 질문

“리소스 서버 설정” 강의는 무료인가요?

네 — “리소스 서버 설정” 전체 내용을 이 웹사이트에서 무료로 읽을 수 있습니다. 인터랙티브하게 실습하려면(내장 코드 에디터와 24/7 AI 튜터), CoddyKit PRO로 업그레이드하면 Spring Security 6 & JWT Authentication 강의 전체를 잠금 해제할 수 있습니다. Spring Security 6 & JWT Authentication 강의에는 총 4개의 강의가 포함되어 있습니다.

“리소스 서버 설정”에서 뭘 배우나요?

Spring Boot 애플리케이션을 OAuth2 리소스 서버로 구성하여 API 엔드포인트를 보호합니다. 브라우저에서 직접 실행하는 실습 코드로 Spring Security 6 & JWT Authentication을(를) 배우며, 24/7 AI 튜터가 강의를 진행하면서 질문에 답변해줍니다.

Spring Security 6 & JWT Authentication을(를) 시작하는 데 경험이 필요한가요?

사전 경험은 필요하지 않습니다. CoddyKit의 Spring Security 6 & JWT Authentication은(는) 초급자부터 고급 학습자까지를 위해 구성되어 있으므로, 여기서 시작하거나 처음부터 시작할 수 있으며 자신의 속도대로 진행할 수 있습니다. 이것은 4개 중 1번째 강의입니다.

“리소스 서버 설정” 강의는 얼마나 걸리나요?

대부분의 CoddyKit 강의는 약 5~10분이 소요됩니다. 각 강의는 간결하고 인터랙티브하여 꾸준한 진행이 가능하며, 웹과 앱에서 중단한 부분부터 바로 시작할 수 있습니다.

이 Spring Security 6 & JWT Authentication 강의에서 코드를 작성하고 실행할 수 있나요?

네. 모든 Spring Security 6 & JWT Authentication 강의에는 내장 코드 에디터가 포함되어 있으므로, 브라우저에서 바로 실제 코드를 작성하고 실행한 후 즉시 AI 피드백을 받을 수 있습니다 — 로컬 설정이 필요 없습니다.

이 강의의 모든 강의

← Spring Security 6 & JWT Authentication(으)로 돌아가기