Chapter 10: API Security with OAuth2, JWT and RBAC

In the previous chapter, we introduced DTO Mapping and Data Transformation.

Our Insurance Policy Management System (IPMS) now has:

Clean API Contracts
Request DTOs
Response DTOs
Entity-DTO Mapping
MapStruct Integration

However, there is another critical question.

Who should be allowed to access these APIs?

Can anyone create policies?

Can anyone approve claims?

Can anyone access customer information?

The answer is:

No.

Enterprise APIs must be secured to ensure that only authenticated and authorized users can access protected resources.

In this chapter, we will learn how to secure APIs using Spring Security, OAuth2, JWT (JSON Web Tokens), and Role-Based Access Control (RBAC).

🎯 Learning Objectives

By the end of this chapter, you will be able to:

Understand API Security Fundamentals
Differentiate Authentication and Authorization
Understand OAuth2 Architecture
Understand OpenID Connect
Implement JWT Authentication
Validate JWT Tokens
Configure Spring Security
Implement Role-Based Access Control (RBAC)
Secure REST APIs
Apply Enterprise Security Best Practices

Why API Security Matters

Imagine an unsecured insurance API.

GET /api/policies

Without security:

Anyone Can Access Policies

Anyone Can View Customer Data

Anyone Can Modify Claims

Anyone Can Delete Policies

This is unacceptable in enterprise systems.

Security protects:

Confidentiality

Integrity

Availability

Security in Insurance Systems

Insurance applications handle sensitive data.

Examples:

Policy Information

Customer Personal Data

Claim Information

Payment Information

Beneficiary Information

Unauthorized access can result in:

Data Breach

Financial Loss

Compliance Violations

Reputation Damage

API Security Overview

Security is applied before business logic is executed.

Authentication vs Authorization

Many developers confuse these concepts.

They are different.

Authentication

Authentication answers:

Who Are You?

Examples:

Username + Password

OAuth Login

JWT Token

Biometric Authentication

Authorization

Authorization answers:

What Are You Allowed To Do?

Examples:

Create Policy

View Policy

Approve Claim

Delete Policy

Authentication and Authorization Flow

Authentication occurs first.

Authorization occurs second.

Spring Security Overview

Spring Security is the standard security framework for Spring Boot.

Provides:

Authentication

Authorization

Session Management

CSRF Protection

Password Encryption

OAuth2 Support

JWT Support

Spring Security Architecture

Every request passes through the security filter chain.

Adding Spring Security

Maven Dependency

<dependency>
    <groupId>
        org.springframework.boot
    </groupId>

    <artifactId>
        spring-boot-starter-security
    </artifactId>
</dependency>

Default Security Behavior

Once added:

All Endpoints Become Protected

Spring automatically creates:

Generated Password

Basic Authentication

Security Filters

OAuth2 Fundamentals

Modern APIs rarely use username/password directly.

Instead they use:

OAuth2

OAuth2 is an authorization framework.

It allows secure delegated access.

OAuth2 Actors

OAuth2 includes:

Resource Owner

Client Application

Authorization Server

Resource Server

OAuth2 Architecture

OAuth2 separates authentication from resource access.

What is OpenID Connect?

OAuth2 handles authorization.

OpenID Connect (OIDC) adds:

Authentication

OIDC provides:

Identity Information

User Profile

Login Support

Examples:

Google Login

Microsoft Login

GitHub Login

What is JWT?

JWT stands for:

JSON Web Token

JWT enables stateless authentication.

Instead of storing sessions:

Server Issues Token

Client Sends Token

Server Validates Token

JWT Structure

A JWT contains three parts.

Header
   .

Payload
   .

Signature

Example:

xxxxx.yyyyy.zzzzz

JWT Architecture

JWT removes the need for server-side session storage.

JWT Header Example

{
  "alg": "HS256",
  "typ": "JWT"
}

JWT Payload Example

{
  "sub": "john.doe",

  "roles": ["POLICY_ADMIN"],

  "exp": 1735689600
}

JWT Signature

Signature ensures:

Token Integrity

Tamper Detection

If payload changes:

Signature Invalid

JWT Authentication Flow

This is the most common architecture used by modern APIs.

Login API Example

POST /api/auth/login

Request:

{
  "username": "agent01",
  "password": "password"
}

Response:

{
  "accessToken": "eyJhbGciOi..."
}

Sending JWT in Requests

Client sends:

Authorization:
Bearer eyJhbGciOi...

JWT Validation

Server validates:

Signature

Expiration

Issuer

Audience

Claims

Only valid tokens are accepted.

Role-Based Access Control (RBAC)

Authentication identifies users.

RBAC determines permissions.

Example Roles

ADMIN

POLICY_ADMIN

CLAIMS_ADMIN

AGENT

CUSTOMER

RBAC Model

Insurance Policy Management System

CUSTOMER
   ↓
View Own Policies

AGENT
   ↓
Create Policies

CLAIMS_ADMIN
   ↓
Approve Claims

ADMIN
   ↓
Full System Access

RBAC Model

Roles simplify authorization management.

Insurance System Role Matrix

Role	Create Policy	Approve Claim	View Customer
ADMIN	Yes	Yes	Yes
POLICY_ADMIN	Yes	No	Yes
CLAIMS_ADMIN	No	Yes	Yes
AGENT	Yes	No	Limited
CUSTOMER	No	No	Own Data

Securing Endpoints

@GetMapping("/policies")

Protect using:

@PreAuthorize(
 "hasRole('POLICY_ADMIN')"
)

RBAC Example

@PreAuthorize(
    "hasRole('CLAIMS_ADMIN')")
public void approveClaim() {

}

Only claim administrators can execute this method.

Security Configuration

@Configuration
@EnableMethodSecurity
public class SecurityConfig {

    @Bean
    SecurityFilterChain securityFilterChain(
            HttpSecurity http)
            throws Exception {

        return http.build();
    }

}

Centralized security management.

Security Filter Chain

@Bean
SecurityFilterChain securityFilterChain(
        HttpSecurity http)
        throws Exception {

    return http.build();
}

Security Processing Flow

Every API request is validated before reaching controllers.

Password Encryption

Passwords must never be stored in plain text.

Use:

BCryptPasswordEncoder

Example

String encodedPassword =
    encoder.encode(password);

Security Best Practices

✅ Use HTTPS everywhere

✅ Use JWT expiration

✅ Use strong password policies

✅ Encrypt sensitive data

✅ Apply RBAC

✅ Validate all tokens

✅ Use least-privilege access

✅ Rotate signing keys

Common Security Mistakes

❌ Hardcoding secrets

❌ Exposing internal APIs

❌ Using plain-text passwords

❌ Missing token validation

❌ Excessive permissions

❌ Storing JWTs insecurely

Interview Questions

Difference between Authentication and Authorization?
What is OAuth2?
What is OpenID Connect?
What is JWT?
Explain JWT structure.
What is RBAC?
Why use Spring Security?
What is a Security Filter Chain?
Why use BCrypt?
Why is JWT considered stateless?

Practice Exercises

Add Spring Security to IPMS.
Create login endpoint.
Generate JWT token.
Validate JWT token.
Create ADMIN role.
Create AGENT role.
Secure policy APIs.
Secure claim approval APIs.

Key Takeaways

Security is mandatory for enterprise APIs.
Authentication identifies users.
Authorization controls access.
OAuth2 enables delegated authorization.
OpenID Connect adds identity support.
JWT provides stateless authentication.
RBAC simplifies permission management.
Spring Security is the standard security framework for Spring Boot.

Chapter Summary

In this chapter, you learned:

Authentication
Authorization
Spring Security
OAuth2
OpenID Connect
JWT
RBAC
Endpoint Security
Password Encryption

Our Insurance Policy Management System can now authenticate users, authorize access, and secure APIs using enterprise-grade security standards.

In the next chapter, we will focus on Enterprise Integration using Feign Clients and Spring WebClient for communication with external systems.