Spring Boot 3 with Auth0

 Spring Boot 3 with Auth0

Spring Boot 3 is using Spring Security 6 which have some updates. To get Auth0 JWT access token to work I created this simple Github repository. You can find it in this branch

https://github.com/AIMMOTH/spring-boot-3/tree/auth0-security

Auth0 SecurityFilterChain

This repository contains a class with @Configuration and @EnableWebSecurity and matches on request to determine to authorize or permit all. See whole example below:

@Configuration
@EnableWebSecurity
@Log
public class SecurityConfig {

  @Value("${auth0.audience}")
  private String audience;

  @Value("${spring.security.oauth2.resourceserver.jwt.issuer-uri}")
  private String issuer;

  @Bean
  public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests()
        .requestMatchers("/api/v1/public/**")
        ).permitAll()
        .requestMatchers("/api/v1/private/**").authenticated()
        .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and().oauth2ResourceServer().jwt()
        ;
    return http.build();
  }

  @Bean
  JwtDecoder jwtDecoder() {
      log.info("audience:" + audience + ", issuer:" + issuer);
      NimbusJwtDecoder jwtDecoder = (NimbusJwtDecoder) JwtDecoders.fromOidcIssuerLocation(issuer);

      OAuth2TokenValidator<Jwt> audienceValidator = new AudienceValidator(audience);
      OAuth2TokenValidator<Jwt> withIssuer = JwtValidators.createDefaultWithIssuer(issuer);
      OAuth2TokenValidator<Jwt> withAudience = new DelegatingOAuth2TokenValidator<>(withIssuer, audienceValidator);

      jwtDecoder.setJwtValidator(withAudience);

      return jwtDecoder;
  }
}