<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
  <groupId>io.jsonwebtoken</groupId>
  <artifactId>jjwt</artifactId>
  <version>0.9.1</version>
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-web</artifactId>
</dependency>

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  @Autowired
  private UserDetailsService userDetailsService;
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .csrf().disable()
      .authorizeRequests()
        .antMatchers("/auth/**").permitAll()
        .anyRequest().authenticated()
      .and().formLogin()
        .loginPage("/auth/login")
        .successHandler(authenticationSuccessHandler())
        .failureHandler(authenticationFailureHandler())
        .permitAll()
      .and().logout()
        .logoutUrl("/auth/logout")
        .logoutSuccessUrl("/auth/login?logout")
        .invalidateHttpSession(true)
        .deleteCookies("JSESSIONID");
  }
  @Override
  protected void configure(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(passwordEncoder());
  }
  @Bean
  public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
  }
  @Bean
  public AuthenticationSuccessHandler authenticationSuccessHandler() {
    return new JWTAuthenticationSuccessHandler();
  }
  @Bean
  public AuthenticationFailureHandler authenticationFailureHandler() {
    return new JWTAuthenticationFailureHandler();
  }
}

public class JWTAuthenticationSuccessHandler extends SimpleUrlAuthenticationSuccessHandler {
  private static final String JWT_SECRET = "secret";
  private static final long JWT_EXPIRATION_TIME = 864000000; // 10 days
  @Override
  public void onAuthenticationSuccess(HttpServletRequest request, HttpServletResponse response,
    Authentication authentication) throws IOException, ServletException {
    String username = authentication.getName();
    String token = Jwts.builder()
      .setSubject(username)
      .setExpiration(new Date(System.currentTimeMillis() + JWT_EXPIRATION_TIME))
      .signWith(SignatureAlgorithm.HS512, JWT_SECRET.getBytes())
      .compact();
    response.setHeader("Authorization", "Bearer " + token);
    response.getWriter().write("{\"token\":\"Bearer " + token + "\"}");
    response.setContentType("application/json");
  }
}

public class JWTAuthenticationFailureHandler extends SimpleUrlAuthenticationFailureHandler {
  @Override
  public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
    AuthenticationException exception) throws IOException, ServletException {
    response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
    response.getWriter().write("{\"error\":\"Bad credentials\"}");
    response.setContentType("application/json");
  }
}

@RestController
public class ResourceController {
  private static final String JWT_SECRET = "secret";
  @GetMapping("/resource")
  public ResponseEntity<String> getResource(HttpServletRequest request) {
    String token = request.getHeader("Authorization").replace("Bearer ", "");
    if (isValidJWT(token)) {
      return ResponseEntity.ok("Protected resource");
    } else {
      return ResponseEntity.status(HttpStatus.UNAUTHORIZED).build();
    }
  }
  private boolean isValidJWT(String jwt) {
    try {
      Jwts.parser().setSigningKey(JWT_SECRET.getBytes()).parseClaimsJws(jwt);
      return true;
    } catch (JwtException e) {
      return false;
    }
  }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
  @Override
  protected void configure(HttpSecurity http) throws Exception {
    http
      .csrf().disable()
      .authorizeRequests()
      .antMatchers("/resource").authenticated()
      .and().sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
      .and().addFilterBefore(new JWTAuthorizationFilter(), UsernamePasswordAuthenticationFilter.class);
  }
}

public class JWTAuthorizationFilter extends OncePerRequestFilter {
  private static final String JWT_SECRET = "secret";
  @Override
  protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response,
    FilterChain filterChain) throws ServletException, IOException {
    String authorizationHeader = request.getHeader("Authorization");
    if (authorizationHeader == null || !authorizationHeader.startsWith("Bearer ")) {
      filterChain.doFilter(request, response);
      return;
    }
    String jwt = authorizationHeader.replace("Bearer ", "");
    try {
      Jws<Claims> claimsJws = Jwts.parser().setSigningKey(JWT_SECRET.getBytes()).parseClaimsJws(jwt);
      String username = claimsJws.getBody().getSubject();
      List<GrantedAuthority> authorities = new ArrayList<>();
      UserDetails userDetails = new User(username, "", authorities);
      UsernamePasswordAuthenticationToken authentication = new UsernamePasswordAuthenticationToken(
        userDetails, null, userDetails.getAuthorities());
      SecurityContextHolder.getContext().setAuthentication(authentication);
    } catch (JwtException e) {
      throw new ServletException("Invalid JWT");
    }
    filterChain.doFilter(request, response);
  }
}