Implement JWT token handling

Oct 13, 2025 by magicalceylontours.com 5 views

Introduction

In today's digital landscape, authentication is a crucial aspect of any web or mobile application. The existing authentication mechanism in our system relies on setting a cookie when logging in with a JWT token. While this approach works well for browsers, it is not suitable for mobile devices, which typically rely on Authorization headers instead of cookies. This ticket aims to modify the authentication system to support mobile authentication while maintaining browser compatibility.

What You Will Learn

As a contributor, you will learn the following skills:

Implement JWT token handling for mobile authentication
Learn refresh token mechanisms for secure session management
Work with middleware logic to support both web and mobile authentication
Understand best practices for secure authentication in web and mobile applications

Desired Skills

To contribute to this project, you should have the following skills:

Familiarity with JWT authentication and token management
Knowledge of Express.js/Spring Boot (or applicable backend framework)
Understanding of middleware and request handling
Experience with mobile API authentication (optional but beneficial)

Goals

The goals of this project are:

Generate a JWT token in the response body for mobile users instead of setting a cookie
Implement refresh tokens with a long expiry for session management
Create a new API to refresh JWT tokens securely
Modify middleware to handle both cookies (for web) and Authorization headers (for mobile)

Expected Outcome

The expected outcome of this project is to have an authentication system that supports both web and mobile clients seamlessly. This will ensure:

Web clients continue using cookies
Mobile clients receive JWT tokens in the response body
Refresh tokens enable long-lived authentication
Middleware properly handles both cookies and Authorization headers

Implementation Details

To achieve the expected outcome, the following implementation details will be followed:

Detect user agent to differentiate between web and mobile requests
Modify login flow to return JWT tokens in response body for mobile users
Implement refresh token logic and store it securely
Create a refresh token API to generate new JWT tokens when needed
Update middleware to handle both web-based cookies and mobile Authorization headers

Mockups/Wireframes

No mockups or wireframes are required for this project.

Product Name

The product name is AMRIT.

Organisation Name

The organisation name is Piramal Swasthya Management and Research Institute.

Domain

The domain is Healthcare.

Tech Skills Needed

The tech skills needed for this project are:

Spring Boot
Java

Mentor(s)

The mentor for this project is @drtechie.

Complexity

The complexity of this project is High.

Implementation

Step 1: Detect User Agent

To differentiate between web and mobile requests, we will detect the user agent using the following code:

String userAgent = request.getHeader("User-Agent");
if (userAgent.contains("Mobile")) {
    // Handle mobile request
} else {
    // Handle web request
}

Step 2: Modify Login Flow

To return JWT tokens in the response body for mobile users, we will modify the login flow as follows:

@PostMapping("/login")
public ResponseEntity<JWTToken> login(@RequestBody User user) {
    // Authenticate user
    JWTToken token = authenticateUser(user);
    return ResponseEntity.ok(token);
}

Step 3: Implement Refresh Token Logic

To implement refresh token logic and store it securely, we will use the following code:

@Service
public class RefreshTokenService {
    @Autowired
    private TokenStore tokenStore;

    public void storeRefreshToken(String refreshToken) {
        tokenStore.storeRefreshToken(refreshToken);
    }

    public String getRefreshToken(String userId) {
        return tokenStore.getRefreshToken(userId);
    }
}

Step 4: Create Refresh Token API

To create a refresh token API to generate new JWT tokens when needed, we will use the following code:

@PostMapping("/refresh-token")
public ResponseEntity<JWTToken> refreshToken(@RequestBody RefreshToken refreshToken) {
    // Validate refresh token
    if (!tokenStore.validateRefreshToken(refreshToken.getRefreshToken())) {
        return ResponseEntity.badRequest().build();
    }

    // Generate new JWT token
    JWTToken token = generateJWTToken(refreshToken.getUserId());
    return ResponseEntity.ok(token);
}

Step 5: Update Middleware

To update middleware to handle both web-based cookies and mobile Authorization headers, we will use the following code:

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/login").permitAll()
                .anyRequest().authenticated()
                .and()
                .oauth2Login()
                .and()
                .oauth2Client();
    }
}

Testing

To test the implementation, we will use the following test cases:

@Test
public void testMobileLogin() {
    // Arrange
    User user = new User("mobileUser", "password");
    JWTToken token = authenticateUser(user);

    // Act
    ResponseEntity<JWTToken> response = login(token);

    // Assert
    assertEquals(HttpStatus.OK, response.getStatusCode());
    assertNotNull(response.getBody());
}

@Test
public void testRefreshToken() {
    // Arrange
    User user = new User("refreshUser", "password");
    JWTToken token = authenticateUser(user);
    RefreshToken refreshToken = new RefreshToken(token.getRefreshToken());

    // Act
    ResponseEntity<JWTToken> response = refreshToken(refreshToken);

    // Assert
    assertEquals(HttpStatus.OK, response.getStatusCode());
    assertNotNull(response.getBody());
}

Conclusion

Introduction

In our previous article, we discussed how to handle JWT token-based authentication for mobile devices. In this article, we will answer some frequently asked questions related to this topic.

Q1: What is JWT token-based authentication?

A: JWT token-based authentication is a method of authentication where a JSON Web Token (JWT) is generated and sent to the client. The client then uses this token to authenticate with the server.

Q2: Why do we need to handle JWT token-based authentication for mobile devices?

A: Mobile devices typically rely on Authorization headers instead of cookies, which is not suitable for the existing authentication mechanism that sets a cookie when logging in with a JWT token. Therefore, we need to modify the authentication system to support mobile authentication while maintaining browser compatibility.

Q3: How do we detect user agent to differentiate between web and mobile requests?

A: We can detect the user agent using the following code:

String userAgent = request.getHeader("User-Agent");
if (userAgent.contains("Mobile")) {
    // Handle mobile request
} else {
    // Handle web request
}

Q4: How do we modify the login flow to return JWT tokens in the response body for mobile users?

A: We can modify the login flow as follows:

@PostMapping("/login")
public ResponseEntity<JWTToken> login(@RequestBody User user) {
    // Authenticate user
    JWTToken token = authenticateUser(user);
    return ResponseEntity.ok(token);
}

Q5: How do we implement refresh token logic and store it securely?

A: We can implement refresh token logic and store it securely using the following code:

@Service
public class RefreshTokenService {
    @Autowired
    private TokenStore tokenStore;

    public void storeRefreshToken(String refreshToken) {
        tokenStore.storeRefreshToken(refreshToken);
    }

    public String getRefreshToken(String userId) {
        return tokenStore.getRefreshToken(userId);
    }
}

Q6: How do we create a refresh token API to generate new JWT tokens when needed?

A: We can create a refresh token API to generate new JWT tokens when needed using the following code:

@PostMapping("/refresh-token")
public ResponseEntity<JWTToken> refreshToken(@RequestBody RefreshToken refreshToken) {
    // Validate refresh token
    if (!tokenStore.validateRefreshToken(refreshToken.getRefreshToken())) {
        return ResponseEntity.badRequest().build();
    }

    // Generate new JWT token
    JWTToken token = generateJWTToken(refreshToken.getUserId());
    return ResponseEntity.ok(token);
}

Q7: How do we update middleware to handle both web-based cookies and mobile Authorization headers?

A: We can update middleware to handle both web-based cookies and mobile Authorization headers using the following code:

@Configuration
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and()
                .csrf().disable()
                .authorizeRequests()
                .antMatchers("/login").permitAll()
                .anyRequest().authenticated()
                .and()
                .oauth2Login()
                .and()
                .oauth2Client();
    }
}

Q8: How do we test the implementation?

A: We can test the implementation using the following test cases:

@Test
public void testMobileLogin() {
    // Arrange
    User user = new User("mobileUser", "password");
    JWTToken token = authenticateUser(user);

    // Act
    ResponseEntity<JWTToken> response = login(token);

    // Assert
    assertEquals(HttpStatus.OK, response.getStatusCode());
    assertNotNull(response.getBody());
}

@Test
public void testRefreshToken() {
    // Arrange
    User user = new User("refreshUser", "password");
    JWTToken token = authenticateUser(user);
    RefreshToken refreshToken = new RefreshToken(token.getRefreshToken());

    // Act
    ResponseEntity<JWTToken> response = refreshToken(refreshToken);

    // Assert
    assertEquals(HttpStatus.OK, response.getStatusCode());
    assertNotNull(response.getBody());
}

Conclusion

In conclusion, handling JWT token-based authentication for mobile devices requires modifying the authentication system to support mobile authentication while maintaining browser compatibility. We can detect user agent, modify the login flow, implement refresh token logic, create a refresh token API, and update middleware to handle both web-based cookies and mobile Authorization headers. The implementation requires the following skills: familiarity with JWT authentication and token management, knowledge of Express.js/Spring Boot (or applicable backend framework), understanding of middleware and request handling, and experience with mobile API authentication (optional but beneficial).