Book Image

Modern API Development with Spring 6 and Spring Boot 3 - Second Edition

By : Sourabh Sharma
1 (1)
Book Image

Modern API Development with Spring 6 and Spring Boot 3 - Second Edition

1 (1)
By: Sourabh Sharma

Overview of this book

Spring is a powerful and widely adopted framework for building scalable and reliable web applications in Java, complemented by Spring Boot, a popular extension to the framework that simplifies the setup and configuration of Spring-based applications. This book is an in-depth guide to harnessing Spring 6 and Spring Boot 3 for web development, offering practical knowledge of building modern robust web APIs and services. The book covers a wide range of topics that are essential for API development, including RESTful web service fundamentals, Spring concepts, and API specifications. It also explores asynchronous API design, security, designing user interfaces, testing APIs, and the deployment of web services. In addition to its comprehensive coverage, this book offers a highly contextual real-world sample app that you can use as a reference for building different types of APIs for real-world applications. This sample app will lead you through the entire API development cycle, encompassing design and specification, implementation, testing, and deployment. By the end of this book, you’ll have learned how to design, develop, test, and deploy scalable and maintainable modern APIs using Spring 6 and Spring Boot 3, along with best practices for bolstering the security and reliability of your applications and improving your application's overall functionality.
Table of Contents (21 chapters)
1
Part 1 – RESTful Web Services
7
Part 2 – Security, UI, Testing, and Deployment
12
Part 3 – gRPC, Logging, and Monitoring
16
Part 4 – GraphQL

Securing REST APIs with JWT

In this section, you’ll secure the REST endpoints exposed in Chapter 4, Writing Business Logic for APIs. Therefore, we’ll use the code from Chapter 4 and enhance it to secure the APIs.

The REST APIs should be protected using the following techniques:

  • No secure API should be accessed without a JWT.
  • A JWT can be generated using sign-in/sign-up or a refresh token.
  • A JWT and a refresh token should only be provided for a valid user’s username/password combination or a valid user sign-up.
  • The password should be stored in an encoded format using a bcrypt strong hashing function.
  • The JWT should be signed with Rivest-Shamir-Adleman (RSA) keys with a strong algorithm.

RSA

RSA is an algorithm approved by the Federal Information Processing Standards (FIPS) (FIPS 186) for digital signatures and in Special Publication (SP) (SP800-56B) for key establishment.

  • Claims in the payload should not store sensitive...