java 42 lines · 7 steps

Issuing JWT and refresh tokens on login in Spring

A Spring Security success handler that mints an access token in the body and a hardened refresh-token cookie after login.

Explained by highlit

Spring Intermediate authentication jwt http-cookies dependency-injection spring-security

1@Component
2public class RefreshTokenSuccessHandler implements AuthenticationSuccessHandler {
3 
  private final RefreshTokenService refreshTokenService;
  private final JwtService jwtService;
  private final ObjectMapper objectMapper;
7 
  @Value("${security.jwt.refresh-token-ttl:604800}")
  private long refreshTokenTtlSeconds;
10 
  public RefreshTokenSuccessHandler(RefreshTokenService refreshTokenService,
                                    JwtService jwtService,
                                    ObjectMapper objectMapper) {
      this.refreshTokenService = refreshTokenService;
      this.jwtService = jwtService;
      this.objectMapper = objectMapper;
  }
18 
  @Override
  public void onAuthenticationSuccess(HttpServletRequest request,
                                      HttpServletResponse response,
                                      Authentication authentication) throws IOException {
      UserDetails user = (UserDetails) authentication.getPrincipal();
24 
      String accessToken = jwtService.issueAccessToken(user);
      RefreshToken refreshToken = refreshTokenService.createFor(user.getUsername());
27 
      ResponseCookie cookie = ResponseCookie.from("refresh_token", refreshToken.getValue())
              .httpOnly(true)
              .secure(true)
              .sameSite("Strict")
              .path("/api/auth/refresh")
              .maxAge(Duration.ofSeconds(refreshTokenTtlSeconds))
              .build();
      response.addHeader(HttpHeaders.SET_COOKIE, cookie.toString());
36 
      response.setStatus(HttpStatus.OK.value());
      response.setContentType(MediaType.APPLICATION_JSON_VALUE);
      objectMapper.writeValue(response.getWriter(),
              Map.of("accessToken", accessToken, "tokenType", "Bearer"));
  }
42}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Splitting tokens — short-lived access token in the body, long-lived refresh token in an HttpOnly cookie — limits the blast radius if either leaks.
2Scoping a cookie with HttpOnly, Secure, SameSite, and a narrow path hardens it against XSS and CSRF theft.
3Spring Security's AuthenticationSuccessHandler is the seam for customizing exactly what a successful login returns to the client.

Related explainers

typescript

import { registerLocaleData } from '@angular/common';
import localeFr from '@angular/common/locales/fr';
import localeFrExtra from '@angular/common/locales/extra/fr';
import localeDe from '@angular/common/locales/de';

Locale-aware bootstrapping in Angular

i18n localization dependency-injection

Intermediate 8 steps

typescript

import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import * as Joi from 'joi';

Validating env config at boot in NestJS

configuration schema-validation environment-variables

Intermediate 8 steps

java

@Component
@Converter
public class EncryptedStringConverter implements AttributeConverter<String, String> {

Transparent column encryption in Spring & JPA

encryption aes-gcm jpa-converter

Advanced 10 steps

python

import time
import uuid
 
from django.utils.deprecation import MiddlewareMixin

Attaching per-request context in Django

middleware request lifecycle multi-tenancy

Intermediate 7 steps

typescript

import { Inject, Injectable, Logger } from '@nestjs/common';
import { CACHE_MANAGER } from '@nestjs/cache-manager';
import { Cache } from 'cache-manager';
import { InjectRepository } from '@nestjs/typeorm';

A cache-aside country lookup in NestJS

cache-aside dependency-injection batch-lookup

Intermediate 8 steps

java

package com.acme.billing.config;
 
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
import org.springframework.boot.context.properties.ConfigurationProperties;