Hi all, Currently, spring security does not provide built-in support of creation of JWT out of the box. Consequently, this would mean developers need to manually write tons of implementation code (including our own Filter, creating and verifying JWT), as evidenced from the below articles among many others Article 1 Article 2
Our backend application would rely on username and password authentication (which thankfully Spring security has direct support to) and once authenticated succesfully, create JWT (yes, sessionless) and send to browser. For every subsequent page visited, backend will verify the JWT in the browser request.
To avoid over-bloating our application, we avoid include OAuth2 Resource Server and OAuth2 Authorization Server libraries as we are not dealing with Oauth mechanism.
For the above-mentioned scenarios, if spring security has built-in support for that, and with the autoconfiguration provided by spring boot, the above scenario's implementation would be a breeze.