Careeroza

Real World Example

Mobile Apps and SPAs Use Bearer Tokens

Apps like Paytm, PhonePe, Zomato and most Indian startups' React or Flutter apps talk to a stateless API with short-lived bearer tokens. The same backend serves the website, the Android app and the iOS app, because a header token works everywhere (cookies are awkward in mobile apps). Here is ShopEase's full JWT flow from the command line.

Client                      JwtAuthFilter            Rules / Controller
  |  POST /api/auth/login        (skipped: no header)   AuthController -> 200 {accessToken}
  |  GET /api/me + Bearer ok  -> verify ok, set auth  -> authenticated -> 200
  |  GET /api/me + tampered   -> bad signature        -> no auth -> EntryPoint -> 401
  |  GET /api/admin/users     -> verify ok (CUSTOMER) -> hasRole ADMIN fails -> 403

The Whole Flow with curl

Example

TOKEN=$(curl -s -X POST localhost:8080/api/auth/login -H "Content-Type: application/json" \
  -d '{"email":"[email protected]","password":"asha123"}' | jq -r .accessToken)

curl -i localhost:8080/api/me -H "Authorization: Bearer $TOKEN"
curl -i localhost:8080/api/me -H "Authorization: Bearer ${TOKEN}x"
curl -i localhost:8080/api/admin/users -H "Authorization: Bearer $TOKEN"
curl -i localhost:8080/api/products/7

Example output

HTTP/1.1 200 OK
{"email":"[email protected]","authorities":["ROLE_CUSTOMER"]}

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token"
{"status":401,"error":"Unauthorized","message":"Invalid access token","path":"/api/me"}

HTTP/1.1 403 Forbidden
{"status":403,"error":"Forbidden","message":"You do not have permission to access this resource","path":"/api/admin/users"}

HTTP/1.1 200 OK
{"id":7,"name":"boAt Rockerz 450","price":1499.0,"stock":120,"category":"Audio"}

Checklist

  • Secret: random, at least 32 bytes, from an environment variable.
  • Access token TTL: 5–15 minutes.
  • Claims: sub, roles, iat, exp, iss. No personal or secret data.
  • Sessions: STATELESS; CSRF disabled only because the token is not in a cookie.
  • HTTPS everywhere: a stolen token works for anyone until it expires.