Careeroza
What a Resource Server Does
The Job
A resource server is your API. It does not log anyone in. It only receives Authorization: Bearer <token>, checks the token, and decides whether to serve the request. In the medium level you wrote your own JWT filter; here the token comes from an external authorization server and Spring Security does all the checking.
Client ---- GET /api/orders, Bearer eyJhbGciOiJSUzI1NiIs... ----> order-service (resource server)
|
on startup (once, then cached): |
GET {issuer}/.well-known/openid-configuration -> jwks_uri |
GET {jwks_uri} -> public keys (kid -> RSA key) |
v
1. signature valid with key "kid"?
2. iss == configured issuer?
3. exp / nbf OK (60 s clock skew)?
4. aud contains "shopease-api"?
5. authorities from scope / roles
|
valid -> controller invalid -> 401 + WWW-AuthenticateJWT vs Opaque Tokens
| JWT (self-contained) | Opaque token | |
|---|---|---|
| Looks like | eyJhbGciOi... (three Base64URL parts) | random string, e.g. 8f14e45f... |
| How the API checks it | locally, with the issuer's public key | calls the introspection endpoint on every request (or cache) |
| Speed | fast, no network call | slower, extra hop |
| Revocation | valid until exp (keep it short) | instant |
| Spring DSL | oauth2ResourceServer(o -> o.jwt(...)) | oauth2ResourceServer(o -> o.opaqueToken(...)) |