We need to implement the backend logic for user authentication using Spring Boot, including user registration, login, and JWT-based session management. Users should be able to securely register and log in, receiving a token they can use for authenticated requests.
Acceptance Criteria
✅ User Registration
-
Endpoint: POST /api/auth/register
-
Accepts: full name, email, password, role
-
Validates:
- Unique email
- Valid email format
- Secure password (e.g., min length 8, etc.)
-
Hash the password before saving (use BCryptPasswordEncoder)
-
Store user in database
-
Return success message or token
Validation methods are already available in validationUtil, You have to use them only.
✅ User Login
- Endpoint:
POST /api/auth/login
- Accepts:
email, password
- Authenticates user and issues a JWT token
- Return JWT token in response in Authorization header.
Database
Create users table/model with fields:
id, full name, email, password_hash, created_at, updated_at, is_deleted
🔐 Authentication Token Strategy (JWT)
How to Store and Use JWT:
- Generate a JWT token on login
- Send it in the Authorization header as
Bearer <token> for all authenticated requests
- Use a Spring Security filter to intercept requests and validate the token
How to Expire/Invalidate Tokens:
- Set an expiry time in JWT (e.g., 15–30 mins)
- Use Refresh tokens for re-authentication
- store JWTs in Redis for manual logout/blacklisting
🛠 Tech Stack
- Backend: Spring Boot 3+
- Security: Spring Security
- Database: PostgreSQL (JPA/Hibernate)
- Password Hashing: BCryptPasswordEncoder
- Token: JWT (use
jjwt or java-jwt libraries)
📄 Deliverables
- API endpoints:
api/auth/register, api/auth/login
- JWT-based authentication with expiry
- User entity + JPA repo
- Security config (JWT filter, WebSecurityConfigurer)
- Basic error handling
- Unit tests for services and controllers
- Refresh tokens
- Logout endpoint (JWT blacklist in Redis or DB)
Notes:
Please include unit tests and basic documentation in the code (e.g., Swagger/OpenAPI or inline comments).
We need to implement the backend logic for user authentication using Spring Boot, including user registration, login, and JWT-based session management. Users should be able to securely register and log in, receiving a token they can use for authenticated requests.
Acceptance Criteria
✅ User Registration
Endpoint:
POST /api/auth/registerAccepts:
full name,email,password,roleValidates:
Hash the password before saving (use
BCryptPasswordEncoder)Store user in database
Return success message or token
Validation methods are already available in validationUtil, You have to use them only.
✅ User Login
POST /api/auth/loginemail,passwordDatabase
Create
userstable/model with fields:id,full name,email,password_hash,created_at,updated_at,is_deleted🔐 Authentication Token Strategy (JWT)
How to Store and Use JWT:
Bearer <token>for all authenticated requestsHow to Expire/Invalidate Tokens:
🛠 Tech Stack
jjwtorjava-jwtlibraries)📄 Deliverables
api/auth/register,api/auth/loginNotes:
Please include unit tests and basic documentation in the code (e.g., Swagger/OpenAPI or inline comments).