@EnableWebSecurity

public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Override

protected void configure(HttpSecurity http) throws Exception {

http.csrf().disable()

.authorizeRequests()

.antMatchers("/api/**").permitAll()

.anyRequest().authenticated()

.and()

.addFilter(new JWTAuthenticationFilter(authenticationManager()))

.addFilter(new JWTAuthorizationFilter(authenticationManager()));

}

}

private AuthenticationManager authenticationManager;

public JWTAuthenticationFilter(AuthenticationManager authenticationManager) {

this.authenticationManager = authenticationManager;

}

@Override

public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {

String username = request.getParameter("username");

String password = request.getParameter("password");

UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);

return authenticationManager.authenticate(token);

}

}

@RequestMapping("/api/auth")

public class AuthController {

@Autowired

private AuthenticationManager authenticationManager;

@PostMapping("/login")

public ResponseEntity login(@RequestBody User user) {

try {

Authentication auth = authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(user.getUsername(), user.getPassword()));

String jwt = Jwts.builder().setSubject(((UserDetails)auth.getPrincipal()).getUsername()).signWith(SignatureAlgorithm.HS512, "secretkey").compact();

return ResponseEntity.ok(jwt);

} catch (Exception e) {

return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Invalid credentials");

}

}

}