🕒 Estimated Time: 6–7 hours total

Subtask Estimates

SZ-4: Implementation Approach: Spring Security – Hybrid AuthN/AuthZ Strategy

Decision Summary:

We’re going to implement a hybrid auth setup in Sztab. The idea is to use form-based login for the server-rendered web UI, and JWT-based stateless auth for REST APIs and future gRPC endpoints.

This gives us flexibility and a clean separation: web UI users get a traditional login flow with sessions, while API and service clients use tokens.

Comparison:

Form login uses HttpSession and cookies. It works well for server-rendered UIs (like Thymeleaf or JSP), has built-in CSRF/XSRF protection, and is simple to set up. But it requires session tracking on the server and doesn’t scale as easily across instances unless we add sticky sessions or shared session stores.

JWT auth is stateless. Clients send the token in the Authorization header (Bearer token). It works great for REST APIs, mobile apps, SPAs, and gRPC. It scales better, but requires us to handle token generation, validation, expiration, and possibly logout/blacklist mechanics. Also needs us to manage CSRF/XSS carefully if tokens are stored in browser-accessible storage.

Implementation Plan:

We’ll define two separate security filter chains. 1. For /ui/: uses form login, session tracking, and Spring Security defaults. Good for admin pages and server-rendered HTML. 2. For /api/: uses JWT. We’ll create a custom login endpoint (POST /api/auth/login) that returns a JWT. All other API routes will require a valid token. The system will be stateless — no sessions or CSRF protection here.

For gRPC: we’ll reuse the same JWT token and pass it in metadata. Server-side interceptors will validate it using the same logic as the REST filter.

Planned Code Structure: • SecurityConfig.java – defines both chains • JwtTokenProvider.java – creates and validates tokens • JwtAuthenticationFilter.java – filters incoming API requests • UserDetailsServiceImpl.java – loads user info from the DB • AuthController.java – exposes the /api/auth/login endpoint • AuthRequest.java and AuthResponse.java – DTOs for login • application.yml – stores secret key, token expiry config

Summary:

We get sessions for server-rendered pages and stateless JWT for APIs. Clean, scalable, and extensible for future use cases (like service-to-service auth with gRPC).

Starting with AuthN in feature branch feature/sz-4-spring-security-authn-authz

Sub-issues:

•  SZ-4a: Implement Authentication (OAuth2/OIDC login + JWT token support)
•  SZ-4b: Implement Authorization (role-based access control via Keycloak roles)