TrickySpring Boot#488 min readJul 11, 2026
OAuth2 vs JWT.
practice
Hook: Interviewers love this question because many candidates treat OAuth2 and JWT like competing tools, when they actually solve different problems.
Question: OAuth2 vs JWT.
Answer: OAuth2 is an authorization framework: it defines how an app gets permission to call another app’s API. JWT is a token format: it is a compact string that can carry claims like the user, expiry, and scopes, and can be verified by signature. In Spring Boot, OAuth2 often handles the flow, while JWT is often the access token that the resource server validates.
Interview-Ready Answer: I’d say OAuth2 and JWT are not the same kind of thing. OAuth2 is the authorization framework that defines how a client gets delegated access, like authorization code or client credentials. JWT is a token format that can be used as an access token and validated locally by checking its signature and expiry. In Spring Boot, I often use OAuth2 for the flow and JWT as the token the resource server accepts.
%22%20stroke%3D%22%234f46e5%22%20stroke-width%3D%221.5%22%2F%3E%3Ctext%20x%3D%22500%22%20y%3D%22308%22%20text-anchor%3D%22middle%22%20font-size%3D%2215%22%20font-weight%3D%22bold%22%20fill%3D%22%23ffffff%22%20font-family%3D%22Segoe%20UI%2C%20Arial%2C%20sans-serif%22%3EOAuth2%20JWT%3C%2Ftext%3E%3C%2Fsvg%3E)
What each term means
OAuth2 is a delegation framework. In plain words, it answers: how does one app get limited access to another app without knowing the user’s password? A common example is a mobile app or browser app getting permission to call an API.
JWT means JSON Web Token. It is a token format, not a login system. A JWT contains claims (pieces of data, like sub for subject and exp for expiry) and is usually signed so the receiver can verify that nobody changed it.
The biggest interview trap is this: OAuth2 is the process; JWT is the package. OAuth2 can use a JWT access token, or it can use an opaque token (a random string with no readable content). JWT can also be used outside OAuth2.
How it works under the hood in Spring Boot
- The user starts in the client app, such as a React front end or a mobile app.
- The client gets permission through an OAuth2 flow, most commonly Authorization Code + PKCE for browser/mobile apps or Client Credentials for service-to-service calls. PKCE means Proof Key for Code Exchange; it stops code theft in public clients.
- The authorization server returns an access token. That access token may be a JWT or an opaque token.
- The Spring Boot resource server receives the request. If the token is JWT, it checks the signature, expiry, issuer, audience, and scopes locally. If the token is opaque, it usually calls an introspection endpoint on the authorization server.
- The app makes an authorization decision. In Spring Security, this often becomes a check like: does the token have the right scope or role for this endpoint?
Why this matters: JWT validation is fast because the resource server can do it locally. Opaque tokens are easier to revoke centrally, but each request may need a network call.
OAuth2 vs JWT comparison
| Aspect | OAuth2 | JWT |
|---|---|---|
| What it is | Authorization framework | Token format |
| Main job | Delegated access flow | Carry signed claims |
| Can stand alone? | Yes | Yes |
| Typical use | Login/consent/API access | Access token or ID token |
| Validation | Flow + server rules | Signature + expiry |
| Spring Boot module | oauth2-client, oauth2-resource-server | Often same resource server, or custom JWT code |
When to use what
- Use OAuth2 when you need a standard way for a client to get access to an API.
- Use JWT when you want a self-contained token that can be checked without calling a database on every request.
- Use both together in most real systems: OAuth2 defines the flow, and JWT carries the access token.
- Use opaque tokens when central revocation and instant invalidation matter more than local verification speed.
Performance and edge cases
JWT validation is roughly O(n) in token size because the server must parse the token and verify the signature, but the token is usually only 1-3 KB, so it feels close to constant time. In practice, local JWT validation is often in the microsecond-to-low-millisecond range, while opaque token introspection can add a 20-100 ms network hop.
Typical access tokens live about 5-15 minutes. Refresh tokens often live for days or weeks, depending on policy. Short-lived access tokens reduce damage if a token is stolen.
Important gotchas:
- JWT is not encryption. It is usually just Base64URL-encoded and signed, so anyone can read the payload unless you use JWE, which is encrypted.
- Do not put secrets in JWTs. Put identifiers and claims, not passwords or API keys.
- Always validate
iss,aud, andexp. Signature alone is not enough. - Key rotation matters. With RSA or EC keys, Spring Boot resource servers can use a JWK Set URI so they can pick up rotated keys.
- OAuth2 is not login by itself. For authentication, many apps use OpenID Connect on top of OAuth2.
Memory hook: OAuth2 is the bouncer’s rulebook; JWT is the stamped wristband. The rulebook decides who gets in, and the wristband is the proof you can show at the door.
Real-World Example: Imagine an e-commerce checkout service in Spring Boot. The front end sends users to an identity provider using OAuth2 Authorization Code + PKCE. After login, the identity provider returns a JWT access token. The checkout API validates that token locally on every request, checks the expiry, and reads the user id and scopes from the claims.
Now the bug story: a team assumes “JWT means authenticated” and forgets to validate the aud claim and key rotation. A token minted for a staging app is accepted in production, or an old signing key keeps being trusted too long. Symptoms show up as either unexpected data access or a spike of 401 Unauthorized responses after deploy. Logs often show messages like invalid signature, expired token, or audience mismatch. Users see logout loops, broken checkout, or repeated login prompts until the config or key set is fixed.
Spring Boot
package com.example.demo;
import com.fasterxml.jackson.databind.ObjectMapper;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.Bean;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.PostMapping;
import org.springframework.web.bind.annotation.RequestBody;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.filter.OncePerRequestFilter;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.io.IOException;
import java.nio.charset.StandardCharsets;
import java.security.MessageDigest;
import java.time.Instant;
import java.util.Collections;
import java.util.LinkedHashMap;
import java.util.Map;
import java.util.Optional;
@SpringBootApplication
public class OAuth2VsJwtDemoApplication {
public static void main(String[] args) {
SpringApplication.run(OAuth2VsJwtDemoApplication.class, args);
}
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http, JwtAuthenticationFilter jwtAuthenticationFilter) throws Exception {
return http
// Stateless APIs usually disable CSRF because bearer tokens are sent in the Authorization header,
// not as browser cookies.
.csrf(csrf -> csrf.disable())
.sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authorizeHttpRequests(auth -> auth
.requestMatchers("/auth/login", "/api/public").permitAll()
.anyRequest().authenticated())
.addFilterBefore(jwtAuthenticationFilter, UsernamePasswordAuthenticationFilter.class)
.build();
}
@Bean
JwtService jwtService(ObjectMapper objectMapper) {
return new JwtService(objectMapper, "change-me-in-prod-change-me-in-prod");
}
@Bean
JwtAuthenticationFilter jwtAuthenticationFilter(JwtService jwtService) {
return new JwtAuthenticationFilter(jwtService);
}
}
record LoginRequest(String username, String password) {}
@RestController
class AuthController {
private final JwtService jwtService;
private final Map<String, String> users = Map.of(
"alice", "password123",
"bob", "s3cret"
);
AuthController(JwtService jwtService) {
this.jwtService = jwtService;
}
@PostMapping("/auth/login")
ResponseEntity<Map<String, Object>> login(@RequestBody LoginRequest request) {
String expected = users.get(request.username());
if (expected == null || !expected.equals(request.password())) {
return ResponseEntity.status(HttpStatus.UNAUTHORIZED)
.body(Map.of("error", "bad_credentials"));
}
String token = jwtService.issueToken(request.username());
return ResponseEntity.ok(Map.of(
"access_token", token,
"token_type", "Bearer",
"expires_in_seconds", 900
));
}
}
@RestController
class ApiController {
@GetMapping("/api/public")
Map<String, String> publicEndpoint() {
return Map.of("message", "public endpoint");
}
@GetMapping("/api/me")
Map<String, Object> me(Authentication authentication) {
return Map.of(
"user", authentication.getName(),
"message", "JWT accepted"
);
}
}
class JwtAuthenticationFilter extends OncePerRequestFilter {
private final JwtService jwtService;
JwtAuthenticationFilter(JwtService jwtService) {
this.jwtService = jwtService;
}
@Override
protected void doFilterInternal(HttpServletRequest request,
HttpServletResponse response,
FilterChain filterChain) throws ServletException, IOException {
String header = request.getHeader("Authorization");
// If no token is present, let Spring Security handle the anonymous/public path.
if (header != null && header.startsWith("Bearer ")) {
String token = header.substring(7).trim();
Optional<String> subject = jwtService.validateAndGetSubject(token);
// This is the failure path interviewers care about: bad signature, bad format, or expired token.
if (subject.isEmpty()) {
response.setStatus(HttpStatus.UNAUTHORIZED.value());
response.setContentType("application/json");
response.getWriter().write("{\"error\":\"invalid_or_expired_token\"}");
return;
}
UsernamePasswordAuthenticationToken authentication =
new UsernamePasswordAuthenticationToken(subject.get(), null, Collections.emptyList());
SecurityContextHolder.getContext().setAuthentication(authentication);
}
filterChain.doFilter(request, response);
}
}
class JwtService {
private static final long TTL_SECONDS = 900;
private final ObjectMapper objectMapper;
private final SecretKeySpec keySpec;
JwtService(ObjectMapper objectMapper, String secret) {
this.objectMapper = objectMapper;
// HMAC keeps this demo self-contained. Real systems often use RSA or EC keys so resource servers
// can verify with a public key and the auth server keeps the private key.
this.keySpec = new SecretKeySpec(secret.getBytes(StandardCharsets.UTF_8), "HmacSHA256");
}
String issueToken(String subject) {
long now = Instant.now().getEpochSecond();
Map<String, Object> header = Map.of(
"alg", "HS256",
"typ", "JWT"
);
Map<String, Object> payload = new LinkedHashMap<>();
payload.put("sub", subject);
payload.put("iat", now);
payload.put("exp", now + TTL_SECONDS);
payload.put("iss", "spring-boot-demo");
String headerPart = base64Url(json(header));
String payloadPart = base64Url(json(payload));
String signaturePart = sign(headerPart + "." + payloadPart);
return headerPart + "." + payloadPart + "." + signaturePart;
}
Optional<String> validateAndGetSubject(String token) {
try {
int firstDot = token.indexOf('.');
int secondDot = token.indexOf('.', firstDot + 1);
if (firstDot <= 0 || secondDot <= firstDot + 1 || token.indexOf('.', secondDot + 1) != -1) {
return Optional.empty();
}
String headerPart = token.substring(0, firstDot);
String payloadPart = token.substring(firstDot + 1, secondDot);
String signaturePart = token.substring(secondDot + 1);
String expectedSignature = sign(headerPart + "." + payloadPart);
if (!MessageDigest.isEqual(base64UrlDecode(expectedSignature), base64UrlDecode(signaturePart))) {
return Optional.empty();
}
Map<String, Object> header = readMap(headerPart);
if (!"HS256".equals(header.get("alg")) || !"JWT".equals(header.get("typ"))) {
return Optional.empty();
}
Map<String, Object> payload = readMap(payloadPart);
Object expValue = payload.get("exp");
Object subValue = payload.get("sub");
if (!(expValue instanceof Number) || !(subValue instanceof String)) {
return Optional.empty();
}
long exp = ((Number) expValue).longValue();
if (Instant.now().getEpochSecond() >= exp) {
return Optional.empty();
}
return Optional.of((String) subValue);
} catch (Exception ex) {
return Optional.empty();
}
}
private byte[] json(Map<String, Object> data) {
try {
return objectMapper.writeValueAsBytes(data);
} catch (IOException ex) {
throw new IllegalStateException("Could not serialize JWT data", ex);
}
}
@SuppressWarnings("unchecked")
private Map<String, Object> readMap(String base64UrlPart) throws IOException {
return objectMapper.readValue(base64UrlDecode(base64UrlPart), Map.class);
}
private String sign(String signingInput) {
try {
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(keySpec);
byte[] signed = mac.doFinal(signingInput.getBytes(StandardCharsets.UTF_8));
return base64Url(signed);
} catch (Exception ex) {
throw new IllegalStateException("Could not sign JWT", ex);
}
}
private String base64Url(byte[] bytes) {
return java.util.Base64.getUrlEncoder().withoutPadding().encodeToString(bytes);
}
private byte[] base64UrlDecode(String value) {
return java.util.Base64.getUrlDecoder().decode(value);
}
}Follow-up & Tricky Questions:
- What is the difference between access token and ID token? An access token is for calling APIs; an ID token is for the client app to learn who the user is. In Spring Boot, an API should usually trust the access token, not the ID token.
- Can OAuth2 use JWT? Yes. OAuth2 defines the authorization flow, and the access token can be a JWT or an opaque token. Many Spring Boot resource servers validate JWTs.
- How does Spring Boot validate a JWT? It can verify the signature, expiry, issuer, audience, and scopes locally, often using a JWK Set URI for public-key tokens. That avoids a network call on every request.
- When would you choose opaque tokens instead of JWT? Choose opaque tokens when you need instant revocation or centralized control more than local validation speed. The trade-off is an introspection call at runtime.
- Why use OAuth2 with PKCE? PKCE protects public clients like SPAs and mobile apps from authorization-code interception. It is the modern safe default for browser/mobile logins.
- Is JWT encrypted? No, not by default. A normal JWT is signed, not encrypted, so anyone who gets it can base64-decode the payload and read the claims.
- Does OAuth2 mean authentication? Not by itself. OAuth2 is about authorization; if you need login and identity, you usually add OpenID Connect on top.
- Can I store user passwords in JWT claims? No. JWT payloads are readable and should never contain secrets.
Tricky / gotcha questions:
- Is JWT always better than server sessions? No. JWT is great for stateless APIs, but sessions can be simpler when you need easy revocation and small cookies.
- If a JWT is signed, does that mean it is trusted forever? No. You still must check expiry, issuer, audience, and sometimes key id. A valid signature only means the token was created by a trusted signer.
- Can an OAuth2 access token be a JWT and still be revoked? Yes, but revocation is harder. Common approaches are short lifetimes, refresh token rotation, or a blacklist for specific token ids.
Common Mistakes:
- Mistake: saying OAuth2 and JWT are the same thing. Correction: OAuth2 is the flow/framework; JWT is a token format.
- Mistake: assuming a signed JWT is automatically safe. Correction: always validate
exp,iss,aud, and the signature. - Mistake: putting secrets or passwords inside the JWT. Correction: JWTs are usually readable, so store only non-sensitive claims.
- Mistake: ignoring revocation and key rotation. Correction: plan for short-lived access tokens and rotated keys.
Memory Hook: OAuth2 is the rulebook; JWT is the ticket. The rulebook decides how permission is granted, and the ticket carries proof in a compact form.
Cheat Sheet:
- OAuth2 = authorization framework.
- JWT = compact signed token format.
- OAuth2 can issue JWT or opaque tokens.
- Spring Boot often uses OAuth2 client/resource-server with JWT validation.
- JWT validation is local and fast; introspection is slower but easier to revoke.
- For login/identity, think OAuth2 + OpenID Connect, not OAuth2 alone.
Practice Tasks:
- First, call the
/auth/loginendpoint in the sample and use the returned token on/api/me. - Next, wait for the token to expire or change one character in it, then confirm that the API returns 401.
- Finally, add a second claim such as
roleorscopeand reject requests that do not have it.