How to send JWT from spring boot to Flutter?

user_16705861 0
Viewed 294

I would like to know what's the best and secured way to send the JWT generated in my spring boot app to my Flutter mobile app. I can send it in the response body which I know that's not a good practice in web but is it a problem when it comes to mobile?

This is how I return the JWT:

public ResponseEntity<?> signin(String username, String password) {
    try {
      authenticationManager.authenticate(new UsernamePasswordAuthenticationToken(username, password));
      String token= jwtTokenProvider.createToken(username, userRepository.findByUsername(username).getRoles());
      //return new JwtResponse(token,username,userRepository.findByUsername(username).getRoles());
      return ResponseEntity.ok(new AuthToken(token));
    } catch (AuthenticationException e) {
      throw new CustomException("Invalid username/password supplied", HttpStatus.UNPROCESSABLE_ENTITY);
    }
  }
jwt spring-boot flutter
1 Answers

IT doesn't matter how you send your JWT token, in the Header or in the body portion. it can easily be seen and copied by others through some app on the client-side.

The steps you can take to secure your data is

  • firstly You need to check if the Token is tampered with by the client, every time you receive a JWT token from the client
  • Secondly, you should add a created-at field where you send a timestamp of when the Token was created. This will prevent someone to pose as the owner of the token forever after this is stolen, as this Token will be invalid after some time.

and you can send your token simply in the body part of the response after taking those security measures. Of course, there are many more best practices to follow but these are a good starting point.

user_85750300
Related