Securing APIs is a super crucial part of web development these days. With the rise of web applications, protecting your resources has never been more important. If you’re building with Micronaut, you’re in luck because it offers solid ways to secure your APIs using OAuth2 and JWT. Here’s how you can do it effortlessly.

Understanding OAuth2 and JWT

Before we dive into the cool implementation stuff, let’s just quickly refresh what OAuth2 and JWT are.

OAuth2, simply put, is an authorization framework. It allows apps to get limited access to user accounts on another service provider’s site without the need to share login credentials—which, trust me, is a lifesaver. The main players in this framework are the resource server (your API), the authorization server (issues those golden access tokens), the client (your app), and the resource owner (the user).

JWT or JSON Web Token is basically a compact way to represent claims that can be easily transferred between two parties. The token is signed digitally, and it includes a payload that can be verified and trusted. Think of it as a digital passport.

Setting Up Micronaut Security

Okay, let’s get into the nitty-gritty of setting up security in your Micronaut app. Buckle up.

First off, you’ve got to enable security. This is where we start our journey:

micronaut:
  security:
    enabled: true
    token:
      jwt:
        enabled: true

Boom. Security enabled. Next, let’s move to configuring JWT settings for token signing and validation:

micronaut:
  security:
    token:
      jwt:
        signatures:
          secret:
            generator:
              secret: "pleaseChangeThisSecretForANewOne"
              jws-algorithm: "HS256"

Here, a secret key is set to sign JWTs using the HS256 algorithm. Security is like baking a cake: get the ingredients wrong, and it’s a disaster.

Integrating with OAuth2

To make OAuth2 work with Micronaut, we need to configure an OAuth2 client. Let’s walk through a sample configuration, using Keycloak:

micronaut:
  security:
    oauth2:
      clients:
        keycloak:
          client-id: "micronaut"
          client-secret: "7dd4d516-e06d-4d81-b5e7-3a15debacebf"
          authorization:
            url: "http://localhost:8888/auth/realms/master/protocol/openid-connect/auth"
          token:
            url: "http://localhost:8888/auth/realms/master/protocol/openid-connect/token"
            auth-method: "client-secret-post"

Next, we need to make Micronaut aware of Keycloak’s token validation endpoint to ensure proper security:

micronaut:
  security:
    token:
      jwt:
        signatures:
          jwks:
            keycloak:
              url: "http://localhost:8888/auth/realms/master/protocol/openid-connect/certs"

This configuration helps Micronaut validate JWT signatures via Keycloak’s JWKS endpoint. Very handy, right?

Securing Endpoints

Once the security configuration is set, let’s see how to secure your endpoints. It’s super simple with annotations. Check out this example:

import io.micronaut.http.annotation.Controller;
import io.micronaut.http.annotation.Get;
import io.micronaut.http.annotation.Produces;
import io.micronaut.security.annotation.Secured;
import io.micronaut.security.rules.SecurityRule;

@Controller("/secure")
public class SecureController {

    @Get
    @Secured(SecurityRule.IS_AUTHENTICATED)
    @Produces("text/plain")
    public String index() {
        return "This is a secure endpoint";
    }
}

Here, the @Secured annotation ensures only authenticated users can hit this endpoint. Easy-peasy.

Authentication Flow

Here’s the lowdown on how the whole authentication flow works with Micronaut and OAuth2:

1. Login Request: The client sends a login request to your Micronaut app with username and password.
2. Redirect to Authorization Server: Micronaut then redirects the client to the OAuth2 authorization server (like Keycloak) for authentication.
3. Authorization Code: Post-authentication, the authorization server sends back an authorization code to the Micronaut app.
4. Token Request: Micronaut exchanges this code for an access token by calling the authorization server’s token endpoint.
5. Set JWT Token: Finally, Micronaut sets the JWT access token in a cookie or header, ready for future requests.

Testing the Security Configuration

Always a good idea to test out security configurations. Lucky for us, Micronaut has a HTTP client, making this a breeze. Here’s a taste:

import io.micronaut.http.HttpRequest;
import io.micronaut.http.HttpResponse;
import io.micronaut.http.client.HttpClient;
import io.micronaut.http.client.annotation.Client;
import io.micronaut.security.authentication.UsernamePasswordCredentials;

@Client("/")
public interface AppClient {

    @Post("/login")
    BearerAccessRefreshToken login(@Body UsernamePasswordCredentials credentials);

    @Get
    @Consumes("text/plain")
    String home(@Header("Authorization") String authorization);
}

@Test
public void testSecureEndpoint() {
    HttpClient client = HttpClient.create(URI.create("http://localhost:8080"));
    AppClient appClient = client.toProxy(AppClient.class);

    UsernamePasswordCredentials credentials = new UsernamePasswordCredentials("test_viewer", "123456");
    BearerAccessRefreshToken token = appClient.login(credentials).blockingGet();

    String response = appClient.home("Bearer " + token.getAccessToken()).blockingGet();
    assertEquals("This is a secure endpoint", response);
}

This sample test logs in using test_viewer credentials and accesses the secured endpoint using the obtained JWT. Sweet, huh?

Advanced Security Features

Micronaut’s security game doesn’t stop here. There are some advanced features for the extra mile:

• Custom Login Handlers: Tailor your login responses and redirects.
• Token Propagation: Tokens can be seamlessly passed across microservices.
• Redirect After Login: Send users back to the original URL post-login.
• Custom Error Messages: Customize error messages for authentication fails.

Conclusion

Wrapping things up, securing APIs with Micronaut using OAuth2 and JWT isn’t just possible—it’s simplified. By following the steps mentioned, your APIs can be super secure and accessible only to authenticated users. Always make sure to test the security configurations to ensure they work like a charm.

Micronaut offers a sturdy and flexible security framework that ticks all the boxes for modern web app security. It’s an excellent choice when you want to keep your APIs under lock and key, while also being straightforward to implement. So why not give it a try? Your app deserves it!

That’s a wrap! Here’s to a secure and robust web application. Cheers!