What is Spring Security OAuth2 and JWT implementation?
Why Interviewers Ask This
This is a differentiating question used for senior and lead roles. Interviewers want to see if you can explain not just what happens, but why — and what the trade-offs are in different approaches.
Answer
Spring Security 6 OAuth2 Resource Server with JWT: Dependencies: spring-boot-starter-security + spring-boot-starter-oauth2-resource-server. Resource server configuration: @Bean public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { http.oauth2ResourceServer(oauth2 -> oauth2.jwt(jwt -> jwt.jwtAuthenticationConverter(jwtAuthConverter()))); http.authorizeHttpRequests(auth -> auth.requestMatchers("/api/public/**").permitAll().requestMatchers("/api/admin/**").hasAuthority("SCOPE_admin").anyRequest().authenticated()); return http.build(); }. JWT configuration: spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://auth-server/.well-known/jwks.json — validates JWT signatures using the auth server's public keys. Or for symmetric signing: spring.security.oauth2.resourceserver.jwt.secret=mySecretKey. Custom JWT converter (extract roles/claims): @Bean public JwtAuthenticationConverter jwtAuthConverter() { JwtGrantedAuthoritiesConverter converter = new JwtGrantedAuthoritiesConverter(); converter.setAuthoritiesClaimName("roles"); converter.setAuthorityPrefix("ROLE_"); JwtAuthenticationConverter jwtConverter = new JwtAuthenticationConverter(); jwtConverter.setJwtGrantedAuthoritiesConverter(converter); return jwtConverter; }. Authorization Server (Spring Authorization Server): Spring's own OAuth2 authorization server implementation: @Import(OAuth2AuthorizationServerConfiguration.class) — provides /oauth2/token, /oauth2/authorize, /oauth2/jwks endpoints. Register clients, configure token settings, customize claims. Method security: @EnableMethodSecurity @GetMapping @PreAuthorize("hasRole("ADMIN") or #userId == authentication.principal.subject") public User getUser(@PathVariable String userId) { ... }.
Pro Tip
If you're unsure about a detail, say so honestly and explain your reasoning. Interviewers respect candidates who can think through uncertainty rather than bluffing.
Previous
What is Spring Boot auto-configuration internals?
Next
What is Spring Boot performance optimization?