# 1033 Structure 3760740c

> Spring Security JWT Skill Structure

- Skill: `tools-only/1033-structure-3760740c` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add tools-only/1033-structure-3760740c`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/1033-structure-3760740c/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/tools-only/1033-structure-3760740c

---

# Spring Security JWT Skill Structure

```
spring-boot-security-jwt/
├── SKILL.md                           # Main skill documentation
├── README.md                          # User-friendly overview and quick start
├── STRUCTURE.md                       # This file - skill structure documentation
│
├── references/                        # Comprehensive reference documentation
│   ├── jwt-configuration.md          # Complete JWT setup and configuration
│   ├── examples.md                   # Real-world implementation examples
│   ├── authorization-patterns.md     # RBAC, ABAC, and permission models
│   ├── token-management.md           # Refresh tokens, rotation, and revocation
│   ├── microservices-security.md     # Inter-service authentication
│   ├── oauth2-integration.md         # OAuth2 provider integration
│   ├── testing-jwt-security.md       # Unit and integration testing
│   ├── performance-optimization.md   # Caching and performance tuning
│   ├── security-hardening.md         # Security best practices
│   └── troubleshooting.md            # Common issues and solutions
│
├── scripts/                          # Utility scripts
│   └── test-jwt-setup.sh            # Automated testing script
│
└── assets/                           # Supporting assets and tools
    └── generate-jwt-keys.sh         # Key generation utility
```

## Skill Coverage

### Core Features (SKILL.md)
- JWT generation and validation with multiple algorithms (RSA, HMAC, ECDSA)
- Bearer token and cookie-based authentication patterns
- Database-backed and OAuth2 provider integration
- Both RBAC and permission-based access control
- Advanced patterns: refresh tokens, token rotation, multi-tenancy

### Configuration (jwt-configuration.md)
- Comprehensive dependency management
- Key configuration for RSA, HMAC, and ECDSA
- Custom claims and validation
- Application properties and YAML configurations
- Key rotation support

### Implementation Examples (examples.md)
- Complete application setup
- Domain models (User, Role, Permission entities)
- Authentication and registration controllers
- Service layer implementations
- Advanced security configuration

### Authorization Patterns (authorization-patterns.md)
- Hierarchical role structures
- Custom permission evaluators
- Attribute-Based Access Control (ABAC)
- Time-based access control
- Location-based restrictions
- Organizational access control

### Token Management (token-management.md)
- Secure refresh token storage
- Token rotation strategies
- Token blacklisting
- Session management
- Distributed security events

### Microservices Security (microservices-security.md)
- Inter-service authentication
- API gateway patterns
- Distributed token validation
- Service mesh integration (Istio)
- Circuit breaker patterns

### OAuth2 Integration (oauth2-integration.md)
- Multi-provider support
- Custom OAuth2 user service
- Token exchange patterns
- Delegated authorization
- Client registration API

### Testing (testing-jwt-security.md)
- Unit testing JWT services
- Integration tests with Testcontainers
- Security testing with OWASP ZAP
- Performance testing
- Custom security test utilities

### Performance Optimization (performance-optimization.md)
- Caching strategies for token validation
- Database optimization
- Async processing
- Monitoring and metrics
- Resource optimization

### Security Hardening (security-hardening.md)
- Secure configuration practices
- Attack prevention (brute force, XSS, SQL injection)
- Key management best practices
- Security monitoring
- GDPR compliance features

### Troubleshooting (troubleshooting.md)
- Common JWT token problems
- Authentication flow debugging
- Configuration validation
- Quick fix scripts
- Debugging checklist

## Integration Points

This skill integrates with:

1. **Spring Boot Actuator** - For security monitoring and health checks
2. **Spring Data JPA** - For user and token persistence
3. **Spring Cache** - For token validation caching
4. **JUnit Testing** - For comprehensive security testing
5. **LangChain4j** - For AI-powered security analysis (if needed)

## Quick Start Flow

1. Review README.md for overview
2. Generate keys using `./assets/generate-jwt-keys.sh`
3. Implement basic JWT using SKILL.md quick start
4. Reference jwt-configuration.md for detailed setup
5. Use examples.md for implementation patterns
6. Apply security-hardening.md for production
7. Run tests with `./scripts/test-jwt-setup.sh`
8. Monitor with troubleshooting.md as needed

## Key Benefits

1. **Comprehensive Coverage**: From basic JWT to advanced microservices patterns
2. **Production Ready**: Includes security hardening and performance optimization
3. **Well Documented**: Each aspect has detailed reference documentation
4. **Practical Examples**: Real-world code implementations
5. **Testing Included**: Automated test suite and testing strategies
6. **Troubleshooting Guide**: Common issues and solutions

## Maintenance

This skill should be updated when:
- New Spring Security features are released
- New security vulnerabilities are discovered
- Performance optimizations are identified
- Community feedback suggests improvements
- Integration patterns evolve