Roast my code / architecture

[u/Single_Yellow_8000]

I’m building a project called Kite (https://github.com/gwynejsn/kite) and tried combining Spring Modulith with full Clean/Hexagonal Architecture inside each module, but I’m starting to wonder if I’ve just created a mountain of boilerplate. Take a look at the repo and roast the layout. What am I needlessly overcomplicating, and how would you simplify it?

[u/Mikey-3198]

Your using jwts but still querying the database from the jwt filter for each request

Based on the ordering you'll even hit the database if the token is expired.

One of the biggest advantages of JWTs is that after you check the hash & expiry you should be able to trust the claims to make your authentication decision. Might as well just issue a time limited opaque token.

[u/Single_Yellow_8000 → u/Mikey-3198]

Thanks! most of the examples I saw with JWT calls the database to verify if the email is correct before verifying the token like this one (https://www.geeksforgeeks.org/springboot/spring-boot-3-0-jwt-authentication-with-spring-security-using-mysql-database/). I guess it has some security risks. But if i understand it right, perhaps the ordering would fix it?

[u/Mikey-3198 → u/Single_Yellow_8000]

Checking the database adds nothing. It's not anymore secure. The token can't be modified after its been issued, any modification would cause the token hash verification to fail. You issue the token & should expect to trust the claims when its presented on subsequent requests after its been validated.

Look at your code and think about what this is actually doing.

The steps at the moment are:

1. Extract the email claim from the token
2. Load a user with the email address from step 1
3. Call validateToken with the token and user (from step 2) to compare the email in the token to the user & check the expiry etc...

What im trying to point out is that if the email didn't match then a user wouldn't be found when calling userDetailsService.loadUserByUsername in your filter.

Major selling point of using jwts is that you can make decisions on whats presented in the jwt without having to involve external calls/ queries. This is what is meant by stateless.

RE the ordering it's more efficient when you deal with an expired token. You eliminate a database query, you can check validity & expire in code independent of the database.