What methods can be used to implement authentication using JWT?

Authentication using JWT (JSON Web Token) is typically implemented using the following methods:

1. Passing JWT in the HTTP Authorization header — the most common method. The client receives a JWT after successful login and sends it in the header for subsequent requests:

Authorization: Bearer <token>

2. Storing JWT in cookies — the token is stored in an HTTP-only cookie, which helps protect against XSS attacks. The server retrieves the token from the cookie on each request.

3. Passing JWT in URL parameters or request body — a less secure method, as URLs can be logged and be visible.

In Java, JWT authentication is often implemented using filters (for example, OncePerRequestFilter in Spring Security), which check for the presence and validity of the token in the request, and then set the security context.

Example of JWT validation in a Spring Security filter:

public class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain)
            throws ServletException, IOException {
        String header = request.getHeader("Authorization");
        if (header != null && header.startsWith("Bearer ")) {
            String token = header.substring(7);
            // Token validation and parsing
            if (validateToken(token)) {
                Authentication auth = getAuthentication(token);
                SecurityContextHolder.getContext().setAuthentication(auth);
            }
        }
        filterChain.doFilter(request, response);
    }
}