Monerh A

[Miuroro]

🤖 What I did:

• Built a stateless authentication system using Spring Security and JWT.
• Created protected /logout and /profile endpoints that require a valid JWT token.
• Used the stateless JWT approach for logging out (client-side token removal, no server-side session logic).
• Secured user passwords in the database using BCrypt hashing.

---

👾 How to test it:

1. Run the application and open Postman.
2. Use POST /users/register to save a new user.
3. Use POST /auth/login with those credentials to receive a JWT token.
4. Paste that token into the Bearer Token field in the Authorization tab to access the protected GET /users/profile and POST /auth/logout endpoints.

[dilero]

it would be nice throw exception and/or log it. Currently it is silently failing.

[dilero]

authenticationManager.authenticate() throws AuthenticationException if credentials are invalid. Make sure you're handling that somewhere (either here with a try-catch or globally with a @ControllerAdvice) so the user gets a clean 401 response instead of a 500.

[dilero]

Right now if someone registers with an existing username, you'll likely get an unhandled database exception. Add a check:

if (userRepository.findByUsername(request.username()).isPresent()) {
    throw new ResponseStatusException(HttpStatus.CONFLICT, "Username already taken");
}