Spring boot Restful API: Simple authentication

Question

I'm writing Restful API endpoints using Spring boot. I want to create login/logout functionality. I don't want to use Spring boot default login page.

From my understanding, a simple and secure way to do so, is:

1. Client provides server with username and password
2. Server sends back an authentication code, which user can use for subsequent calls to the API endpoints
3. The authentication code is valid until users logs out/a certain amount of time passes

Is there any conventional name for this method of authentication ?

I don't want to use Spring boot login page. Does Spring boot have any other default implementation for this authentication method ? If yes, where does it store the authentication code. Does it store in the memory ?

Answer 1

Stateless, token-based authentication is what you're looking for. Json Web Tokens (JWT) is one implementation of that.

I wrote a tutorial about setting up JWT in SpringBoot for use with Angular. It's too long to include here - it's a two-parter, and the second part, dealing with JWT is at http://chariotsolutions.com/blog/post/angular-2-spring-boot-jwt-cors_part2

If you want the first part, it's at http://chariotsolutions.com/blog/post/angular-2-spring-boot-jwt-cors_part1