Woow its a great tutorial to implement security . working great . By seeing this video i was able to implement security from scratch in 5 days now i am able to have error less working code . Great video. thanks a lot.
Had a brief look at you video and it was good. I would like to suggest you do more complex stuff with spring security 6 and spring boot 3 so that people can learn from you while being involved in complex projects.This video helped me get a better understanding of the basics. Thanks a lot. Please continue on teaching. PLEASE USE NEXT JS INSTEAD OF ANGULAR IF YOU CAN .
Thank you so much for your positive feedback and valuable suggestion! I'm thrilled to hear that the video helped you understand the basics. Your suggestion to delve into more complex projects with Spring Security 6 and Spring Boot 3 is noted, and I'll certainly consider creating content on more advanced topics. Regarding your preference for Next.js over Angular, that's an interesting suggestion. While my current content includes Angular, I'll certainly explore the possibility of incorporating Next.js in future projects. Both frameworks have their strengths, and it's great to have variety in the topics covered. I truly appreciate your support and encouragement. If you have specific topics or features you'd like to see covered, feel free to share them. I'm here to help you learn and explore. Thanks again, and happy coding!
@@code_with_projectsAngular ftw. Could you do a full stack project? With Role Authorizations? Maybe like a hotel website where the admin can create the hotel listings, and the user can only book them, sort them, save them to their favorites etc. (just something that come to mind with role based authorization) anything is fine really. It would really help seeing a project come to life like this please
Our current projects are structured around specific roles(admin and customer). Feel free to explore our E-commerce application and Car Rental project. If you're still interested in the Hotel Listing project, let me know!
@@code_with_projects thank you I’ll take a look at those! And yes, I’m definitely still interested in the hotel project, but only if you have the time🙌🏽. I’m sure everyone can benefit from seeing another fully implemented project form A-Z
Thanks for the tutorial. It is really helpful. Some of the codes are marked as deprecated but I manage to fix it from the documentation. It would be good for others if you can add it in the description or comment
@@code_with_projects Thanks, I am teaching new developers from Malaysia and currently building modules for them. Notes that your content will be very helpful and help others as well
Constructive criticism: Other tutorial videos i have to watch it at 1.5x speed whereas this one i watched at 0.75x 😂 PLEASE TRY TO TEACH AT A SLOWER PACE AND IN DEPTH
Thank you for your feedback! I appreciate your honesty, and I'm glad to hear that you found the pace of this tutorial more comfortable. I'll definitely take your suggestion into consideration for future content and aim to provide a slower pace with more in-depth explanations.
one more thing bro, i agree you explained, but if you explain even more like you used several interfaces in the code, if you explain thats purpose and usage, will be more helpful for the viewers, because the main motive for you to put this video is makes people understand the concept right, so please do it from next video, thanks
And one thing the video makers should keep in mind, as if they see the video in the eyes of fresher's, as a fresher who doesn't know things, we are approaching the you tube videos, but here videos are like revising for the people who already mastered the concepts, then what's the point of making the video..
Thanks a lot for your feedback! I appreciate your suggestion. I'll make sure to provide more detailed explanations in my next video, covering the various interfaces used in the code and their purposes. Your input is valuable, and I want to ensure that my content is as helpful as possible.
i have a doubt because i referred 4 to 5 tutorials everyone using different approach i confused which one is more secure and whta do i prefer can u guide me.
Of course! It's completely understandable to feel uncertain when different tutorials offer varying approaches. When it comes to security, prioritizing reliability is key. Here's some guidance: Unique Key for Token Generation: Using a unique key for token generation adds an extra layer of security by ensuring that tokens are not easily guessable or susceptible to attacks like token replay. Protecting API Based on User Role: Implementing role-based access control (RBAC) helps in enforcing security by only allowing authorized users to access specific resources or perform certain actions within your API. Sending and Receiving JWT in Headers: Storing JWTs in headers instead of the request body helps prevent accidental exposure of tokens through logging mechanisms or other vulnerabilities. Setting JWT Token Expiration: Limiting the lifespan of JWT tokens reduces the window of opportunity for malicious actors to exploit stolen tokens, thus enhancing overall security. Using Refresh Tokens: Employing refresh tokens alongside access tokens allows for more secure token management. Refresh tokens can be used to obtain new access tokens without requiring the user to re-enter their credentials. Handling Expired Refresh Tokens: If a refresh token expires, it's important to handle this scenario gracefully by logging out the user and prompting them to log in again. This helps mitigate potential security risks associated with expired tokens. By following these best practices, you can enhance the security of your application and minimize the risk of unauthorized access or data breaches.
Thank you! Integrating with custom HTML and CSS involves calling these APIs using JavaScript. If you prefer using frameworks like React or Angular, you can watch any project playlist on our channel where we've integrated Spring Security with Angular in various examples.
The refresh token allows for longer user sessions, reducing the need for frequent logins. It has a longer time to live (TTL) to maintain user authentication.
Thanks for your feedback! Storing the hashRefreshToken in the database is indeed a good practice for better security and management. It adds an extra layer of protection against token theft. 👍
time WARN 11496 --- [nio-8090-exec-2] o.s.w.s.h.HandlerMappingIntrospector :Cache miss for REQUEST dispatch to '/home/signin' (previous null). Performing CorsConfiguration lookup. This is logged once only at WARN level, and every time at TRACE. time WARN 11496 --- [nio-8090-exec-2] o.s.w.s.h.HandlerMappingIntrospector : Cache miss for REQUEST dispatch to '/home/signin' (previous null). Performing MatchableHandlerMapping lookup. This is logged once only at WARN level, and every time at TRACE. Well these two are shown after trying to enter .../admin/home (which is for admin only)@@code_with_projects
Thanks for the feedback! While this tutorial covers the basics, I'll definitely consider exploring more advanced security concepts for production-ready APIs in future videos. Appreciate your support!
Thank you so much for your kind words! Your support means a lot to us, and we're committed to delivering continued excellence. Thanks again for your encouragement!
Your request for a video on OAuth 2.0 implementation has been noted. We appreciate your interest in this topic, and we're committed to providing valuable content for our audience. Stay tuned, as we will definitely work on creating a comprehensive video on OAuth 2.0 implementation in the near future.
Great question! Storing refresh tokens in a database can enhance security and allow for better management of token expiration and revocation. I opted for a different approach for simplicity and demonstration purposes in the video. However, using a RefreshTokenRepository is definitely a good practice for production applications. Thanks for pointing that out!
Thank you for your positive feedback, and I'm glad to hear that the tutorial was helpful to you! I appreciate your diligence in making the necessary tweaks to get everything working. Regarding the issue with the admin endpoint, I'm sorry to hear that you're experiencing difficulties. To better assist you, could you provide more details about the specific problem you're facing with the admin endpoint? Any error messages or additional information would be helpful in troubleshooting and resolving the issue. I'm here to help, so feel free to share more details, and I'll do my best to assist you further!
@@code_with_projects Many thanks for replying. I finished the code and trying to access the admin endpoint results in a 403 error using Postman with no additional messages to show. I have spent hours looking at the code and can't figure it out. The endpoint should be accessible since authentication was successful but it isn't.
I appreciate your effort in completing the code, and I'm sorry to hear that you're encountering a 403 error when trying to access the admin endpoint. Here are a few steps you can take to troubleshoot this issue: Roles and Authorities: Double-check that the authenticated user has the necessary roles or authorities required to access the admin endpoint. Verify that the role configuration in your code aligns with the roles assigned to the user during authentication. Path Configuration: Ensure that the path to the admin endpoint in your Postman request matches the path configured in your Spring Security rules. Minor discrepancies in path configuration can lead to 403 errors. Token Inclusion: Confirm that your Postman request includes the correct authentication token, especially if you're using JWT. The token should be included in the "Authorization" header with the format "Bearer [your_token]". Debugging: Consider adding logging statements or using a debugger to inspect the authentication details and roles at runtime. This can provide insights into whether the user has the expected roles. If the issue persists, please share relevant portions of your security configuration and the Postman request, so I can provide more targeted assistance. Your diligence in troubleshooting is commendable, and I'm here to help you resolve this challenge.
Thank you for your feedback! I'll consider creating a video on OAuth2 implementation with user role many-to-many relationships for REST API. Stay tuned for upcoming content. Your suggestions are valuable!
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351" 2) You can generate this key from any online password generator website. 3) You can generate by below code. public static void main(String[] args) { SecureRandom random = new SecureRandom(); byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256 random.nextBytes(keyBytes); String secretKey = Base64.getEncoder().encodeToString(keyBytes); System.out.println("Generated SECRET_KEY : " + secretKey); }
Great stuff but there is one thing I am confused about. During the 'signin' I can see the Authorization tab active in your postman when you are sending the request body. Should signin require additional authentication? With no authorization set in postman this endpoint would return 403.
Great observation! In the 'signin' process, the Authorization tab is active in Postman because we're including the user credentials (username and password) in the request body for authentication. This is a common approach when sending credentials for user authentication. Regarding the 403 Forbidden issue, it's important to note that the 'signin' endpoint typically doesn't require additional authentication beyond the credentials provided in the request body. If you're encountering a 403 error, it could be due to various reasons such as incorrect credentials, user not found, or an issue with the authentication process. Make sure the credentials are correct, and consider checking the Spring Security configuration for the 'signin' endpoint in your Spring Boot application to ensure it allows unauthenticated access. If you have specific details or code snippets you'd like me to review, feel free to share, and we can dive deeper into resolving the issue. Happy coding!
@@code_with_projects Thank you for you quick response. Luckily I managed to fix it(had some inconsistency with my signatureAlgorithms) Let me just say that I gone through so many tutorials here in youtube and all of them failed to produce the desired outcome. Yours is the first one that finally worked and for that I am eternally grateful.
Thanks buddy nice tutorial ... Buddy I think you can go little bit slowly with more explanation. Like you have to think from beginners perspective and you were like okay this okay this... Just think about this and upload content accordingly to this it would be more helpful for everyone..
Thanks a lot for your feedback, and I'm glad you found the tutorial helpful! I appreciate your suggestion about slowing down and providing more detailed explanations, especially from a beginner's perspective. Your input is valuable, and I'll certainly take it into consideration for future content.
Don't worry about memorizing JWT details. When working with secured APIs, you typically receive the JWT from the response of the login API. Focus on understanding how to handle and utilize JWTs in your application rather than memorizing their contents.
Hey, I've heard sometimes people do use sessions + jwt together and send jwt as coockie for example. Is it ok? I mean I thought jwt is for stateless design and sessions for storing state somewhere/somehow. So you pick one according to your needs but not both at the same time. And if it's a common practice, would you mind to create some tutorial of combining sessions and jwt. Thank you.
Using sessions and JWT together is common and valid. JWT handles authentication, while sessions manage server-side state. I'll consider creating a tutorial on this. Thanks for the suggestion! 🚀Keep watching our videos. Thank you
In SecurityConfiguration class, I am getting error in permitAll function as Cannot resolve method 'permitAll' in 'HttpSecurity'and Cannot resolve method 'sessionCreationPolicy(SessionCreationPolicy)' Can you please rectify.
Sure thing! In Postman, follow these steps: Open your request. Go to the 'Authorization' tab. From the type dropdown, select 'Bearer Token'. Enter your token in the designated field.
@@code_with_projects I'm getting this "Using generated security password: 30ecd606-cca2-4876-bc10-0b4f06027ffb" when application starts.Where and how to use it ? It asks me to login when I'm invoking "localhost:9092/api/v1/auth/hi" through explorer .
If both your original token and refresh token are lost, you’ll need to log in again to generate a new token. This will reauthenticate you and provide a new set of tokens.
Please ensure that the authentication token is being sent correctly in the request headers. If the issue persists, double-check the configuration and permissions in your backend code.
i have an error can you help me?, i created project with spring v3.2.0 in getSignInKey method i have an exception like ECDSA signing keys must be PrivateKey instances.
Why are you utilizing the privateKey? In this project, our approach involves constructing and returning a java.security.Key. If your intention is to utilize PrivateKey instead, please ensure compatibility and verify that you are not returning null, as it seems the key is currently null.
"Query did not return a unique result: 2 results were returned," indicates that there might be two users in the database with the same email address. To resolve this issue, please ensure that you don't have duplicate entries in the database. If the problem persists, could you share the relevant code snippet where you are executing the query that triggers this error? It would be helpful for me to take a look and provide more targeted assistance.
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351" 2) You can generate this key from any online password generator website. 3) You can generate by below code. public static void main(String[] args) { SecureRandom random = new SecureRandom(); byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256 random.nextBytes(keyBytes); String secretKey = Base64.getEncoder().encodeToString(keyBytes); System.out.println("Generated SECRET_KEY : " + secretKey); }
Glad to hear sign-in and refresh tokens are working. For the 403 Forbidden issue with the admin controller, ensure you're hitting the right URL. Please share your security config for a quick check. Also, confirm you've followed the video to authenticate the admin URL with the correct role.
@@mineeleppa2654 Solved. You take a look "doFilterInternal" in JwtAuthenticationFilter, I recognized I missed "!" in if condition -> "!org.apache.commons.lang3.StringUtils.startsWith(authHeader,"Bearer ")"
Hello, I'm receiving the 403 error, and in the terminal, the following message appears: Illegal base64 character: '.'. My secret key, I obtained it from the JWT.
@@code_with_projects I did what you said, but I'm receiving the 'Invalid compact JWT string: Compact JWSs must contain exactly 2 period characters, and compact JWEs must contain exactly 4. Found: 0' error. I'm watching again and searching forums for a possible solution.
Correct me if I'm wrong, but we are not checking if the user already exist in the DB before signup ? I'm facing an issue, I can create the same user multiple times in the DB. Because of this issue, login is not possible if there is more than 1 user with the same credentials. (Obviously) Did I miss something ?
You're absolutely right. Currently, we're not checking for existing users before signup. The prime focus of this video is Spring Security, and email checking is a small detail that you can implement very easily. To address this, consider adding a check using existsByEmail. If it returns true, display an error message. This should prevent creating duplicate users.
@@code_with_projects Yeah no problem, I've already implemented it myself. I thought I missed something in the video. Thanks for this tutorial, I'm learning a lot !
Hey, can you help me with this problem? I'm getting this error "Could not autowire. No beans of 'JWTService' type found. " with jwtService variable in JwtAuthenticationFilter class, shoudn't JWTServiceImpl implement JWTService?
Indeed, the 'JWTServiceImpl' should implement 'JWTService' interface. Please double-check the implementation and make sure it's correctly annotated as a Spring Bean with '@Service' or '@Component' so that it can be autowired in the 'JwtAuthenticationFilter' class. Also, keep watching our videos. Thanks
Make sure you implemented CommandLineRunner like below. If you are still getting the error then please share the error logs. @SpringBootApplication public class SpringsecurityApplication implements CommandLineRunner { @Autowired private UserRepository userRepository;
@@code_with_projects that works now... thanks...... but there is one more problem im facing.... im getting the Invalid credentials exception by my authentication manager in signin method or auth service even though the email and password are correct(created by run method).... pretty sure i followed every step from your video.... can you help me fix it....
Sir, i have a problem. i have followed through the video and everything works as expected. However i added the possibility for a user to have different items. So i created a basic endpoint where items can be obtained based on user_id for the endpoint /item @GetMapping("/{id}") public ResponseEntity getItemsByUserId(@PathVariable Long id) { List items = itemRepository.findByUserId(id); return ResponseEntity.ok(items); } I am authenticated when doing the GET request, but im getting the error: jakarta.servlet.ServletException: Unable to handle the Spring Security Exception because the response is already committed. This only happens when I return the response entity with a item or a user for example. Return a entity with a simple String works. What can be causing the problem?
Make sure you've correctly annotated the userdetailsService class with @Service or a similar annotation to allow Spring to manage it as a bean. If you can share a snippet of your code where the userdetailsService is declared and injected, I might be able to provide more specific guidance. Ensure that the UserService is being injected into the class where you're using it. If the issue persists, feel free to provide more details for further assistance. Happy coding! 😊🚀
can you help me with the issue after calling login api and copying token into admin and user api none of the api is getting called and i am also not getting to see any error in console.
It seems unusual that the API is not working, and there are no error logs or responses in the console. I recommend revisiting the code, conducting a thorough dry run, and debugging to identify any potential issues. Sometimes, a fresh perspective can reveal overlooked details. Let me know if you find anything during your review, and we can continue troubleshooting from there.
Hey really good Tutorial, but one question: Where did you get the byte[] key = Decoders.BASE64.decode("THIS HERE"); You did not tell where you got it and just input it . Thanks for the help
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351" 2) You can generate this key from any online password generator website. 3) You can generate by below code. public static void main(String[] args) { SecureRandom random = new SecureRandom(); byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256 random.nextBytes(keyBytes); String secretKey = Base64.getEncoder().encodeToString(keyBytes); System.out.println("Generated SECRET_KEY : " + secretKey); } Also, keep watching our upcoming videos. Thanks.
I'm still getting the 403 error.And won't we get username and password incorrect as exception (as we have mentioned in orElseThrow()...) if the credentials are wrong.Please help.
I can't really determine the actual reason with just two words, '403 Forbidden.' However, here are the steps you can follow to resolve this issue: 403 Forbidden error usually indicates that the server has understood the request, but it refuses to fulfill it, often due to permissions or authentication issues. Check URL and Path: Ensure that you are trying to access the correct URL and path. Sometimes, a small typo in the URL or path can lead to a 403 error. Login Credentials: Double-check your login credentials (username and password). Ensure that you are entering the correct information. Debugging: Enable debugging for Spring Security to get more information about why the request is being denied. If you've reviewed all these aspects and the issue persists, consider sharing more specific details about your Spring Security configuration and Postman request for further assistance. Additionally, check the Spring Security logs for any specific error messages or clues about why the 403 error is occurring.
JWT expired at 2023-11-05T16:20:20Z. Current time: 2023-11-18T16:42:34Z, a difference of 1124534305 milliseconds. Allowed clock skew: 0 milliseconds. **This error i am facing now..please help me to solve out**
The error you're encountering suggests that the JWT (JSON Web Token) you are working with has expired. JWTs contain an expiration time (exp claim) to enhance security. The current time is checked against this expiration time to ensure the token is still valid. To solve this issue, you have a few options: Regenerate Token: Regenerate a new token by logging in again. Refresh Tokens: Call the refresh token API to get a new token. Increase Validity Time: You can configure the expiration time to 1 week or 2 weeks.
thank you so mcuh for the video, I have coded but getting error: ECDSA signing keys must be PrivateKey instances. I have debugged it show error at getSigninKey and searched solution but could not get solution. Kindly assist.
Thank you for watching! It seems like you're facing an issue with ECDSA signing keys. To help you better, I'd need more details about your code. Feel free to share more information, and I'll do my best to assist you.
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351" 2) You can generate this key from any online password generator website. 3) You can generate by below code. public static void main(String[] args) { SecureRandom random = new SecureRandom(); byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256 random.nextBytes(keyBytes); String secretKey = Base64.getEncoder().encodeToString(keyBytes); System.out.println("Generated SECRET_KEY : " + secretKey); } Also, keep watching our upcoming videos. Thanks.
The refresh token plays a crucial role in enhancing the security of the authentication process. While the access token is short-lived and used for authenticating API requests, the refresh token is a longer-lived token. Its primary purpose is to obtain a new access token when the current one expires. Here's how it works: 1. The user logs in, and the server provides both an access token and a refresh token. 2. The access token is used to authenticate requests to protected resources. 3. When the access token expires, instead of forcing the user to log in again, the refresh token is sent to the server to obtain a new access token. 4. The refresh token itself is not used for authentication but is exchanged for a new access token. This mechanism helps improve security because: - Access tokens have a shorter lifespan, limiting the window of vulnerability if they are compromised. - Even if an attacker gains access to an access token, they cannot use it indefinitely because they would also need the refresh token to obtain a new access token. In summary, the refresh token enhances security by providing a way to obtain a new access token without requiring the user to log in again, while also mitigating the risks associated with long-lived access tokens.
Hi Getting this error: Parameter 2 of constructor in com.sunny.springsecurity.services.impl.AuthenticationServiceImpl required a bean of type 'org.springframework.security.authentication.AuthenticationManager' that could not be found. Action: Consider defining a bean of type 'org.springframework.security.authentication.AuthenticationManager' in your configuration. Any fix or if I can read about this more in detail
It looks like you've defined an AuthenticationManager bean in your WebSecurityConfiguration class. Make sure this class is being scanned by Spring and included in your application context. If the error persists, double-check your package structure and component scanning configuration to ensure everything is set up correctly.
@@code_with_projects I am not sure on this webSecurityConfiguration class. Since I am very new to Spring, I have strictly followed your code. if there is any refrence you can help me with, to understand this issue, pls let me know.
Make sure you are using auto wired. If you are still getting the error then please share the error logs. @Autowired private UserRepository userRepository;
@@code_with_projects yes I created private repository but it's saying userRepositoey cannot be injected as it's not static as main spring boot class is static
@@code_with_projects java.lang.IllegalStateException: Failed to execute CommandLineRunner at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:789) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.lambda$callRunners$3(SpringApplication.java:770) ~[spring-boot-3.2.0.jar:3.2.0] at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183) ~[na:na] at java.base/java.util.stream.SortedOps$SizedRefSortingSink.end(SortedOps.java:357) ~[na:na] at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:510) ~[na:na] at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499) ~[na:na] at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150) ~[na:na] at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173) ~[na:na] at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[na:na] at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596) ~[na:na] at org.springframework.boot.SpringApplication.callRunners(SpringApplication.java:765) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:330) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1342) ~[spring-boot-3.2.0.jar:3.2.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1331) ~[spring-boot-3.2.0.jar:3.2.0] at com.codewithnarasimham.springsecurity.SpringsecurityApplication.main(SpringsecurityApplication.java:24) ~[classes/:na] at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104) ~[na:na] at java.base/java.lang.reflect.Method.invoke(Method.java:577) ~[na:na] at org.springframework.boot.devtools.restart.RestartLauncher.run(RestartLauncher.java:50) ~[spring-boot-devtools-3.2.0.jar:3.2.0] Caused by: java.lang.NullPointerException: Cannot invoke "com.codewithnarasimham.repository.UserRepository.findByRole(com.codewithnarasimham.entities.Role)" because "com.codewithnarasimham.springsecurity.SpringsecurityApplication.userRepository" is null at com.codewithnarasimham.springsecurity.SpringsecurityApplication.run(SpringsecurityApplication.java:30) ~[classes/:na] at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:786) ~[spring-boot-3.2.0.jar:3.2.0] ... 17 common frames omitted
Hey @kaankahraman61! I used the AuthenticationManager to validate the user's credentials and generate the JWT token in the backend. You can check the video for a step-by-step breakdown! 👍" Let me know if you'd like any changes or additional details!
Hi there! The 'user is null' error in the security config class typically occurs when the authentication process doesn't successfully retrieve a user. Double-check your authentication logic, make sure your user details are being loaded correctly, and ensure your UserDetails service is implemented properly. If the issue persists, feel free to share relevant portions of your code, and I'll do my best to help you further. Happy coding! 😊🚀
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351" 2) You can generate this key from any online password generator website. 3) You can generate by below code. public static void main(String[] args) { SecureRandom random = new SecureRandom(); byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256 random.nextBytes(keyBytes); String secretKey = Base64.getEncoder().encodeToString(keyBytes); System.out.println("Generated SECRET_KEY : " + secretKey); }
Bhai, yeh issue kuch common reasons ke wajah se ho sakta hai. Kuch cheezein check karo: Body: Ensure karo ke POST request ke body mein saare required parameters sahi se set kiye gaye hain. Endpoint: Confirm karo ke tum sahi endpoint pe request bhej rahe ho. Server Logs: Server logs check karo, wahaan kuch additional information mil sakta hai.
Hie bro i need your help. this video helped me. i am thinking of making a two way authentication where user can authenticate with google as well as by conventional approach like you showed. in both the cases i want to create a new user and save the user data in the database as well. do you have any video regarding how to achive that. there are no video in the internet for that currently can you make one
I'm glad to hear that the video was helpful for you! Creating a two-way authentication system sounds like a great project. While I don't have a specific video on that topic at the moment, I appreciate your suggestion. I'll definitely consider it for future content.
I'm sorry to hear that you encountered a 403 error during the sign-in API process. To better assist you, could you please share the error logs related to that particular step? This information will help me pinpoint the issue and provide you with a more accurate solution.
The `private final UserRepository userRepository;` expression I think is incorrect, not sure why it is not showing an error. It must be initialized and cannot change it's value, and cannot be null, and it does not have the @Autowired annotation. Why? The DI injection used, requires @Bean The "JwtServiceImpl" Service is not implementing the Interface! Why?
It seems like you're facing some concerns with the DI injection and implementation of services. Installing the Lombok extension in your IDE can help resolve any issues related to the private final UserRepository userRepository; expression. As for the @Autowired annotation, its usage depends on your application's specific requirements; you can use it if needed. Additionally, ensure that your JwtServiceImpl service implements the required interface to avoid any errors.
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351" 2) You can generate this key from any online password generator website. 3) You can generate by below code. public static void main(String[] args) { SecureRandom random = new SecureRandom(); byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256 random.nextBytes(keyBytes); String secretKey = Base64.getEncoder().encodeToString(keyBytes); System.out.println("Generated SECRET_KEY : " + secretKey); }
I can't really determine the actual reason with just two words, '403 Forbidden.' However, here are the steps you can follow to resolve this issue: 403 Forbidden error usually indicates that the server has understood the request, but it refuses to fulfill it, often due to permissions or authentication issues. Check URL and Path: Ensure that you are trying to access the correct URL and path. Sometimes, a small typo in the URL or path can lead to a 403 error. Login Credentials: Double-check your login credentials (username and password). Ensure that you are entering the correct information. Debugging: Enable debugging for Spring Security to get more information about why the request is being denied. If you've reviewed all these aspects and the issue persists, consider sharing more specific details about your Spring Security configuration and Postman request for further assistance. Additionally, check the Spring Security logs for any specific error messages or clues about why the 403 error is occurring.
@@code_with_projects in signin function of AuthenticationServiceImpl , the authenticationManager.authenticate( new UsernamePasswordAuthenticationToken(signinRequest.getEmail(), signinRequest.getPassword())); Is having some issue , because code is not going to next line after executing this. . I am trying to login through admin and admin ... ( same that you added in main class )
Thank you for your suggestion! The logout feature is indeed on our radar, and it's currently under planning for an upcoming part of the series. Your input is valuable, and I appreciate your patience. Stay tuned for the logout implementation in the future videos. Happy coding!
No worries, JWT Service implementation can be complex. If you have specific questions or need clarification on that part, feel free to ask. We are here to help you navigate it!
You're just coding in the video and not explaining anything, you should at least give a quick overview of the things, rather than just writing it in a hurry
I appreciate your feedback and understand your concern. I'll make sure to include a quick overview of the code in future videos to provide a better understanding of the concepts and techniques involved.
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351" 2) You can generate this key from any online password generator website. 3) You can generate by below code. public static void main(String[] args) { SecureRandom random = new SecureRandom(); byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256 random.nextBytes(keyBytes); String secretKey = Base64.getEncoder().encodeToString(keyBytes); System.out.println("Generated SECRET_KEY : " + secretKey); }
hello, thank you for this tutorial, I did everything just like in your videro and i have a problem. When i generate token for user with USER ROLE and i used it for endpoint in UserController, I get a 403 code response. I checked in terminal i have an error with message: Cannot invoke "app_name.services.JWTServiceImpl.extractUserName(String)" because "this.jwtService" is null. Error is in JwtAuthenticationFilter.java file in doFilterInternal method. Could you help me? What am doing wrong?
Thank you for reaching out, and I appreciate your kind words about the tutorial. It seems like you're encountering an issue with the JWT authentication in your UserController. The error message you provided, "Cannot invoke 'app_name.services.JWTServiceImpl.extractUserName(String)' because 'this.jwtService' is null," suggests that the jwtService instance is not being properly initialized before use. Here are a few things you might want to check: Service Initialization: Ensure that the jwtService is properly initialized in your JwtAuthenticationFilter. It seems like it might not be instantiated before the doFilterInternal method is called. public JwtAuthenticationFilter(JwtService jwtService) { this.jwtService = jwtService; } Dependency Injection: Check if the JwtService is being injected correctly into your UserController. Make sure that the instance of JwtService is not null when you use it in the extractUserName method. @Autowired private JwtService jwtService;
The method you are using is correct for setting the expiration time and other details of a JWT. Please ensure that your project's POM file is correctly configured and that the dependencies' versions match the versions mentioned in the video tutorial. Additionally, to assist you more effectively, please consider sharing your POM file with us. This will enable us to review your project's configuration and dependencies to provide more specific guidance and help.
@@sabujkumartarfodar8122 Hey this will help you ? tell if any wrong happens? public static final String SECRET = "5367566B59703373367639792F423F4528482B4D6251655468576D5A71347437"; public String generateToken(UserDetails userDetails) {
![Spring Security 6 | How to Create a Login System with Spring Data JPA and JWTs [NEW 2023]](http://i.ytimg.com/vi/TeBt0Ike_Tk/mqdefault.jpg)
![Ice On My Teeth - ATEEZ エイティーズ 에이티즈 [Music Bank] | KBS WORLD TV 241115](http://i.ytimg.com/vi/c-n92OgbbwA/mqdefault.jpg)
![Spring Boot 3.0 Security | Authentication and Authorization | [New Changes] | javaTechie](/img/1.gif)
very nice project, up to date and working 100%. thank you for putting the time bro
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
hello Alex i am struck can u help me setting up the code i need it badly
i have problem with methode signIn not function can u help me
bro can you send me your email to contact you
I've been looking for this exact tutorial (role based authentication) for weeks, much appreciated👍
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
me too
Woow its a great tutorial to implement security . working great . By seeing this video i was able to implement security from scratch in 5 days now i am able to have error less working code . Great video. thanks a lot.
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
Had a brief look at you video and it was good. I would like to suggest you do more complex stuff with spring security 6 and spring boot 3 so that people can learn from you while being involved in complex projects.This video helped me get a better understanding of the basics. Thanks a lot. Please continue on teaching. PLEASE USE NEXT JS INSTEAD OF ANGULAR IF YOU CAN .
Thank you so much for your positive feedback and valuable suggestion! I'm thrilled to hear that the video helped you understand the basics. Your suggestion to delve into more complex projects with Spring Security 6 and Spring Boot 3 is noted, and I'll certainly consider creating content on more advanced topics.
Regarding your preference for Next.js over Angular, that's an interesting suggestion. While my current content includes Angular, I'll certainly explore the possibility of incorporating Next.js in future projects. Both frameworks have their strengths, and it's great to have variety in the topics covered.
I truly appreciate your support and encouragement. If you have specific topics or features you'd like to see covered, feel free to share them. I'm here to help you learn and explore. Thanks again, and happy coding!
@@code_with_projectsAngular ftw. Could you do a full stack project? With Role Authorizations? Maybe like a hotel website where the admin can create the hotel listings, and the user can only book them, sort them, save them to their favorites etc. (just something that come to mind with role based authorization) anything is fine really. It would really help seeing a project come to life like this please
Our current projects are structured around specific roles(admin and customer). Feel free to explore our E-commerce application and Car Rental project. If you're still interested in the Hotel Listing project, let me know!
@@code_with_projects thank you I’ll take a look at those! And yes, I’m definitely still interested in the hotel project, but only if you have the time🙌🏽. I’m sure everyone can benefit from seeing another fully implemented project form A-Z
Guys if you follow each steps carefully, you will not get an error.
i completed this tutorial successfully.
Fantastic to hear that you completed the tutorial successfully! Attention to detail definitely pays off. Keep up the great work!
I take it back.
43:10 It should be
user.setLastname(signUpRequest.getLastname());
I am truly grateful for your assistance. This has been very helpful.
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
Thank you, people like you make self taught programming achievable 🙂
You're very welcome! Keep up the fantastic work, and happy coding! 😊🚀
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
Thank you man , what a clear cut explanation , it's on point explanation ,Keep going ..we are there to support you always🔥🔥❤️
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
Thanks for the tutorial. It is really helpful. Some of the codes are marked as deprecated but I manage to fix it from the documentation. It would be good for others if you can add it in the description or comment
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
@@code_with_projects Thanks, I am teaching new developers from Malaysia and currently building modules for them. Notes that your content will be very helpful and help others as well
thank you so much.... it was great to learn and understand easily...🔥🔥🔥🔥🔥
Thank you! Glad you found it helpful! 🔥😊 Keep learning and keep growing!
Constructive criticism: Other tutorial videos i have to watch it at 1.5x speed whereas this one i watched at 0.75x 😂 PLEASE TRY TO TEACH AT A SLOWER PACE AND IN DEPTH
Thank you for your feedback! I appreciate your honesty, and I'm glad to hear that you found the pace of this tutorial more comfortable. I'll definitely take your suggestion into consideration for future content and aim to provide a slower pace with more in-depth explanations.
one more thing bro, i agree you explained, but if you explain even more like you used several interfaces in the code, if you explain thats purpose and usage, will be more helpful for the viewers, because the main motive for you to put this video is makes people understand the concept right, so please do it from next video, thanks
Tha's a problem with a lot of youtube videosabout this topic
And one thing the video makers should keep in mind, as if they see the video in the eyes of fresher's, as a fresher who doesn't know things, we are approaching the you tube videos, but here videos are like revising for the people who already mastered the concepts, then what's the point of making the video..
Thanks a lot for your feedback! I appreciate your suggestion. I'll make sure to provide more detailed explanations in my next video, covering the various interfaces used in the code and their purposes. Your input is valuable, and I want to ensure that my content is as helpful as possible.
Hello, thank you very much for the tutorial when you send /api/v1/auth/signin that authorization they send. Thank you greetings from Peru
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
Great work bro!🎉
Thank you so much 😀
i have a doubt
because i referred 4 to 5 tutorials everyone using different approach
i confused which one is more secure and whta do i prefer
can u guide me.
Of course! It's completely understandable to feel uncertain when different tutorials offer varying approaches. When it comes to security, prioritizing reliability is key.
Here's some guidance:
Unique Key for Token Generation: Using a unique key for token generation adds an extra layer of security by ensuring that tokens are not easily guessable or susceptible to attacks like token replay.
Protecting API Based on User Role: Implementing role-based access control (RBAC) helps in enforcing security by only allowing authorized users to access specific resources or perform certain actions within your API.
Sending and Receiving JWT in Headers: Storing JWTs in headers instead of the request body helps prevent accidental exposure of tokens through logging mechanisms or other vulnerabilities.
Setting JWT Token Expiration: Limiting the lifespan of JWT tokens reduces the window of opportunity for malicious actors to exploit stolen tokens, thus enhancing overall security.
Using Refresh Tokens: Employing refresh tokens alongside access tokens allows for more secure token management. Refresh tokens can be used to obtain new access tokens without requiring the user to re-enter their credentials.
Handling Expired Refresh Tokens: If a refresh token expires, it's important to handle this scenario gracefully by logging out the user and prompting them to log in again. This helps mitigate potential security risks associated with expired tokens.
By following these best practices, you can enhance the security of your application and minimize the risk of unauthorized access or data breaches.
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
Can you please create one in which you can show user roles and privileges for Authorization of end points
That's a great suggestion! I'll consider it for a future series. Thanks for your input!
Great video . But could you please tell how to integrate with custom html and css?
Thank you! Integrating with custom HTML and CSS involves calling these APIs using JavaScript. If you prefer using frameworks like React or Angular, you can watch any project playlist on our channel where we've integrated Spring Security with Angular in various examples.
What is the use of refresh token? why you set it's time to live for 7 days . and when login the refresh token also returned . what is the need ?
The refresh token allows for longer user sessions, reducing the need for frequent logins. It has a longer time to live (TTL) to maintain user authentication.
Nice tuto! One question : isn't it better to store hashRefreshToken in database?
Thanks for your feedback! Storing the hashRefreshToken in the database is indeed a good practice for better security and management. It adds an extra layer of protection against token theft. 👍
@@code_with_projects could you show us??
Great work , keep going
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
creat work thanks bro
Thanks a lot! Glad you liked it, bro! 👍😊
endpoints return always 403, with correct endpoints and user
Check and send server logs for any error messages or additional information about why the request is being denied.
time WARN 11496 --- [nio-8090-exec-2] o.s.w.s.h.HandlerMappingIntrospector :Cache miss for REQUEST dispatch to '/home/signin' (previous null). Performing CorsConfiguration lookup. This is logged once only at WARN level, and every time at TRACE.
time WARN 11496 --- [nio-8090-exec-2] o.s.w.s.h.HandlerMappingIntrospector : Cache miss for REQUEST dispatch to '/home/signin' (previous null). Performing MatchableHandlerMapping lookup. This is logged once only at WARN level, and every time at TRACE.
Well these two are shown after trying to enter .../admin/home (which is for admin only)@@code_with_projects
same here....
Has anyone found a solution and can help me?
This is okay for basics but missing proper stages in terms of security context for production ready APIs. Overall good efforts to understand basics.
Thanks for the feedback! While this tutorial covers the basics, I'll definitely consider exploring more advanced security concepts for production-ready APIs in future videos. Appreciate your support!
Very nice, thank you so much
Thank you so much for your kind words! Your support means a lot to us, and we're committed to delivering continued excellence. Thanks again for your encouragement!
@@code_with_projects how can i add the user id when signing in? or other user related data? its for the frontend
no need i figured it out just added this line on the signin method jwtAuthenticationResponse.setUserId(user.getId());
👍
Can you make a video of oauth2.0 implementation?
Your request for a video on OAuth 2.0 implementation has been noted. We appreciate your interest in this topic, and we're committed to providing valuable content for our audience. Stay tuned, as we will definitely work on creating a comprehensive video on OAuth 2.0 implementation in the near future.
why are you not storing refresh token in database. Many RUclips lecture almost all saving refresh token in database.(RefreshTokenRepository )
Great question! Storing refresh tokens in a database can enhance security and allow for better management of token expiration and revocation. I opted for a different approach for simplicity and demonstration purposes in the video. However, using a RefreshTokenRepository is definitely a good practice for production applications. Thanks for pointing that out!
Very nice tutorial. Everything works as described, albeit with little tweaks. However the admin endpoint is not working.
Thank you for your positive feedback, and I'm glad to hear that the tutorial was helpful to you! I appreciate your diligence in making the necessary tweaks to get everything working.
Regarding the issue with the admin endpoint, I'm sorry to hear that you're experiencing difficulties. To better assist you, could you provide more details about the specific problem you're facing with the admin endpoint? Any error messages or additional information would be helpful in troubleshooting and resolving the issue.
I'm here to help, so feel free to share more details, and I'll do my best to assist you further!
@@code_with_projects Many thanks for replying. I finished the code and trying to access the admin endpoint results in a 403 error using Postman with no additional messages to show. I have spent hours looking at the code and can't figure it out. The endpoint should be accessible since authentication was successful but it isn't.
I appreciate your effort in completing the code, and I'm sorry to hear that you're encountering a 403 error when trying to access the admin endpoint. Here are a few steps you can take to troubleshoot this issue:
Roles and Authorities: Double-check that the authenticated user has the necessary roles or authorities required to access the admin endpoint. Verify that the role configuration in your code aligns with the roles assigned to the user during authentication.
Path Configuration: Ensure that the path to the admin endpoint in your Postman request matches the path configured in your Spring Security rules. Minor discrepancies in path configuration can lead to 403 errors.
Token Inclusion: Confirm that your Postman request includes the correct authentication token, especially if you're using JWT. The token should be included in the "Authorization" header with the format "Bearer [your_token]".
Debugging: Consider adding logging statements or using a debugger to inspect the authentication details and roles at runtime. This can provide insights into whether the user has the expected roles.
If the issue persists, please share relevant portions of your security configuration and the Postman request, so I can provide more targeted assistance. Your diligence in troubleshooting is commendable, and I'm here to help you resolve this challenge.
good video,
need a video for OAuthh2 implementation user role many to many relationship, for rest api, not form login, would be much help
Thank you for your feedback! I'll consider creating a video on OAuth2 implementation with user role many-to-many relationships for REST API. Stay tuned for upcoming content. Your suggestions are valuable!
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
from where you get the secret key that you passing in line number 27 in JWTServiceImpl?
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351"
2) You can generate this key from any online password generator website.
3) You can generate by below code.
public static void main(String[] args) {
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256
random.nextBytes(keyBytes);
String secretKey = Base64.getEncoder().encodeToString(keyBytes);
System.out.println("Generated SECRET_KEY : " + secretKey);
}
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
Great stuff but there is one thing I am confused about. During the 'signin' I can see the Authorization tab active in your postman when you are sending the request body.
Should signin require additional authentication? With no authorization set in postman this endpoint would return 403.
Great observation! In the 'signin' process, the Authorization tab is active in Postman because we're including the user credentials (username and password) in the request body for authentication. This is a common approach when sending credentials for user authentication.
Regarding the 403 Forbidden issue, it's important to note that the 'signin' endpoint typically doesn't require additional authentication beyond the credentials provided in the request body. If you're encountering a 403 error, it could be due to various reasons such as incorrect credentials, user not found, or an issue with the authentication process.
Make sure the credentials are correct, and consider checking the Spring Security configuration for the 'signin' endpoint in your Spring Boot application to ensure it allows unauthenticated access.
If you have specific details or code snippets you'd like me to review, feel free to share, and we can dive deeper into resolving the issue. Happy coding!
@@code_with_projects Thank you for you quick response. Luckily I managed to fix it(had some inconsistency with my signatureAlgorithms)
Let me just say that I gone through so many tutorials here in youtube and all of them failed to produce the desired outcome.
Yours is the first one that finally worked and for that I am eternally grateful.
Thank you for your kind words. These words mean a lot to us. Your support is greatly appreciated. Thank you!
Hi, I am having this issue. How did you solve it?@@a.z.b.1916
@@a.z.b.1916 Thank you for your observation. How did you solve it?
Thanks buddy nice tutorial ...
Buddy I think you can go little bit slowly with more explanation.
Like you have to think from beginners perspective and you were like okay this okay this...
Just think about this and upload content accordingly to this it would be more helpful for everyone..
Thanks a lot for your feedback, and I'm glad you found the tutorial helpful! I appreciate your suggestion about slowing down and providing more detailed explanations, especially from a beginner's perspective. Your input is valuable, and I'll certainly take it into consideration for future content.
😊@@code_with_projects
Plz guide me and give me any tip how can i memorize this JWT is very different for me.
Can people do it without code Copy/Past????
Don't worry about memorizing JWT details. When working with secured APIs, you typically receive the JWT from the response of the login API. Focus on understanding how to handle and utilize JWTs in your application rather than memorizing their contents.
Hey, I've heard sometimes people do use sessions + jwt together and send jwt as coockie for example. Is it ok? I mean I thought jwt is for stateless design and sessions for storing state somewhere/somehow. So you pick one according to your needs but not both at the same time. And if it's a common practice, would you mind to create some tutorial of combining sessions and jwt. Thank you.
Using sessions and JWT together is common and valid. JWT handles authentication, while sessions manage server-side state. I'll consider creating a tutorial on this. Thanks for the suggestion! 🚀Keep watching our videos. Thank you
I CAN'T USE THE METHOD STARTSWITH() help please
it say : Cannot resolve method 'startsWith' in 'StringUtils'
Make sure you have added the Apache Commons Lang dependency in your project. Here's an example for Maven:
org.apache.commons
commons-lang3
In SecurityConfiguration class, I am getting error in permitAll function as Cannot resolve method 'permitAll' in 'HttpSecurity'and Cannot resolve method 'sessionCreationPolicy(SessionCreationPolicy)' Can you please rectify.
Make sure to use the exact versions mentioned in the video to avoid encountering any errors.
Nice
Thanks
I am getting 401 unauthorised error. What type of authentication needs to be selected while invoking the requests from postman
Sure thing! In Postman, follow these steps:
Open your request.
Go to the 'Authorization' tab.
From the type dropdown, select 'Bearer Token'.
Enter your token in the designated field.
@@code_with_projects I'm getting this "Using generated security password: 30ecd606-cca2-4876-bc10-0b4f06027ffb" when application starts.Where and how to use it ?
It asks me to login when I'm invoking "localhost:9092/api/v1/auth/hi" through explorer .
How to generete new token ,if original token expired and refresh token is lost.
If both your original token and refresh token are lost, you’ll need to log in again to generate a new token. This will reauthenticate you and provide a new set of tokens.
Whenever I hit signup api I'm getting 401 unauthorised error even though its specified with permit all and passing with correct url
Kindly double-check the spellings of 'signup' in your Postman, in the controller, and in the config file.
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
Please ensure that the authentication token is being sent correctly in the request headers. If the issue persists, double-check the configuration and permissions in your backend code.
i have an error can you help me?, i created project with spring v3.2.0 in getSignInKey method i have an exception like ECDSA signing keys must be PrivateKey instances.
Why are you utilizing the privateKey? In this project, our approach involves constructing and returning a java.security.Key. If your intention is to utilize PrivateKey instead, please ensure compatibility and verify that you are not returning null, as it seems the key is currently null.
I'm getting a "Query did not return a unique result: 2 results were returned" any ideas?
"Query did not return a unique result: 2 results were returned," indicates that there might be two users in the database with the same email address. To resolve this issue, please ensure that you don't have duplicate entries in the database.
If the problem persists, could you share the relevant code snippet where you are executing the query that triggers this error? It would be helpful for me to take a look and provide more targeted assistance.
@@code_with_projects thank yo, i figured it out. i was just a ug with Mysql.
Could you please tell how to generate secret key
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351"
2) You can generate this key from any online password generator website.
3) You can generate by below code.
public static void main(String[] args) {
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256
random.nextBytes(keyBytes);
String secretKey = Base64.getEncoder().encodeToString(keyBytes);
System.out.println("Generated SECRET_KEY : " + secretKey);
}
The signin is working, the refresh token is working but when i call the admin controller, it says 403 forbiden.
Glad to hear sign-in and refresh tokens are working. For the 403 Forbidden issue with the admin controller, ensure you're hitting the right URL. Please share your security config for a quick check. Also, confirm you've followed the video to authenticate the admin URL with the correct role.
Getting the same issue . Is your problem solved?
@@mineeleppa2654 Solved. You take a look "doFilterInternal" in JwtAuthenticationFilter, I recognized I missed "!" in if condition -> "!org.apache.commons.lang3.StringUtils.startsWith(authHeader,"Bearer ")"
so once after the refersh token gets expired, again we need to login? for fresh tokens
Yes, once the refresh token expires, you'll need to log in again to get fresh tokens.
Hello, I'm receiving the 403 error, and in the terminal, the following message appears: Illegal base64 character: '.'. My secret key, I obtained it from the JWT.
Please use the following secret key: 413F4428472B4B6250655368566D5970337336763979244226452948404D6351
@@code_with_projects I did what you said, but I'm receiving the 'Invalid compact JWT string: Compact JWSs must contain exactly 2 period characters, and compact JWEs must contain exactly 4. Found: 0' error. I'm watching again and searching forums for a possible solution.
can we get github repo for this project please
Kindly reach out to us on Instagram for access to the source code.
Correct me if I'm wrong, but we are not checking if the user already exist in the DB before signup ?
I'm facing an issue, I can create the same user multiple times in the DB. Because of this issue, login is not possible if there is more than 1 user with the same credentials. (Obviously)
Did I miss something ?
You're absolutely right. Currently, we're not checking for existing users before signup. The prime focus of this video is Spring Security, and email checking is a small detail that you can implement very easily. To address this, consider adding a check using existsByEmail. If it returns true, display an error message. This should prevent creating duplicate users.
@@code_with_projects Yeah no problem, I've already implemented it myself. I thought I missed something in the video.
Thanks for this tutorial, I'm learning a lot !
👍
Hey, can you help me with this problem? I'm getting this error "Could not autowire. No beans of 'JWTService' type found. " with jwtService variable in JwtAuthenticationFilter class, shoudn't JWTServiceImpl implement JWTService?
Indeed, the 'JWTServiceImpl' should implement 'JWTService' interface. Please double-check the implementation and make sure it's correctly annotated as a Spring Bean with '@Service' or '@Component' so that it can be autowired in the 'JwtAuthenticationFilter' class.
Also, keep watching our videos. Thanks
my run method did not executed or triggerred for inserting the dummy admin what do you think went wrong
Make sure you implemented CommandLineRunner like below. If you are still getting the error then please share the error logs.
@SpringBootApplication
public class SpringsecurityApplication implements CommandLineRunner {
@Autowired
private UserRepository userRepository;
@@code_with_projects that works now... thanks......
but there is one more problem im facing.... im getting the Invalid credentials exception by my authentication manager in signin method or auth service even though the email and password are correct(created by run method).... pretty sure i followed every step from your video.... can you help me fix it....
Sir, i have a problem.
i have followed through the video and everything works as expected. However i added the possibility for a user to have different items.
So i created a basic endpoint where items can be obtained based on user_id for the endpoint /item
@GetMapping("/{id}")
public ResponseEntity getItemsByUserId(@PathVariable Long id) {
List items = itemRepository.findByUserId(id);
return ResponseEntity.ok(items);
}
I am authenticated when doing the GET request, but im getting the error:
jakarta.servlet.ServletException: Unable to handle the Spring Security Exception because the response is already committed.
This only happens when I return the response entity with a item or a user for example. Return a entity with a simple String works. What can be causing the problem?
Show me content of Item.
Thank you
you're welcome!
I got java null pointer exceptions it shows userdetailsService is null
Make sure you've correctly annotated the userdetailsService class with @Service or a similar annotation to allow Spring to manage it as a bean.
If you can share a snippet of your code where the userdetailsService is declared and injected, I might be able to provide more specific guidance. Ensure that the UserService is being injected into the class where you're using it. If the issue persists, feel free to provide more details for further assistance. Happy coding! 😊🚀
Thanks for the response after comment I'll go through the Google and then the error is gone thank
Hey can you please help me to know what datas this token will contain ?
I want name of user, email etc
For this tutorial, we included the user's email in the JWT, but feel free to add more information based on your specific use case.
can you help me with the issue after calling login api and copying token into admin and user api none of the api is getting called and i am also not getting to see any error in console.
It seems unusual that the API is not working, and there are no error logs or responses in the console. I recommend revisiting the code, conducting a thorough dry run, and debugging to identify any potential issues. Sometimes, a fresh perspective can reveal overlooked details. Let me know if you find anything during your review, and we can continue troubleshooting from there.
does claim here means the jwt payload?
Yes, that's correct! In JWT, a claim refers to the information embedded within the token's payload.
Hey really good Tutorial, but one question: Where did you get the byte[] key = Decoders.BASE64.decode("THIS HERE"); You did not tell where you got it and just input it . Thanks for the help
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351"
2) You can generate this key from any online password generator website.
3) You can generate by below code.
public static void main(String[] args) {
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256
random.nextBytes(keyBytes);
String secretKey = Base64.getEncoder().encodeToString(keyBytes);
System.out.println("Generated SECRET_KEY : " + secretKey);
}
Also, keep watching our upcoming videos. Thanks.
I'm still getting the 403 error.And won't we get username and password incorrect as exception (as we have mentioned in orElseThrow()...) if the credentials are wrong.Please help.
brother I am getting 403 error i am done everything like you this tutorial. everything work fine except 403 error
I can't really determine the actual reason with just two words, '403 Forbidden.' However, here are the steps you can follow to resolve this issue:
403 Forbidden error usually indicates that the server has understood the request, but it refuses to fulfill it, often due to permissions or authentication issues.
Check URL and Path: Ensure that you are trying to access the correct URL and path. Sometimes, a small typo in the URL or path can lead to a 403 error.
Login Credentials: Double-check your login credentials (username and password). Ensure that you are entering the correct information.
Debugging: Enable debugging for Spring Security to get more information about why the request is being denied.
If you've reviewed all these aspects and the issue persists, consider sharing more specific details about your Spring Security configuration and Postman request for further assistance. Additionally, check the Spring Security logs for any specific error messages or clues about why the 403 error is occurring.
Try sending the debugging lines to chatgpt other than that my error was that I forgot to add autowired to password encoder.
JWT expired at 2023-11-05T16:20:20Z. Current time: 2023-11-18T16:42:34Z, a difference of 1124534305 milliseconds. Allowed clock skew: 0 milliseconds. **This error i am facing now..please help me to solve out**
The error you're encountering suggests that the JWT (JSON Web Token) you are working with has expired. JWTs contain an expiration time (exp claim) to enhance security. The current time is checked against this expiration time to ensure the token is still valid.
To solve this issue, you have a few options:
Regenerate Token: Regenerate a new token by logging in again.
Refresh Tokens: Call the refresh token API to get a new token.
Increase Validity Time: You can configure the expiration time to 1 week or 2 weeks.
@@code_with_projects but it is not giving permission me to log in and also for refres token..now what can i do?
thank you so mcuh for the video, I have coded but getting error: ECDSA signing keys must be PrivateKey instances.
I have debugged it show error at getSigninKey and searched solution but could not get solution. Kindly assist.
Thank you for watching! It seems like you're facing an issue with ECDSA signing keys. To help you better, I'd need more details about your code. Feel free to share more information, and I'll do my best to assist you.
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
from where should I get the secret key?
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351"
2) You can generate this key from any online password generator website.
3) You can generate by below code.
public static void main(String[] args) {
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256
random.nextBytes(keyBytes);
String secretKey = Base64.getEncoder().encodeToString(keyBytes);
System.out.println("Generated SECRET_KEY : " + secretKey);
}
Also, keep watching our upcoming videos. Thanks.
@@code_with_projectsSo basically, this can be any sequence of random characters as well...? Or does it need to be generated a specific way...?
What is the use of refresh token?
The refresh token plays a crucial role in enhancing the security of the authentication process. While the access token is short-lived and used for authenticating API requests, the refresh token is a longer-lived token. Its primary purpose is to obtain a new access token when the current one expires.
Here's how it works:
1. The user logs in, and the server provides both an access token and a refresh token.
2. The access token is used to authenticate requests to protected resources.
3. When the access token expires, instead of forcing the user to log in again, the refresh token is sent to the server to obtain a new access token.
4. The refresh token itself is not used for authentication but is exchanged for a new access token.
This mechanism helps improve security because:
- Access tokens have a shorter lifespan, limiting the window of vulnerability if they are compromised.
- Even if an attacker gains access to an access token, they cannot use it indefinitely because they would also need the refresh token to obtain a new access token.
In summary, the refresh token enhances security by providing a way to obtain a new access token without requiring the user to log in again, while also mitigating the risks associated with long-lived access tokens.
@@code_with_projects understood, well explained... Thank you 😊
Hi
Getting this error:
Parameter 2 of constructor in com.sunny.springsecurity.services.impl.AuthenticationServiceImpl required a bean of type 'org.springframework.security.authentication.AuthenticationManager' that could not be found.
Action:
Consider defining a bean of type 'org.springframework.security.authentication.AuthenticationManager' in your configuration.
Any fix or if I can read about this more in detail
It looks like you've defined an AuthenticationManager bean in your WebSecurityConfiguration class. Make sure this class is being scanned by Spring and included in your application context. If the error persists, double-check your package structure and component scanning configuration to ensure everything is set up correctly.
@@code_with_projects I am not sure on this webSecurityConfiguration class. Since I am very new to Spring, I have strictly followed your code. if there is any refrence you can help me with, to understand this issue, pls let me know.
when injecting userRepository into the @springboot main class getting error and application is failing to start i am struck can any one guide me ?
Make sure you are using auto wired. If you are still getting the error then please share the error logs.
@Autowired
private UserRepository userRepository;
@@code_with_projects yes I created private repository but it's saying userRepositoey cannot be injected as it's not static as main spring boot class is static
@@code_with_projects java.lang.IllegalStateException: Failed to execute CommandLineRunner
at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:789) ~[spring-boot-3.2.0.jar:3.2.0]
at org.springframework.boot.SpringApplication.lambda$callRunners$3(SpringApplication.java:770) ~[spring-boot-3.2.0.jar:3.2.0]
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183) ~[na:na]
at java.base/java.util.stream.SortedOps$SizedRefSortingSink.end(SortedOps.java:357) ~[na:na]
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:510) ~[na:na]
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499) ~[na:na]
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150) ~[na:na]
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173) ~[na:na]
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) ~[na:na]
at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596) ~[na:na]
at org.springframework.boot.SpringApplication.callRunners(SpringApplication.java:765) ~[spring-boot-3.2.0.jar:3.2.0]
at org.springframework.boot.SpringApplication.run(SpringApplication.java:330) ~[spring-boot-3.2.0.jar:3.2.0]
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1342) ~[spring-boot-3.2.0.jar:3.2.0]
at org.springframework.boot.SpringApplication.run(SpringApplication.java:1331) ~[spring-boot-3.2.0.jar:3.2.0]
at com.codewithnarasimham.springsecurity.SpringsecurityApplication.main(SpringsecurityApplication.java:24) ~[classes/:na]
at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104) ~[na:na]
at java.base/java.lang.reflect.Method.invoke(Method.java:577) ~[na:na]
at org.springframework.boot.devtools.restart.RestartLauncher.run(RestartLauncher.java:50) ~[spring-boot-devtools-3.2.0.jar:3.2.0]
Caused by: java.lang.NullPointerException: Cannot invoke "com.codewithnarasimham.repository.UserRepository.findByRole(com.codewithnarasimham.entities.Role)" because "com.codewithnarasimham.springsecurity.SpringsecurityApplication.userRepository" is null
at com.codewithnarasimham.springsecurity.SpringsecurityApplication.run(SpringsecurityApplication.java:30) ~[classes/:na]
at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:786) ~[spring-boot-3.2.0.jar:3.2.0]
... 17 common frames omitted
@@code_with_projects Required type:UserDetails
,Provided:Optional
How did you get the token?
Hey @kaankahraman61! I used the AuthenticationManager to validate the user's credentials and generate the JWT token in the backend. You can check the video for a step-by-step breakdown! 👍"
Let me know if you'd like any changes or additional details!
@@code_with_projects I am getting a 403 error in postman. I need to help
@code_with_projects Hi please help i am getting the Error this user is null in security config class
Hi there! The 'user is null' error in the security config class typically occurs when the authentication process doesn't successfully retrieve a user. Double-check your authentication logic, make sure your user details are being loaded correctly, and ensure your UserDetails service is implemented properly. If the issue persists, feel free to share relevant portions of your code, and I'll do my best to help you further. Happy coding! 😊🚀
@@code_with_projects i have request you on insta too
Please add timestamps and share source code. Thanks
🔗 Project Source Code: codemarketplace.github.io/
Please can someone tell me how he got the key to use 18:26
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351"
2) You can generate this key from any online password generator website.
3) You can generate by below code.
public static void main(String[] args) {
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256
random.nextBytes(keyBytes);
String secretKey = Base64.getEncoder().encodeToString(keyBytes);
System.out.println("Generated SECRET_KEY : " + secretKey);
}
@@code_with_projects thank you 👑
please share project code also
codemarketplace.github.io/
Bhai..jb auth/signin post method m kr rahe h to..refreshtoken aa raha.hai..lekin.. token null aa raha h postman m kahan issue ho skta h?
Bhai, yeh issue kuch common reasons ke wajah se ho sakta hai. Kuch cheezein check karo:
Body: Ensure karo ke POST request ke body mein saare required parameters sahi se set kiye gaye hain.
Endpoint: Confirm karo ke tum sahi endpoint pe request bhej rahe ho.
Server Logs: Server logs check karo, wahaan kuch additional information mil sakta hai.
@@code_with_projects ho gaya resolve..thanks
Hie bro
i need your help. this video helped me. i am thinking of making a two way authentication where user can authenticate with google as well as by conventional approach like you showed. in both the cases i want to create a new user and save the user data in the database as well. do you have any video regarding how to achive that. there are no video in the internet for that currently can you make one
I'm glad to hear that the video was helpful for you! Creating a two-way authentication system sounds like a great project. While I don't have a specific video on that topic at the moment, I appreciate your suggestion. I'll definitely consider it for future content.
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
on second last part i got error 403 for singin api
I'm sorry to hear that you encountered a 403 error during the sign-in API process. To better assist you, could you please share the error logs related to that particular step? This information will help me pinpoint the issue and provide you with a more accurate solution.
Can we g it a github repo?
🔗 Project Source Code: codemarketplace.github.io/
The `private final UserRepository userRepository;` expression I think is incorrect, not sure why it is not showing an error. It must be initialized and cannot change it's value, and cannot be null, and it does not have the @Autowired annotation. Why?
The DI injection used, requires @Bean
The "JwtServiceImpl" Service is not implementing the Interface! Why?
It seems like you're facing some concerns with the DI injection and implementation of services. Installing the Lombok extension in your IDE can help resolve any issues related to the private final UserRepository userRepository; expression. As for the @Autowired annotation, its usage depends on your application's specific requirements; you can use it if needed. Additionally, ensure that your JwtServiceImpl service implements the required interface to avoid any errors.
I followed the tutorial exactly why do i get a 404 forbidden for admin and user request????
@@code_with_projects Thank you for the response, you got it, It worked.
+1 sub - excellent video, really appreciate it.
18:20 secret key kaha se layi
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351"
2) You can generate this key from any online password generator website.
3) You can generate by below code.
public static void main(String[] args) {
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256
random.nextBytes(keyBytes);
String secretKey = Base64.getEncoder().encodeToString(keyBytes);
System.out.println("Generated SECRET_KEY : " + secretKey);
}
can i get your project on github ?
You can access the source code of the project from this website: codemarketplace.github.io/
@@code_with_projects i can't see the link of project github ? or do i need to pay $ for this ?
provide the git link to pull the code
Kindly reach out to us on Instagram for access to the source code. Here's the link: instagram.com/code_with_projects
Please provide source code of the project bhaii
codemarketplace.github.io/
Bhai ek issue hai, login work nhi kr rha , 403 Forbidden mil rha mujhe ... help please ...
maine same kia h tmhare jaisa
I can't really determine the actual reason with just two words, '403 Forbidden.' However, here are the steps you can follow to resolve this issue:
403 Forbidden error usually indicates that the server has understood the request, but it refuses to fulfill it, often due to permissions or authentication issues.
Check URL and Path: Ensure that you are trying to access the correct URL and path. Sometimes, a small typo in the URL or path can lead to a 403 error.
Login Credentials: Double-check your login credentials (username and password). Ensure that you are entering the correct information.
Debugging: Enable debugging for Spring Security to get more information about why the request is being denied.
If you've reviewed all these aspects and the issue persists, consider sharing more specific details about your Spring Security configuration and Postman request for further assistance. Additionally, check the Spring Security logs for any specific error messages or clues about why the 403 error is occurring.
@@code_with_projects in signin function of AuthenticationServiceImpl , the authenticationManager.authenticate( new UsernamePasswordAuthenticationToken(signinRequest.getEmail(), signinRequest.getPassword()));
Is having some issue , because code is not going to next line after executing this. .
I am trying to login through admin and admin ... ( same that you added in main class )
Please contact us on Instagram and share screen shot of your postman request.
@@code_with_projects I sent you msg, pls accept invite
git link please
Kindly reach out to us on Instagram for access to the source code.
please do logout
Thank you for your suggestion! The logout feature is indeed on our radar, and it's currently under planning for an upcoming part of the series. Your input is valuable, and I appreciate your patience. Stay tuned for the logout implementation in the future videos. Happy coding!
bro lost me at jwtserviceimpl
No worries, JWT Service implementation can be complex. If you have specific questions or need clarification on that part, feel free to ask. We are here to help you navigate it!
You're just coding in the video and not explaining anything, you should at least give a quick overview of the things, rather than just writing it in a hurry
I appreciate your feedback and understand your concern. I'll make sure to include a quick overview of the code in future videos to provide a better understanding of the concepts and techniques involved.
i got this error plzz help : runtime~jwt.auth: could not sign the request: Invalid secret key. Enter a valid key.
1) You can use the same key which I used in project. "413F4428472B4B6250655368566D5970337336763979244226452948404D6351"
2) You can generate this key from any online password generator website.
3) You can generate by below code.
public static void main(String[] args) {
SecureRandom random = new SecureRandom();
byte[] keyBytes = new byte[32]; // 256 bits (32 bytes) is a common choice for HMAC-SHA256
random.nextBytes(keyBytes);
String secretKey = Base64.getEncoder().encodeToString(keyBytes);
System.out.println("Generated SECRET_KEY : " + secretKey);
}
hello, thank you for this tutorial, I did everything just like in your videro and i have a problem. When i generate token for user with USER ROLE and i used it for endpoint in UserController, I get a 403 code response. I checked in terminal i have an error with message: Cannot invoke "app_name.services.JWTServiceImpl.extractUserName(String)" because "this.jwtService" is null. Error is in JwtAuthenticationFilter.java file in doFilterInternal method. Could you help me? What am doing wrong?
Thank you for reaching out, and I appreciate your kind words about the tutorial. It seems like you're encountering an issue with the JWT authentication in your UserController.
The error message you provided, "Cannot invoke 'app_name.services.JWTServiceImpl.extractUserName(String)' because 'this.jwtService' is null," suggests that the jwtService instance is not being properly initialized before use. Here are a few things you might want to check:
Service Initialization: Ensure that the jwtService is properly initialized in your JwtAuthenticationFilter. It seems like it might not be instantiated before the doFilterInternal method is called.
public JwtAuthenticationFilter(JwtService jwtService) {
this.jwtService = jwtService;
}
Dependency Injection: Check if the JwtService is being injected correctly into your UserController. Make sure that the instance of JwtService is not null when you use it in the extractUserName method.
@Autowired
private JwtService jwtService;
Jwts.builder().setClaims(claims).setSubject(subject)
.setIssuedAt(new Date(System.currentTimeMillis()))
.setExpiration(new Date(System.currentTimeMillis() * 1000 * 60 * 24))
.signWith(SignatureAlgorithm.HS512, getKey())
.compact();
brother this code show me deprecated
The method you are using is correct for setting the expiration time and other details of a JWT. Please ensure that your project's POM file is correctly configured and that the dependencies' versions match the versions mentioned in the video tutorial. Additionally, to assist you more effectively, please consider sharing your POM file with us. This will enable us to review your project's configuration and dependencies to provide more specific guidance and help.
17
org.springframework.boot
spring-boot-starter-data-jpa
org.springframework.boot
spring-boot-starter-web
com.mysql
mysql-connector-j
runtime
org.projectlombok
lombok
true
org.springframework.boot
spring-boot-starter-test
test
org.springframework.boot
spring-boot-starter-security
io.jsonwebtoken
jjwt-api
0.12.3
io.jsonwebtoken
jjwt-impl
0.12.3
runtime
io.jsonwebtoken
jjwt-jackson
0.12.3
runtime
@@code_with_projects
@@sabujkumartarfodar8122
Hey this will help you ? tell if any wrong happens?
public static final String SECRET = "5367566B59703373367639792F423F4528482B4D6251655468576D5A71347437";
public String generateToken(UserDetails userDetails) {
return Jwts.builder()
.setSubject(userDetails.getUsername())
.setIssuedAt(new Date(System.currentTimeMillis()))
.setExpiration(new Date(System.currentTimeMillis()+1000*60*24))
.signWith(getSignKey(), SignatureAlgorithm.HS256)
.compact();
}
public String generateRefreshToken(Map extraClaims,UserDetails userDetails) {
return Jwts.builder().setClaims(extraClaims)
.setSubject(userDetails.getUsername())
.setIssuedAt(new Date(System.currentTimeMillis()))
.setExpiration(new Date(System.currentTimeMillis()+684800000))
.signWith(getSignKey(), SignatureAlgorithm.HS256)
.compact();
}
private SecretKey getSignKey() {
byte[] keyBytes= Decoders.BASE64.decode(SECRET);
return Keys.hmacShaKeyFor(keyBytes);
}
@@code_with_projects bhai... .signWith method is not showing means showing no suggestions... please give me any solution for this...
I did comment the previous code and again wrote the same code it worked...🤣 miracle miracle