advancedJWT: Token-Based Authentication
Why must a custom JWT-issuing login endpoint call AuthenticationManager.authenticate() instead of comparing passwords itself?
Calling AuthenticationManager.authenticate() reuses the exact same verification pipeline the framework already provides — the configured AuthenticationProvider(s), UserDetailsService, PasswordEncoder, account-status checks (locked/disabled/expired), and authentication event publishing (Chapter 5's audit listeners). Reimplementing password comparison directly in the controller bypasses all of this, duplicating logic and losing consistent exception handling and auditability.
Ready to master this question?
Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.
Sign in to generate a response