advancedJWT: Token-Based Authentication
Why must a custom JWT-issuing login endpoint call AuthenticationManager.authenticate() instead of comparing passwords itself?
Calling AuthenticationManager.authenticate() reuses the exact same verification pipeline the framework already provides — the configured AuthenticationProvider(s), UserDetailsService, PasswordEncoder, account-status checks (locked/disabled/expired), and authentication event publishing (Chapter 5's audit listeners). Reimplementing password comparison directly in the controller bypasses all of this, duplicating logic and losing consistent exception handling and auditability.
This is a Pro chapter
Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.
Why must a custom JWT-issuing login endpoint call AuthenticationManager.authenticate() instead of comparing passwords itself?