advancedJWT: Token-Based Authentication

Why must a custom JWT-issuing login endpoint call AuthenticationManager.authenticate() instead of comparing passwords itself?

Calling AuthenticationManager.authenticate() reuses the exact same verification pipeline the framework already provides — the configured AuthenticationProvider(s), UserDetailsService, PasswordEncoder, account-status checks (locked/disabled/expired), and authentication event publishing (Chapter 5's audit listeners). Reimplementing password comparison directly in the controller bypasses all of this, duplicating logic and losing consistent exception handling and auditability.

This is a Pro chapter

Sign in, then upgrade to Pro or Power to unlock this and the full Spring Ecosystem Mastery library.

Why must a custom JWT-issuing login endpoint call AuthenticationManager.authenticate() instead of comparing passwords itself?

Next Step

Continue to How do you expose the AuthenticationManager as an injectable bean for a custom login controller?← Back to all Spring Security questions