A comprehensive Spring Boot application demonstrating secure user authentication and authorization using Firebase Auth with session-based security.
- Firebase Authentication Integration: Complete JWT token validation and user management
- Session-based Security: Secure cookie-based session management with Spring Security
- Public & Private Endpoints: Role-based access control for different API endpoints
- Database Integration: H2 in-memory database with JPA support (MySQL ready)
- CORS Configuration: Proper cross-origin resource sharing setup
- RESTful API: Clean REST endpoints for authentication and user management
- Frontend Integration: Sample HTML/JavaScript login form
- Java 21 - Latest LTS version
- Spring Boot 3.4.4 - Main framework
- Spring Security - Authentication & authorization
- Spring Data JPA - Database operations
- Firebase Admin SDK 9.4.3 - Firebase integration
- H2 Database - In-memory database (development)
- MySQL - Production database support
- Maven - Build tool
- Lombok - Code generation
- Java 21 or higher
- Maven 3.6+
- Firebase project with Authentication enabled
- Firebase service account key
- Create a Firebase project at Firebase Console
- Enable Authentication with Email/Password
- Generate a service account key:
- Go to Project Settings → Service Accounts
- Generate new private key
- Save as
src/main/resources/notifikasi-270506-firebase-adminsdk-*.json
Update src/main/resources/application.yml:
security:
firebase-props:
database-url: ${FIREBASE_DATABASE:your-project.firebasestorage.app}
cookie-props:
domain: ${DOMAIN:your-project.firebaseapp.com}
allowed-origins:
- https://${DOMAIN:your-project.firebaseapp.com}
- http://localhost:3000Update index.html with your Firebase config:
var firebaseConfig = {
apiKey: "your-api-key",
authDomain: "your-project.firebaseapp.com",
projectId: "your-project-id",
// ... other config
};# Clone the repository
git clone <repository-url>
cd spring-boot-firebase-auth
# Run the application
mvn spring-boot:run# Build the application
mvn clean package
# Run the JAR
java -jar target/firebase-auth-0.0.1-SNAPSHOT.jarThe application will start on http://localhost:8080
| Method | Endpoint | Description |
|---|---|---|
| GET | /public/test |
Test public access |
| GET | /favicon.ico |
Favicon |
| POST | /session/login |
User login |
| Method | Endpoint | Description |
|---|---|---|
| GET | /private/user-details |
Get authenticated user details |
- Frontend Login: User enters credentials in
index.html - Firebase Auth: Frontend authenticates with Firebase
- Token Exchange: Send Firebase ID token to
/session/login - Session Creation: Backend validates token and creates secure session
- API Access: Use session cookie for subsequent API calls
{
"kind": "identitytoolkit#VerifyPasswordResponse",
"localId": "user-unique-id",
"email": "user@example.com",
"displayName": "",
"idToken": "eyJhbGciOiJSUzI1NiIs...",
"registered": true,
"refreshToken": "AMf-vBxkMD_s8HHq...",
"expiresIn": "3600"
}src/
├── main/
│ ├── java/id/my/hendisantika/firebaseauth/
│ │ ├── auth/ # Security configuration
│ │ │ ├── SecurityConfig.java
│ │ │ ├── SecurityFilter.java
│ │ │ └── SecurityService.java
│ │ ├── config/ # Application configuration
│ │ │ ├── FirebaseConfig.java
│ │ │ └── SpringConfig.java
│ │ ├── endpoint/ # REST controllers
│ │ │ ├── PublicEndpoints.java
│ │ │ └── PrivateEndpoint.java
│ │ ├── model/ # Data models
│ │ │ ├── User.java
│ │ │ ├── Credentials.java
│ │ │ └── *Properties.java
│ │ ├── util/ # Utilities
│ │ │ └── CookieUtils.java
│ │ └── SpringBootFirebaseAuthApplication.java
│ └── resources/
│ ├── application.yml # Configuration
│ └── firebase-key.json # Firebase service account
├── test/
└── index.html # Sample frontend
- JWT Token Validation: Secure Firebase token verification
- Session Management: HTTP-only, secure cookies
- CORS Protection: Configurable allowed origins
- CSRF Protection: Built-in Spring Security CSRF
- Path-based Security: Public/private endpoint separation
- Development: H2 in-memory database (auto-configured)
- Production: MySQL support (uncomment in
application.yml)
mvn testmvn clean package- Open
index.htmlin a browser - Enter email and password
- Click "Login" to authenticate
- Use the session for API calls
| Public Endpoint | Private Endpoint | Web Interface |
|---|---|---|
![]() |
![]() |
![]() |
FROM openjdk:21-jdk-slim
COPY target/*.jar app.jar
EXPOSE 8080
ENTRYPOINT ["java","-jar","/app.jar"]| Variable | Description | Default |
|---|---|---|
FIREBASE_DATABASE |
Firebase database URL | notifikasi-270506.firebasestorage.app |
DOMAIN |
Application domain | notifikasi-270506.firebaseapp.com |
- Fork the repository
- Create a feature branch
- Commit your changes
- Push to the branch
- Create a Pull Request
This project is licensed under the MIT License.
Hendi Santika
- Email: hendisantika@yahoo.co.id
- Telegram: @hendisantika34
- Link: s.id/hendisantika


