JWT-Based Authentication and Role-Based Access Control for Securing a Healthcare Management System REST API: An Implementation Case Study
Keywords:
Healthcare information systems, JWT authentication, REST API security, Role-based access control, Spring Security, Stateless authenticationAbstract
Healthcare management systems store sensitive patient and staff data and are increasingly built as REST APIs that are used by separate client applications. Protecting such an API needs an authentication and authorization mechanism that does not depend on server-side sessions. This study presents an implementation case study of a security layer for a Healthcare Management System developed with Spring Boot 3, Spring Security 6, Spring Data JPA, and a Microsoft SQL Server database. The layer issues a signed JSON Web Token (JWT) at login, validates it in a custom filter placed in the Spring Security filter chain, runs with stateless sessions, and restricts the administrator endpoints through a role claim. Functional tests were executed with Postman: an administrator login returned a token, and a protected endpoint returned HTTP 401 when the token was missing, altered, or expired and HTTP 200 when a valid token was supplied. The study also states the limitations of the current version, including unhashed password storage and the role-mismatch and cross-origin cases that are yet to be tested, and outlines the planned next steps, which include an Angular front end and a later move to microservices. The study is intended as a practical and reproducible reference for developers who secure small healthcare REST APIs with JWT.
References
S. Adilapuram, “Unveiling modern authentication strategies for Java APIs: Exploring OAuth 2.0, JWT, API keys, and basic authentication,” Journal of Scientific and Engineering Research, vol. 9, no. 9, pp. 119–125, 2022.
S. Dalimunthe, J. Reza, and A. Marzuki, “The model for storing tokens in local storage (Cookies) using JSON Web Token (JWT) with HMAC (Hash-Based Message Authentication Code) in e-learning systems,” Journal of Applied Engineering and Technological Science, vol. 3, no. 2, pp. 149–155, Jun. 2022.
S. Dalimunthe, E. H. Putra, and M. A. Fadhly Ridha, “RESTful API Security Using JSON Web Token (JWT) with HMAC-SHA512 Algorithm in Session Management,” IT Journal Research and Development, vol. 8, no. 1, pp. 81–94, Dec. 2023.
M. Rana, A. Pandey, A. Mishra, and V. Kandu, “Enhancing data security: A comprehensive study on the efficacy of JSON Web Token (JWT) and HMAC SHA-256 algorithm for web application security,” International Journal on Recent and Innovation Trends in Computing and Communication, vol. 11, no. 9, pp. 4409–4416, Nov. 2023.
L. V. Jánoky, P. Ekler, and J. Levendovszky, “Evaluating the Performance of Novel JWT Revocation Strategy,” Acta Cybernetica, vol. 25, no. 2, pp. 307–318, Aug. 2021.
B. Mario, T. Wiradinata, and C. Christian, “Enhancing web security and performance with hybrid stateless authentication,” Journal of Applied Informatics and Computing, vol. 9, no. 3, 2025.
X. Xiang, M. Wang, and W. Fan, “A permissioned blockchain-based identity management and user authentication scheme for e-health systems,” IEEE Access, vol. 8, pp. 171771–171783, 2020.
Spring, “Spring Boot reference documentation.”
Mozilla, “Cross-Origin Resource Sharing (CORS),” MDN Web Docs.
M. Jones, J. Bradley, and N. Sakimura, “JSON Web Token (JWT),” RFC 7519, Internet Engineering Task Force, May 2015.
Spring, “Spring Security reference documentation.”
OWASP Foundation, “OWASP Top 10:2021,” 2021.
