❓ How to use SSE with Spring Security and JWT authentication?

[sbharatjoshi]

Question

How do I secure my SSE endpoints with Spring Security and JWT tokens?

Since the browser's EventSource API doesn't support custom headers, how should I pass the JWT token?

Recommended Approaches

Option 1: Query parameter (EventSource transport)

this.sse.stream<T>(`/sse/my-topic?token=${this.authService.getToken()}`, {
  transport: 'eventsource',
});

Option 2: Custom headers (fetch transport)

this.sse.stream<T>('/sse/my-topic', {
  transport: 'fetch',
  headers: {
    'Authorization': `Bearer ${this.authService.getToken()}`
  }
});

Option 3: Cookie-based (withCredentials)

this.sse.stream<T>('/sse/my-topic', {
  withCredentials: true,
});

See issue #32 for the roadmap on built-in auth support.

This is a pinned FAQ — add your own auth patterns below!

[FLCordis]

Concrete example for Option 1: JWT via query parameter

To add a concrete example for Option 1 (query parameter), since that's usually the path of least resistance when using the browser's native EventSource.

The tricky part is that Spring Security's normal JWT filter expects the token in the Authorization header, while EventSource doesn't give you a straightforward way to set custom headers.

A possible approach is to support a query-string token only on the SSE endpoint, rather than changing authentication behavior repo-wide:

public class SseTokenAuthFilter extends OncePerRequestFilter {

    private final JwtDecoder jwtDecoder;

    @Override
    protected void doFilterInternal(
            HttpServletRequest request,
            HttpServletResponse response,
            FilterChain chain
    ) throws ServletException, IOException {

        if (request.getRequestURI().startsWith("/sse/")
                && request.getHeader("Authorization") == null) {

            String token = request.getParameter("token");

            if (token != null) {
                try {
                    Jwt jwt = jwtDecoder.decode(token);

                    var auth = new JwtAuthenticationToken(jwt);
                    SecurityContextHolder.getContext().setAuthentication(auth);

                } catch (JwtException ex) {
                    response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
                    return;
                }
            }
        }

        chain.doFilter(request, response);
    }
}

Then register the filter before BearerTokenAuthenticationFilter:

http.addFilterBefore(
    new SseTokenAuthFilter(jwtDecoder),
    BearerTokenAuthenticationFilter.class
);

Ideally, this should be scoped specifically to /sse/** so the query-parameter authentication mechanism isn't enabled for the rest of the application.

Security considerations

There are two important things worth flagging here because this is security-sensitive:

• Query-string tokens can end up in access logs, browser history, proxies, monitoring systems, and other places where URLs are recorded.
• If you use this approach, consider issuing a short-lived token specifically for opening the SSE connection, rather than exposing a normal long-lived access token in the URL.

If Option 3 (withCredentials + HttpOnly cookie) is viable in your setup, I'd strongly prefer that approach. It avoids putting the token in the URL entirely and integrates naturally with Spring Security's existing cookie/session handling.

The query-parameter approach is best treated as a fallback for cases where cookie-based authentication isn't practical, such as certain cross-origin SSE configurations.