Secure Your Spring Boot Application with Email OTP Verification | Step-by-Step Guide FINAL

Secure Spring Boot login with Email OTP (step‑by‑step)

What the tutorial covers (high level)

• Building a simple Spring Boot login flow that requires email OTP verification before allowing login.
• Using an H2 in-memory database for testing and the H2 console (http://localhost:8080/h2-console) to inspect users.
• Demonstrates service, repository, and controller layers plus basic error/verification handling.
• Shows how to register a user, send/verify OTP, then login with email + password.
• Mentions how to extend with authentication/authorization for other endpoints.

Key technical steps and implementation details

Models & repository

• A User model (persisted in the users table) is used to store user data.
• userRepository.findByEmail(email) is used to locate a user by email.

Service layer (userService.login)

• Method signature: returns a User (or a response object) and accepts email (String) and password (String).
• Implemented logic:
  1. Fetch the user by email.
  2. Check the user is not null.
  3. Check the user is verified (OTP verification flag).
  4. Compare provided password with stored password (e.g., equals).
  5. If checks pass, return the user; otherwise throw an exception (internal server error or custom exception).
• Recommendation: create and throw custom exceptions for clearer error responses (instead of generic internal server errors).

Controller

• A POST endpoint (for example POST /login) implemented using @PostMapping.
• Accepts email and password as request parameters or in the request body (caller choice, but body is recommended for POST).
• Calls userService.login(email, password) and wraps the result in a ResponseEntity.
• Suggests customizing error handling and response messages when verification fails.

Testing / running the flow

• Start the Spring Boot app (default port 8080).
• Use the H2 console to inspect users created by the register endpoint.
• Typical flow:
  1. POST /register to create a user.
  2. Receive OTP via email (demo copies OTP to show flow).
  3. POST /verify to verify the OTP.
  4. POST /login with email and password — expect successful login if verified.
• If verification is not completed or the password is wrong, the demo shows an internal server error; it is recommended to handle these cases more gracefully with proper status codes and messages.

Tips, improvements and customization suggestions

• Use custom exceptions and proper HTTP status codes (e.g., 401 Unauthorized, 403 Forbidden, 400 Bad Request) rather than generic 500 Internal Server Error to convey verification or authentication failures.
• Accept credentials in the request body (JSON) for POST endpoints instead of plain query parameters.
• After login, integrate authentication (e.g., JWT or Spring Security) so only authenticated users can access protected endpoints.
• Customize behavior and responses to suit your application (roles, session management, additional checks such as rate limiting or OTP expiry).

Best practice: return clear, specific errors (with appropriate HTTP status codes) and avoid exposing sensitive details in error messages.

Endpoints / components referenced

• userRepository.findByEmail(email)
• userService.login(email, password)
• Controller endpoints:
  • POST /register (implied)
  • POST /verify (implied)
  • POST /login
• H2 console: http://localhost:8080/h2-console

Main speaker / source

• A video presenter / tutorial author (YouTube channel owner; unnamed in the subtitles) — a developer/instructor walking through the Spring Boot implementation and live demo.