Securing Spring Boot Microservices with Spring Security

Overview

Basically, our microservices are secured this way :

  1. The user provides his credentials via a public endpoint
  2. If authenticated, the server returns an authentication token (JWT)
  3. The JWT is attached to each subsequent request via an HTTP header: Authorization:Bearer TOKEN

User Microservice

This microservice uses a MySQL database. We begin by creating the Account table:

Below is a script to insert some dummy data:


The Account entity will be created using JPA:



The account repository:



User Principal

We create a class named UserPrincipal which implements UserDetails. In order to be accessible by all microservices, this class is located in our shared module.


JWT Token Service


This service is responsible for creating expiring JWT. We can also parse a JWT for getting the UserPrincipal. We use the io.jsonwebtoken dependency for that.


Account Service


The account service via the login method logs in a user and returns a JWT. This service is located in the user module.


Authentication Filter


The authentication filter is responsible of extracting the JWT from the Authorization header.


Authentication Provider

The authentication provider is responsible of validating the JWT. If the token is valid, we return a UserPrincipal otherwise we throw an exception. As you can see we don't access the database at all (our stateless solution!). In order to be accessible by all microservices, this class is also located in our shared module.


Security Config

We will configure in the next configuration class all the Spring security staff. In order to be available to all modules, this configuration will be placed in our shared module.


As you can see, all non public endpoints are protected.

Public Controllers

In the user module, we create a controller for logging in a user into the application.


Protected Controllers

The authenticated user can be accessed via the AuthenticationPrincipal annotation.


Testing

You can test a protected controller this way :



Thanks for sharing...



Comments

Post a Comment

Popular posts from this blog

Spring JPA : Using Specification with Projection

You may probably know that using Specification with Projection is not possible at this moment. I'll show you how you can easily bypass this problem using the JPA Criteria. 1. Create an extended repository We begin by creating an extending global repository as follow : You can find more information here . 2. Add our custom method In order to limit the fields returned for each item, the consumer of my API must provide the required fields this way: /orders?fields=productId,name,quantity . ( Best Practices ) Basically, I'm defining the SELECT clause with the returned fields (cf. getSelections() ): 😎Happy coding...
Read more

Chip input using Reactive Form

The Chips component documentation from the angular material website, describes how to use the MatChipInput directive with a chip-list for adding or removing chips. I'll show you how you can implement the same component using Reactive Form. The HTML template: The TS component file:   As you can see, we use the FormBuilder class to simplify the form creation. We define our requirements as a  FormArray within our FormGroup. The requirements will be accessed in our template with this expression inside the *ngFor of <mat-chip></mat-chip> : *ngFor="let requirement of form.get('requirements').controls; let i = index;" In the ChipComponent class, the requirements array is accessed by using this expression: this.form.get('requirements') as FormArray; Thanks
Read more