Microservices Security Using JWT | Spring Cloud Gateway | JavaTechie

[@treefrog9392]

I feel like your explanations are even better than people who have english as their first language lol. You really do have a gift for this!

[@impertator644]

I love you. Finally the architecture I'm looking for. A lot of tutorial are covering authentication for only one microservice and you are probably the only one that approaches the problem keeping in mind the whole microservice architecture.

[@Javatechie]

Thank you so much Lukasz for appreciating my work 🥰🥰

[@hkkabir2024]

you worth millions of like

[@shortcuter4]

Is it still applicable in 2024, in the latest version of spring?

[@pierreescudie1634]

Finally found an understandable tutorial about securing a Spring Cloud Gateway microservices architecture! A thousand times thank you sir!

[@dattatraybharde2902]

Great Video sir, completely Awesome...Add the role based security through api gateway.

[@feriel6929]

Wow, thank you so much! You’re literally my savior 🙏 This video was a lifesaver and exactly what I needed. Keep up the amazing work! 🎉👏 It would be awesome if you could make a video on implementing microservices with role-based authorization . That would be so helpful!

[@cristianlozadapadilla4896]

THIS IS THE VIDEO I WAS LOOKING FOR, THANKS SO MUCH FROM COLOMBIA

[@sunderkrishnaupreti561]

Nobody explains like you do..Thank you very much for the video.

[@vedhlikith6252]

Best course available in youtube. Thankfully it is free. Keep up the good work

[@robinhowilson]

You saved my day. God bless you. Thanks so much from Mozambique.

[@atulpatil1586]

Amazing🤩, really like the way you explain and handle everything in a very simple way. thank you!! it helped me a lot.🙏

[@davidevangelista1774]

This is the best channel about Spring and stuffs of all KZbin. Thank you Java Techie.

[@sivakumar-df9kk]

Actually without your tutorial I couldn't learn easily new things implementation in spring app... You are Guru. Thanks lot.

[@Javatechie]

Thank you Siva . Keep learning 😃

[@sunilchandran4u]

This is Gold Boss... Thanks a ton for this video.. I lost most of my interview only because of not answering how to security is implemented in micro services question.... Appreciate your efforts.

[@Javatechie]

Thank you buddy 🙂

[@shanmukpaila6956]

We need this kind of videos. It is an end to end tutorial for microservices with security + JWT. Plz make videos on real time deployments with microservice architecture.

[@baleshwariaddula4775]

Thank you so much for clear explain no one will explain like you.

[@ousmanefofana4495]

i love you brother, you are the best teacher for learners in this field.

[@manoharanrajendiran568]

Hi , Boss, Thanks for the video , i am following you since 2018, your videos help me to get move forward .

[@arundhwajiiith]

Thanks a lot. I am looking for security in Microservices architecture. It is one of the best way, you have explained.

[@Javatechie]

Glad to hear that😊

[@sahilpatel2885]

I had been waiting for this topic for long time. Finally wait is over.

[@cd62]

Waited last couple of month to get solution which you explain about validate and filter the request form spring cloud getway. ##you make my weekend Basant Sir. Thank you Sir

[@Javatechie]

Thanks buddy 😊. Keep learning 👍

[@erichhc9698]

I've been waiting this long, thanks java techie greetings from peru😎

[@naidu12341]

No words Mind Blowing

[@vaishali1843]

1:11:00 The rest call from gateway to auth service is not working. It is throwing an error saying cannot call from java.lang.illegalstateexception: block()/blockfirst()/blocklast() are blocking, which is not supported in thread reactor-http-nio-1. Please let me know if someone can help in this

[@sonliman2192]

This video is very useful for me . Thank you for your time and explanation

[@SayemHasnat-e4h]

it's awsome,, I was trying to solve this kind of problem and this tutorial helps me a lot. Thank You so much for the video tutorial.

[@Full-Stack-Project]

Nice video we learn couple of thing related to microservices and spring security ❤❤❤

[@PrashantJannu]

Thanks aTon Sir ❤, No one can match your Explanation level 👍

[@ManishNegi-il1kf]

Its a very best content which i ever seen in across youtube .. thanks basant keep it up..

[@ousmanefofana4495]

me too

[@shortcuter4]

Is it still applicable in spring 3 (2024) ?

[@Javatechie]

Yes

[@MohitKumar-bc1rs]

Best video you can find for JWT auth ❤

[@manoharanagiaploshan4348]

Searching every where finally got it thanks sir 😀

[@AnilKumar-cc8px]

Grateful for such a wonderful insight on Microservices security. It will definitely help me to improve skills in my projects. Thankyou so much for the efforts. I'm learning a lot from your channel. Awaiting for more interesting videos.

[@Javatechie]

Thanks buddy keep learning 😃

[@umeshchandra6201]

Excellent Explanation. this is the Video i was looking for. thanks

[@jh_super_soccer]

This is what, I was waiting for ,Very Helpful for me

[@yuvrajph4754]

Awesome video Bhai.. much needed.. thanks a lot for the content shared. 🎉

[@truthpath184]

Hi Basant sir, Jwt in microservices explanation is so good. Thank you so much...

[@Mohamed-uf5jh]

Thanks Sir , Good explanation, your course was clear and understandable.

[@nileshdasarwad1668]

Thank you so much sir for wonderful explanation ❤

[@kevinameda2711]

Thank you for such an awesome lecture. We many of us benefit from such work. Continue teaching brother

[@kaushikmitra1982]

Awesome explanation !!! Really i feel that you are one of the most amazing solution architect !!!

[@Javatechie]

Thank you for appreciating buddy. I am just a senior software Engineer not an architect 🤪🤪

[@ВитяМаксимов-л9ш]

Bro, thank you!!! God bless you!!!

[@aadiraj6126]

Hey Basant Anna, this is awesome 👌thanks for such a smooth flow..its really a very complex topic & nightmare for interview candidates.

[@giansiccardi6151]

bro you helped me a lot, thank you very much and greetings from Argentina

[@gopisambasivarao5282]

Thanks so much Basant. Appreciate your efforts. I am learning lot from your videos. Waiting for more videos.

[@maheshy5168]

Wooooow.... i seached a lot for this kind of scenario but i did not find and in so many interviews i faced this question and got stucked. A million thanks basanth.... it helps us a looooot......👏👏👏🤝🤝🤝🙏🙏🙏 Thanks you so much Next Please do videos on TESTING(mockito) microservices end to end and GLOBAL EXCEPTIONAL HANDLING (please think about it)

[@Javatechie]

I will share the link with what you mentioned which i already uploaded. Even if you can search in the channel it's already there buddy

[@Javatechie]

Exception handling : kzbin.info/www/bejne/nYHRlWCer7KSbKM

[@Javatechie]

Mockito testing: kzbin.info/www/bejne/fpmUaH16pdh-p8U

[@rachidbenkitou9023]

Good explanation, your course was clear and understandable.

[@aryanaryan9759]

Much waited ❤ Thank you sir for your wonderful teaching and the knowledge your sharing .

[@sriramvenky7926]

thanks for giving us this much excellent content and awesome video

[@wimaxisp]

Wonderful. Thank you very much for sharing

[@hkkabir2024]

Hello sir. there is api still open for each microservice. like calling the order in it's own microservice with port like localhost: 8082 then api is open . if anyone can call that api wihout gateway and security then what is the usage of jwt ???

[@Javatechie]

Simple question can you please answer me how the user will know about the endpoints of your microservice ?

[@hkkabir2024]

@@Javatechie using url or somehow user know the endpoint or hacker know the endpoint. so the endpoints are not secured for each MS. you have to reconsider your code and try to figure out how to secure all the endpoints separately also

[@Javatechie]

@@hkkabir2024 no buddy it will be known by user only if you exposed it . If we are doing that then it's the wrong approach then what is the need for a gateway?

[@dhirajchavan8364]

Thanks!! Helpful for basic understanding.

[@TalhaHussain-zy9gw]

It is authenticated only when it routes through the gateway. But the end point for the micro services are still open how to secure that?

[@vinaygoswami5374]

I think we need to implement spring security at service level for each service

[@ahammedhussain9335]

Is there any solution for this issue?

[@vinaygoswami5374]

@@ahammedhussain9335 I think the services need not to be public, so we cannot access them directly, we can only access them through gateway as the end user, and at gateway we filter request to check for the token and authentication for routing the request to the appropriate service.

[@darshanrajashekhar5914]

No no just implement cross origin bro

[@vinaygoswami5374]

@@darshanrajashekhar5914 please elaborate

[@filz4461]

You have one of the best educational channels out there. I would love to give you a constructive opinion: It would be great if you could change your microphone into something clearer, like what the java brain and Navin have. Trust me, it makes a huge difference.

[@Javatechie]

Thanks Filz , i noted it and going forward i will come with better audio quality. Need to look into rode configuration

[@archanasingh3060]

​@@Javatechie 🎉d o 😢😢😢😮😊😂😅😅😅😅😮😮😮😮😮😅😮fq😢😢😢😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮😮

[@Javatechie]

Archana not getting you

[@filz4461]

@@Javatechie I think, that's a bot.

[@Javatechie]

Even not getting you buddy. What do you mean by bot

[@adanali3652]

You are super talented man.clear explanation .Thank you

[@inhtruongvu7618]

00:05 Triển khai Bảo mật dựa trên JWT trong microservice bằng Spring Cloud Gateway 07:12 Hai dịch vụ vi mô, Swiggi Service và dịch vụ nhà hàng, đang liên lạc với nhau thông qua API Gateway. 21:19 Cần phải viết một phương pháp để đăng ký người dùng, tạo mã thông báo và xác thực mã thông báo 28:07 Đã triển khai các điểm cuối xác thực và xác thực mã thông báo. 41:40 Xác định Dịch vụ chi tiết người dùng của riêng bạn để xác thực người dùng 48:42 Đã hoàn tất triển khai dịch vụ nhận dạng 1:02:00 Xác thực mã thông báo trong API Gateway 1:09:10 Triển khai logic xác thực mã thông báo JWT trong Cổng 1:22:07 Triển khai bảo mật microservice bằng xác thực JWT Crafted by Merlin AI.

[@TinoReyna1984]

Looks really simple, just as I used to implement the JWT service in a monolithic way, but porting everything to a new independent webservice to validate JWT to access any endpoint without compromising the other webservices.

[@Crazyfactzz123]

Thank you for this wonderful video❤️❤️

[@viveksingh-rt4py]

Awesome videos. Hats off to you in explaining it in a very simple and easy manner. One question. May I know if we have a requirement to secure our swiggy and restaurant service endpoint and grant access based on role, then how we can achieve this requirement .

[@lucienmakutano3574]

Thank you for this tutorial... Kudos

[@rounakmaity4]

Excellent Work....Thank you

[@AjayGupta-ob8oe]

Thanks for sharing the knowledge ❤

[@vaderashyam7207]

Wow Very Nicely Explained In Easy To Understand Manner. 1 Request can you please show how to implement role based authentication with Spring API Gateway ?

[@Javatechie]

Yes buddy it's in queue i will upload soon

[@roshanpatro5777]

Fantastic video and an outstanding explanation ❤‍🔥. Thank you so much!!!

[@andywang4189]

Quite informative, thanks!

[@supun_sandaruwan]

superb clear video

[@romanas7587]

Loved your explaination ❤❤❤❤

[@PatilShantanu-c2t]

Thank you, Basant Bhai...

[@pavankumarmantha]

instead of completely using spring cloud stack we can make this more OSS (open source stack) like every micro service is containerised (dockerised) then use KONG as API gateway. this way we can make the configuration more simple and reduce tight coupling.

[@mirarima8877]

Could you please explain more about how that works?

[@amankumar-f4n5r]

can you please come with your hands on similar like this using KONG.

[@nirmesh44]

The best explanation

[@AlmustaphaTukurUmar]

This Video is really helpful, Pls. Can you cover Role base authentication and Authorization on the individual microservices?

[@ramojiseemakurthi155]

My approach for this is to apply filters to individual microservice, in which set up the securitycontextholder which would look something like below UsernamePasswordAuthenticationToken authenticationToken = new UsernamePasswordAuthenticationToken(username, null, authorities); SecurityContextHolder.getContext().setAuthentication(authenticationToken); This is working for me.

[@faixan13]

finally someone addressed this scenario with proper explanation. Thanks as always. one question that if auth service also has to pass through api gateway and we didn't add filter param in gateways routes for auth service then why we are checking those urls through validators in authentication filter ? because request will never land on filter in case of /register and /token api

[@Javatechie]

No usually we should do a rest call to identify service from gateway to validate and get token but here to avoid that I have directly used jwt logic in gateway that's why it's confusing for you

[@faixan13]

​@@Javatechie but that rest call we are doing lately when all the checks are true before that. I am talking about that "if" condition in start (validator.isSecured.test(exchange.getRequest())) { because in this condition we are checking /register and /token urls to bypass the token check and according to implementation when we will call register or token it would never land on Authentication Filter. let me know if I am missing something still.

[@Javatechie]

That's correct right. In the filter we had token validation logic right? So when i don't want to authenticate the user for the first time login then why do you want this to be delegated to filter what is the sense here ? Let me know if I understand your concern correctly. If not please drop an email to [e-mail]

[@faixan13]

@@Javatechie no I dont want to authenticate for the first time. I am just saying that, main if condition is of no use when we will call /register or /token , it does not matter if the condition is there or not. Will email no problem

[@Javatechie]

@@faixan13 okay simple things buddy remove those 2 url from validator don't bypass it and run your app then test . Hope you will get your point.

[@dineshrajput1821]

In the gateway service when we create authfilter is good to copy default methods and paste them or memorize them bc there is a lot methods? at 59:52 onwards

[@Akash-tq1ui]

Hi Basant , Very useful tutorial however I have one doubt, In production when the token is generated by passing a valid username and password it should automatically pass the token to the gateway right but here I saw that you are manually passing the token to the gateway through Postman for accessing microservices, My question is how we can automatically pass the token to the gateway for accessing microservices when the token is generated

[@Javatechie]

Your question is genuine but this automatically stuff needs to handle from UI not from the backend

[@Akash-tq1ui]

@@Javatechie ok thank you!

[@Nexgenstory]

Could you explain me : Client -> Security Service (GenerateToken) -> API Gateway -> MicroService1 (validate JWT) this flow is fine . What happen we request come directly to Client-> Microservice1 . How to check JWT for each endpoint.

[@aishaprasad5555]

How to block each microservice endpoint to access??

[@PeetCode]

The API Gateway is like the front door to your entire microservices setup. Every request coming in or going out passes through it. Think of it as a super-secure, load-balanced gatekeeper that makes sure only the right people and requests get in. Once you’ve validated requests at the gateway, there’s no need to worry about extra authentication for internal services since they aren’t directly accessible from the outside world. This setup keeps everything neat, secure, and centralized, so your microservices can focus on what they do best-without worrying about who’s knocking on the door.

[@akumarsingh85]

Just what I needed. 👍

[@ouyoussmeryem1916]

you're really amazing thank you so mutch

[@alegutierrezmusic]

Thank you so much great video. Just wanted to mention that oauth 2.1 removed the password grant type so a generated client_credentials would be a better option, and would like to see an updated video on that implementation.

[@milanfaizal]

Awesome video.

[@serigneibrahimafall6322]

Wonderful and clearly explained. I want just to know how to access authentication info (principal for example) and how to do authorization if needed in microservices

[@Javatechie]

Please check the video below 👇 you will get an idea kzbin.info/www/bejne/p4CnoHenasSbd68

[@serigneibrahimafall6322]

@@Javatechie Thanks a lot

[@berkslv]

You're a life saver!

[@suresh1250]

Thank you very much for providing such a detailed explanation. Your video is undoubtedly superior to paid courses that tend to overcomplicate things and stretch on for more than 8 hours. I have a question: If I were to call Swiggy or a restaurant service directly, bypassing the gateway or discovery service, how would I handle authentication?

[@vivekbansal-bc9eg]

you can't but you can make that api endpoint in api gateway itself

[@rathan235]

Great job

[@BrilliantMindsZw]

well explained concepts, thank you

[@tanvirahmed7399]

If I want to add userId to the order table as a primary key then how can I get the current logged-in user so that I can take the user credential then take userId and place it into the order table?

[@Javatechie]

From controller method just call principal.getUserName()

[@tanvirahmed7399]

​@@Javatechie Thanx for the reply. what about swaggy microservice or restaurant microservice. there has no security configuration so how I can get the logged-in user from swaggy or restaurant microservice?

[@fsoldierdeth]

i have a question, what if i have 3 microservices (agency -> service -> activities ) and i want to get all activities from the services that an agency offers, do i need to ask for the token 3 times?

[@Javatechie]

It should be done in one go , simply we are applying security on the entry point not in individual microservice

[@Bharathidhasan-m]

Hi, You've integrated an identity security service with your API Gateway (running on port 8080) and secured it with authentication via tokens. The API Gateway is working perfectly with token-based authentication. However, the issue is where the individual microservices (on ports 8083, 8084, etc.) and even the security service (on port 9898) itself are still accessible directly, without any authentication. What’s the best way to ensure these services are secured, not accessible directly without tokens, and can only be accessed through the API Gateway? I’ve found suggestions like blocking the ports in Kubernetes, but this approach doesn’t seem scalable when auto-scaling is in use. Any insights or recommendations would be greatly appreciated. Thanks!

[@AmitBenShimon]

why did you copy the code of "/validate" to gateway? It's useless now in the identity-service if you run this piece of code from the gateway

[@Javatechie]

Rather than doing another rest call to identity service i have used it in gateway itself

[@AmitBenShimon]

@@Javatechie i get that, but if this was the goal all along, then why did we implement this in the id-service to begin with? I want to avoid duplicate code.

[@IT_Ocean]

Nice detailed video..

[@xiaoze3234]

may i know why feign cannot use within the custom filter,i had issue that my feign is null

[@Javatechie]

I guess we can use it. But not sure whether will it work with traditional api call or not will check and update

[@sidimohamedelhamed4419]

Thank you! how is it going if i have the UserData in an other service, is there any video with this case ?

[@Javatechie]

In our case also user data available in other services right

[@MedAliJelidi]

Thank you! but i have a question! is this enough in term of security in my application and how can i add more security layers

[@Javatechie]

This is the way to implement in microservice but if you want more secure then better use 3rd party identity providers like okta or keyclok. I already uploaded a video of keyclok using microservice

[@ViswanathSandilyaJandhyala]

Hi @javatechie I have a question. What is i dont want to validate the token in cloud-gateway. every request which is coming to gateway and cloud-gateway has to call identity-service to validate the token and send back to cloud-gateway and based on the response it will call the endpoint or throw an exception. Is it possible ??

[@Javatechie]

Yes it's absolutely possible that is what I explained in PPT but while explaining code I have added validateToken logic in gateway but you can do that easily just refer flow it will be dead easy

[@developersatish]

love you bro you are helping so much

[@saurabhmaurya6964]

is there any way to get the exact exception message in response ? in gateway

[@Javatechie]

Yes we can do that

[@saurabhmaurya6964]

@@Javatechie how ...i tried with global exception handling but for that web dependency required..but web and gateway both are not compatible with each other.. so how are to?..

[@Javatechie]

Yes correct but gateway we have used wwbflux right so we can use global exception handling for reactive approach but wait let me do some cross check will update in same thread

[@Javatechie]

Can't we play with the fallback method of resilense4j

[@saurabhmaurya6964]

@@Javatechie so we have to write fallback method to get the proper exception...am I right?..

[@RanuMishra-es1xf]

keep it up good work.

[@krishnan6201]

how spring cloud check that request came from web or mobile app and executes corresponding version of RequestMapping method. can you please clarify my query?

[@Javatechie]

There is no such mechanism whether it's mobile or web app endpoint will always be the same buddy .

[@krishnan6201]

@@Javatechie i am facing interview questions about it. i can't able to answer that. what could expert answer from you. plz help me on this.

[@Javatechie]

For desktop or mobile view frontend team needs to design responsive pages. Nothing to do from the backend

[@krishnan6201]

thanks @@Javatechie

[@vivekbansal-bc9eg]

Won't the rest template call to identity service will be blocking and will lead to an issue?

[@Javatechie]

Yes it should be synchronous

[@seriseyes]

Im using gateway automatic locator. How can i exclude my auth-microservice from filters?

[@Javatechie]

You must need to specify antMatchers

[@C410-u7t]

Let me ask you a question. If, for example, I try to access the restaurant service directly (giving the restaurant service port), that is, without going through Gateway, I will skip the validate token part, right? So the restaurant service isn't protected at all, is it?

[@Javatechie]

Then what is the need of the API gateway buddy? If you will directly expose your microservice endpoints to users

[@C410-u7t]

​@@Javatechie The point is, if a hacker knows the port of my services (for somehow), he can easily access them.

[@omkarprakashbhosale8338]

Do you get any solution regarding this

[@omkarprakashbhosale8338]

​@@Javatechie then how disallow it...?....bcz if somebody knows our port...he can access it

[@Javatechie]

Knowing only port how someone can access buddy? We shouldn't expose our microservice endpoints even though it's exposed then we need to implement cross origin so that if the request comes from only api gateway then only allow that.

[@amreshsinha2469]

What if user tries to access the microservices endpoint directly bypassing the api-gateway if endpoint for microservices is exposed to the user in any way. How to secure it.

[@MrShashankTube]

When i am trying to access through post man with identity service routes via gateway its giving me like "An expected CSRF token cannot be found". I guess my request has not been forwarded from api gateway to auth service. Because its preventing me due to spring security impl in api gateway. When i try to access it from a browser it redirects me to login page. What is the issue ?