Spring Cloud API Gateway | JWT Security | Pass UserDetails to Microservices | JavaTechie

[@impertator644]

Great content. It would be also great to see, how to integrate this authentication with frontend, I mean for example, how to handle loging. And also how to handle "log once".

[@MAMUNGM]

Thank you so much to add this requested content

[@ntjoel19]

I appreciate the content and the architecture. Thank you for the video. For a better scalability, separation of concerns, security enforcement, I thing you can totaly seperate the gateway with the authentication by making the authentication service an independant microservice.

[@Javatechie]

Yes that's what we need to play with identity services from gateway

[@saqlainmirza9644]

@@Javatechie please make this

[@RahulKumar-qu1if]

Hi , can you please make a video on how to integrate both Oauth2 and jwt in a single application

[@Javatechie]

Okay i will

[@pranoydas9654]

​@@Javatechiesir, have you created the video of Oauth2 and JWT in a single application?

[@jimiotulana2546]

Thanks a lot, very informative, however, I was wondering if the restaurant API had been using a role-based control how do you pass the user role such that the endpoint can only honor the request if the user has the right permission

[@Gabrysia445]

maybe you could pass this in the same manner that user name was sent? Add a header "userRoles" with role as a value in the gateway

[@MAMUNGM]

Thanks to you for adding this. How to configure the cors origin configuration in api-gateway and auth microservice?

[@aadiraj6126]

What is the industry best practices? Details are passed through header or request body?

[@Javatechie]

Yes we can pass as part of the header not an issue it won't be visible to outside calls. Request body needs to use when we have to pass multiple fields or object

[@cevinananda1639]

very good tutorial, but i have a question. The services is secure if we access it from the api gateway, but it have no secure system when we try access it directly from the service (without using api gateway endpoint). My question, is there any ways to make the services only can be access from the api gateway and can't be access from the service directly. Thank you

[@Javatechie]

That is why we are using gateway to make a single entry point to our application so if you won't expose microservice endpoints then the user won't access it .

[@cevinananda1639]

thank you for your fast response. Forgive me, I am new to this microservices thing. I just knew that when we already at the deployment phase, we can make the service only accessible by the api gateway and block any other request that's not from the api gateway. good tutorial and very helpful person, thank you very much

[@southcroydon7462]

Hi, which video has API Gateway details ? not sure I understand AbstractGatewayFilterFactory

[@Prakash-8876]

Hi, I’m curious to know about your mac experience. Is it good for development? Which MacBook you are using, please? Is it worth to buy? Planning to buy but not sure with performance!! Thanks.

[@Javatechie]

Mac for development is superb and can't compare with any other OS. Without any second thought go ahead with it . I am using both Mac desktop and mac pro laptop 💻 . It's amazing 😍

[@viacheslav_chudnovskyi]

Is it considered a bad practice to set Authentication in the SecurityContextHolder in the API gateway to make it accessible from a controller in another service?

[@Javatechie]

No not at all

[@maantram]

We have Zuul proxy and spring boot 2.1.x and implemented resourceserverconfig adapter. Now we have upgarding to spring boot 3.2.0 and cloud gateway. What is the equalent implementation for resourceconfigadaptor

[@dineshpanigrahi1065]

Hi @JavaTechie, Can you please make a video explaining to prevent direct calls to microservices, we should access the microservices only through the api gateway, and role based authorization in continuation of the spring cloud api gateway | JWT Security video

[@Javatechie]

Yes interesting. I will give it a try

[@dineshpanigrahi1065]

@@Javatechie Thank you . Can we have a video in continuation to this video ASAP

[@sanathrayala2745]

@@Javatechie waiting for above committed video😊😊

[@karthicks2198]

Hi, But still need to product other micro services right, between micro services communication how to secure? Without using api gate still you can access directly other micro service, it should required security right?

[@Javatechie]

Simple answer why will you expose other microservices direct endpoint? What is the need for an api gateway then ?

[@collinstamaletalemwa6218]

Great tutorial! Although, what is the best way for one to secure the microservices as well? Since they only appear secure when accessed through the gateway, but one does not need to be authorised to access the microservices directly

[@Javatechie]

If you will allow user to directly access to microservices then what is the need of api gateway it doesn’t make any sense right because we are bypassing the flow

[@collinstamaletalemwa6218]

@@Javatechie it is not a matter of giving users access, but it turns out to be a big security concern once anyone decides to attack you. There is no point of defense at all

[@Javatechie]

Okay if forcefully you want to secure then you need to implement security in each and every microservices that is what I can think at this moment. Will check and update if there could be any better approach

[@akshaynilkanth_shady]

Hi Brother, I guess we need not do that because when the request is forwarded the SecurityContextHolder object already has user details int it.........after learning from your previous video i implemented the same architecture and tried it

[@Javatechie]

Yes that's correct but in each microservice i shouldn't add security dependency to just fetch the user info

[@akshaynilkanth_shady]

@@Javatechie Yes indeed......thanks for all your tutorials.....you have no idea how much it has helped me to build my career

[@Javatechie]

Glad to hear this Akshay . Keep learning 😃

[@Akash-tq1ui]

Very useful video , Thankyou😊 I have one doubt if I want to pass userid to microservices how to do that ?

[@Javatechie]

I already explained that please check the next video of microservice security

[@ngonimugandani4504]

This is awesome

[@hkkabir2024]

i have checked in the gateway it's not possible to use RouteValidator class "/auth/**" it's not working. would u like to findout the solution

[@siddharthshitole7574]

Hi Techie, I really love your content, requesting you to make a series on code review. it will be helpful for everyone

[@Javatechie]

Yes it's on my queue buddy soon i will do that

[@Virat77799]

How rolebased authorisation happens witn this architecture..please make a video of it. How any rest end point will give access to only admin or role ?

[@anupamupadhyay826]

Hi @Java Techie, thank you for sharing such valuable content. I have a question: could you please help me understand the process of implementing method-level role-based authorization in a Swiggy microservice? While I'd prefer not to use Keycloak, I'm interested in any references or guidance you could provide to achieve this. For instance, I'm curious about effectively utilizing the @PreAuthorize annotation in a Swiggy microservice

[@Javatechie]

That's tough to implement i am working on a poc once it is done i will upload

[@hieunghiemxuan3992]

Hi @@Javatechie, I went through your series about Auth in microservice and I couldn't find the videos about role-based authorization. I mean the next video of this one. Did you already upload it?

[@Javatechie]

Not uploaded yet buddy

[@hoanganhtuan7266]

Hello , my identity-service is not working properly, after running all service 15' it works. Please show me how to configure that, thank you !

[@hduy8536]

You can make a video to decentralize permissions. For example, if the user does not have permission to access service A, it will be denied.

[@BrilliantMindsZw]

Thank you, do you have any audit implementation?

[@Javatechie]

Audit implementation using spring security?

[@srinukumbam6918]

Hi Bro, Thank you for This content, and it is very much useful for every java developer. And my question is here restaurant service also authorised service if swiggy service want to call restaurant service like using RestTemplate, how we have to pass the token since the request will directly go to gatway. Is it As you explained in above or any other way?

[@Javatechie]

Swiggy service needs to pass a token to access restaurant service using rest template headers

[@srinukumbam6918]

@@Javatechie Thank you bro.

[@cd62]

Hi @Java Techie, Thank you for such great content. Sir, how to handle if api gateway go down? In this conditions I need to create cluster for this. Can you create a video to explain if possible? Thanks for support

[@Javatechie]

Hi buddy, usually in real-time we do follow multiple instances for service as a replica, in case of region instance goes down then immediately traffic should redirect to active instance and to achieve this usually we do need to configure proper DR (disaster recovery)

[@Adventurevictoria]

is this an excellent idea? pour all the security logic into the gateway which is the busiest service for routing the message that can cause potential bottlenecks for the entire service? and make all sub-microservices open up with as naked? the main job of gateway is routing the messages to the proper microservice. you could implement basic token validation here since it will cut down all unnecessary burdens in earliest point but securityfilter in gateway shouldn't be much heavy like this .

[@V1vekST]

8:30 "why this is crying?" 🤣

[@pranoydas9654]

Sir, can you make a video of role based authentication like user role , admin role etc ? Using JWT

[@Javatechie]

Role base i am also struggling to find a solution. Will definitely update you

[@rahulvijay1781]

Awsome javatechie can u implement oauth2 in api gateway ?

[@vinodhreddy6227]

U can cover roles to access the rest endpoint

[@Javatechie]

No but this is not the way to maintain Authorization. I will upload that video

[@vinodhreddy6227]

@@Javatechie ok, identity service we can't add roles and services we can use ryt?

[@Javatechie]

You can add roles in identity service but in other microservices to use this role for Authorization bit tricky

[@vinodhreddy6227]

@@Javatechie cover that topic also, thanks

[@AzrielPazarudin]

I got the problem while I try it using Postman, it's send me a message : An expected CSRF token cannot be found

[@Javatechie]

Disable it

[@AzrielPazarudin]

@@Javatechie how i did'nt understand, i have disable the csrf in auth-service

[@Javatechie]

I have done this in securityFilterChain please check and do the same

[@AzrielPazarudin]

@@Javatechie thank you, i didn't check it before. Now its work

[@walterricardoforerosanchez8461]

Thanks for the content ❤ What is the name of the app next to the configuration?

[@nadigatlapraveen4681]

Hi sir, can you please make a video on role based spring boot microservices security

[@AbhishekSharma-jg2ow]

Hi @Java Techie, Thank you for such great content. Sir, I came across a question in an interview and was still unable to find a suitable solution, I will be grateful if you can make a small video on this. I believe this may require generics, recursion or reflection concepts. WAP to compare if two arguments are equal, they can be anything primitive, Array, Map, Collection or custom objects, and the input param type is Object. Ex, isEqual(Object arg1, Object arg2). As per the question, we don't have knowledge of the input provided.

[@amjadali3601]

We can do this using generic method if all the Class that we need to compare implements Comparable interface

[@Javatechie]

Good question i believe we can directly play with object but will check and update

[@saurabhtandel3332]

How to exclude some API from applying Jwt in the headers.

[@mrowox]

Is it possible to pass a user object instead of the username. For example, I might need the email, username, and role of the user. Also how to I restrict API endpoints bu roles and permissions

[@Javatechie]

I don't think we can pass an object directly in the header but you can pass multiple key and value

[@mrowox]

@@Javatechie so how can I use something like @AuthenticatedPrincipal or annotations like @hasRole and @hasAuthority in the respective microservices?

[@Javatechie]

I still have not found the solution for role based Authorization in this approach. Looking into it m

[@sujeetsharma9976]

Hi Java Techie, Can you make a video on logout that makes Jwttoken expired in microservice.

[@HarryKane-m4q]

Hi @Java Techie, Thank you for This content, and it is very much useful for me, But How Swagger calls works in this case. Can you pls add that also..

[@Javatechie]

Okay sure

[@ratnajiguptha5643]

Hi , can you make a video implementation of oauth and sign with different platform like google, Facebook, github .

[@SanjayKumar-di5db]

there is security vulnerability in this way, if client adds the same header in the request then micro services might read the header added by the client and not the gateway so need to block the header coming from the client either at infra level like nginx or cloudfront or need to put check on gateway itself that if client sending any of these headers then forbidden

[@Javatechie]

Not getting you Sanjay , what do you mean by client here ?

[@SanjayKumar-di5db]

In detail all headers in http could be a list of values and gateway is adding some headers and hacker can add the same headers then there is a chance that micro service side the header it reads is coming from hacker

[@Javatechie]

Okay got you.then we can mask it and pass

[@deviprasadhota2617]

Great one... One question how to enable cors cor support host header?

[@deviprasadhota2617]

Just encountered like problem.. Can you tell me how I can support host header for my api... Now its forbidding the host header. One of our client wants to access the api by giving its endpoint.

[@MEGANE34]

Hi Java Techie, Thank you for great content.can make spring boot project for deploying azure with jenkins pls

[@Javatechie]

Azure doesn't have much experience but will check and update you

[@MEGANE34]

@@Javatechie Thank you, i am looking forwad 😳😳

[@gamingbeast710]

aswome

[@mohdshahrukh6176]

Sir career related kuch guidance milskti hae?

[@Javatechie]

Drop me an email to [e-mail]

[@sk-ip4md]

Hi, Can you please make a video on Oauth2 + webclient+ token uri?

[@kmiiloberrio-dev]

How to deploy in aws this distributed system?

[@sagar8964]

how To disable direct access to microservice & allow only though api gateway?

[@Javatechie]

Yes that's what the gateway pattern

[@sagar8964]

@@Javatechie can you please make a tutorial on it?? Also how to use preAuthorize in swiggy controller?

[@slogger5033]

I am getting a forbidden error after following the above video, Can anyone please tell what can be possible scenarios to look into it?

[@Javatechie]

You might have made some mistake please import the code and try again

[@anilkumarraju8839]

Hi bro nice can we expect Saga pattern implementation video bro

[@Javatechie]

Hi Anil Kumar , please check this video it's already there in the channel kzbin.info/www/bejne/bICYmn1thbCIntU

[@robinrajlouis9183]

How to handle Authorization (role based Authorization)?

[@Abhi-wh3lh]

Do a video for roles from gateway to swiggyservice

[@logic_master950]

Hi sir, can you create a video on how to to password reset using mail api.

[@arpit1145]

Better approach is use two way TLS or A2A cert .

[@tendaikawadza4492]

i need support on one of my api to do this

[@vamshibyagari5986]

08:31 why's this crying😂

[@ashishmishra2346]

how routing will be done if url of swiggy-service(host1:port1) and restaurant-service(host2:port2) is different