Spring Boot从请求中获取承载令牌并调用另一个微服务

Question

I have a spring boot microservice that is acting as a gateway and needs to get the authorization header from request, attach it to a new request and pass the request to another microservice. I am currently doing the following and it works, but wondering if there is a better way to do it.

@GetMapping
public List<Task> getTasks(HttpServletRequest request, HttpServletResponse httpresponse) {

    String bearerToken = request.getHeader("Authorization");

    HttpHeaders httpHeaders = new HttpHeaders();
    httpHeaders.set("Authorization", bearerToken);

    HttpEntity<String> httpEntity = new HttpEntity <String> (httpHeaders);

    String getTasksURL = "http://localhost:8082/tasks";
    ResponseEntity<List<Task>> response = restTemplate.exchange(
            getTasksURL,
            HttpMethod.GET,
            httpEntity,
            new ParameterizedTypeReference<List<Task>>(){});
    List<Task> taskslist = response.getBody();
    return taskslist;
}

If there are code samples around using jwt please provide links. Most code samples show only the configuration of jwt within a single microservice, but have not seen a project that ends up calling another microservice, passing the tokens back and forth

Answer 1

I don't see anything wrong with the way you are doing it. However if you're implementing a gateway that's just passing the requests through (perhaps with some rate limiting or security, but not really business logic), I'd recommend checking out http://spring.io/projects/spring-cloud-netflix - the Zuul proxy portion. You can have a fully working API Gateway up in just a few classes and a total of < 200 lines of code including configuration. Its pretty nice!

Answer 2

May be it's better to encapsulate the code dealing with the authorization in a separate Interceptor. This way your code becomes simpler and clearer.

A such Interceptor may look like:

class RestTemplateHeaderModifierInterceptor implements  ClientHttpRequestInterceptor {
@Override
public ClientHttpResponse intercept(
  HttpRequest request, 
  byte[] body, 
  ClientHttpRequestExecution execution) throws IOException {
    // Set your new Header here...
    // ...
    ClientHttpResponse response = execution.execute(request, body);
    return response;
}}

Now you have to add this interceptor to your restTemplate during its creation

@Bean
public RestTemplate restTemplate() {
    RestTemplate restTemplate = new RestTemplate(clientHttpRequestFactory());
    restTemplate.setInterceptors(Collections.singletonList(new RestTemplateHeaderModifierInterceptor()));
    return restTemplate;
}

Answer 3

Its better to use zuul proxy as your gateway. But keep in mind it does not forward your authorization header by default to external service. And if you want to do it then it can be simply done by just one line configuration. You can look How to get username from JWT token while requesting for another service after authentication?