Spring 启动微服务授权

Question

I have two spring boot applications. Backend part - with access to the database it is used as Rest API and admin panel. Frontend part - using Rest API to display information for clients.

So I have a problem with configuration security for the client part (frontend), also for the admin panel, authorization is implemented through sessions. Previously, authorization for client part was implemented through a JWT token, but I do not quite understand how to store a token for each individual client and use it when sending requests to Rest API.

There is my Security Configuration:

@Configuration
@EnableWebSecurity
@ComponentScan(basePackages = "kg.nurtelecom.cashbackapi")
public class SecurityConfig {
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Configuration
    @Order(1)
    public static class RestApiSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        private JwtAuthenticationTokenFilter jwtAuthFilter;

        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .csrf().disable()
                    .antMatcher("/api/**")
                    .authorizeRequests()
                    .antMatchers("/api/authenticate").permitAll()
                    .antMatchers("/api/**").permitAll()
                    .and()
                    .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

            http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        }
    }

    @Configuration
    @Order(2)
    public static class AdminSecurityConfig extends WebSecurityConfigurerAdapter {
        @Autowired
        @Qualifier("customUserDetailsService")
        private UserDetailsService userDetailsService;

        @Autowired
        public void configureGlobalSecurity(AuthenticationManagerBuilder auth) {
            auth.authenticationProvider(authenticationProvider());
        }

        @Bean
        public PasswordEncoder getPasswordEncoder() {
            return new BCryptPasswordEncoder(8);
        }

        @Bean
        public DaoAuthenticationProvider authenticationProvider() {
            DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
            authenticationProvider.setUserDetailsService(userDetailsService);
            authenticationProvider.setPasswordEncoder(getPasswordEncoder());
            return authenticationProvider;
        }


        @Override
        protected void configure(HttpSecurity http) throws Exception {
            http
                    .authorizeRequests()
                    .antMatchers("/**").authenticated()
                    .antMatchers("/login")
                    .permitAll()
                    .anyRequest()
                    .authenticated()
                    .and()
                    .formLogin()
                    .usernameParameter("username")
                    .passwordParameter("password")
                    .loginPage("/login")
                    .failureUrl("/login?error")
                    .permitAll()
                    .and()
                    .logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout"))
                    .logoutSuccessUrl("/login");
        }

        @Override
        public void configure(WebSecurity web) throws Exception {
            web
                    .ignoring()
                    .antMatchers("/resources/**", "/static/**", "/assets/**", "/css/**", "/js/**");
        }
    }

}

So is it possible to configure authorization between two spring boot applications using JWT tokens?

Answer 1

You have to request it whenever you need it, for example when the previous one has expired and when you acquiere it you have to storage somewhere in the clients side.

For example, local storage or a cookie, so anytime you need to do a call to the backend you can attach it to the request in the authorization header