spring boot - feign client sending on basic authorization header| Pass jwt token from one microservice to another

Question

I am creating a microservice based project using spring boot. I have used eureka server for service discovery and registration also using JWT for authentication for authorization and authentication. Each microservice has jwt validation and global method security is implemented on controllers I am making inter microservice calls using feign client.

Services - 1)main request service 2)Approver service;

approver service is making a call to main service for invoking a method that is only accessible by ADMIN but when jwt validation is processed on main request service side..i can only see basic authorization header in Headers.

I am passing JWT token from my approver service Feign client in approverservice

 @FeignClient("MAINREQUESTSERVICE") public interface MainRequestClient { @RequestMapping(method=RequestMethod.POST, value="/rest/mainrequest/changestatus/{status}/id/{requestid}") public String changeRequestStatus(@RequestHeader("Authorization") String token,@PathVariable("requestid")int requestid,@PathVariable("status") String status); }

Code for reading header from request

 @Override public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException { HttpServletRequest request=(HttpServletRequest) req; HttpServletResponse response=(HttpServletResponse) res; String header = request.getHeader("Authorization"); System.out.println("header is "+header); if (header == null || !header.startsWith("Bearer")) { chain.doFilter(request, res); return; } UsernamePasswordAuthenticationToken authentication = getAuthentication(request); SecurityContextHolder.getContext().setAuthentication(authentication); chain.doFilter(request, response); }

While debugging this filter i have printed the token on console Header when debugged in main request service

So can get help on how can i pass my JWT token from one microservice to another?

Answer 1

Try this (code based on https://medium.com/@IlyasKeser/feignclient-interceptor-for-bearer-token-oauth-f45997673a1 )

@Component public class FeignClientInterceptor implements RequestInterceptor {

private static final String AUTHORIZATION_HEADER="Authorization";
private static final String TOKEN_TYPE = "Bearer";

@Override
public void apply(RequestTemplate template) {
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();

    if (authentication != null && authentication instanceof JwtAuthenticationToken) {
        JwtAuthenticationToken token = (JwtAuthenticationToken) authentication;
        template.header(AUTHORIZATION_HEADER, String.format("%s %s", TOKEN_TYPE, token.getToken().getTokenValue()));
    }
}

}