Building An API Gateway With Spring Cloud, Security, Netflix Zuul, Eureka And Ribbon Using JWT Access And Refresh Tokens

Elattar Saad

Mon, 20th September 2021

11 min read

#spring #spring security #netflix eureka #netflix zuul #JWT

Building An API Gateway With Spring Cloud, Security, Netflix Zuul, Eureka And Ribbon Using JWT Access And Refresh Tokens

Let’s first define what we’re trying to achieve here before diving into establishing an API Gateway and dealing with sophisticated configuration.

An API gateway is a cloud-based management solution for APIs that sits between a client and a collection of backend services. It acts as a reverse proxy, taking all API requests, aggregating the many services required to complete them, and providing the relevant results.

This article is based on Getting started with Spring Boot: Creating a simple movies list API and Spring cloud: introduction to service discovery using Netflix eureka; Make sure to take a give it a look before getting started with this one.

Api Gateway

The API Gateway we aiming to build will have two main jobs to handle:

The filtering and routing agent will manage request routing based on filtering procedures; a series of filters will determine if the request should be forwarded to the backend services, redirected, or even rejected.
The security agent (the largest part) is one of the filters that performs a more thorough examination of the authentication and authorisation statuses of incoming requests.

The authentication status determines whether the request sender is a registered user. The authorisation status of a request indicates whether it has access to a certain resource.

For this example I will be using:

Java version: 8
Spring boot version: 2.4.13
Spring cloud version: 2020.0.0

Building the security agent

The security agency will be based on the following dependencies:

Spring Data JPA and H2 database for storing our users:

Spring Boot Web to expose endpoints to create users and login them by generating JWT Tokens (we need the JWT library also):

Spring Security which will handle the user authorisation and authentication:

The Lombok dependency to reduce our boilerplate code:

Then, let's start with a basic config of our server and datasource:

The authentication statuses are based on two models: users and roles, which we’ll develop next; each module will have its own bean, controller, service, and database repository:

The user module

The user bean will be like the following:

You can other data properties if needed.

We name the bean AppUser instead of user to avoid the collision with the Spring Security user which we'll going to use later.

To handle user endpoints we created the following RESTful controller:

The user repository will be as basic as this:

The service layer of this module will be having the following specs:

As you can see, we used the UserDetailsService, which is a Spring Security default service for dealing with Spring Security users. However, because we added our own user schema, we needed additional code to handle it the Spring Security way.

Finally, we need to set and handle our custom exceptions:

The role module

The role bean will be like this:

You can add more attributes if needed.

For this module, we didn't add a controller since the user controller handle the role attribution to users, but you still can add a controller if you need dynamic roles.

To persist our roles, the roles repository handles that of us:

And the role service will handle the logic for us:

And of course we need to set our custom exceptions and a handler:

with that, we are done defining the general schema of our project (domain layer).

Spring Security configurations

Now, it's time to stuff our app with a set of needed configurations aspects, let's start with the password encoder config, the password encoder is the tool the app will use to encrypt our data (mainly passwords).

Inside of a package called "security" we created a class named SecurityBeanConfig.java:

This allows us to use the BCryptPasswordEncoder as our main password encoder, note that there're other encoders like the Pbkdf2PasswordEncoder, SCryptPasswordEncoder and the Argon2PasswordEncoder.

Next, where thing get a bit serious we need a set of configs which will allow us to define:

Our user service as main user service for Spring Security (I'll develop that even more later).
The Cross-Site Request Forgery (CSRF) and Server Session states.
The fully and role-based allowed and prohibited routes.
The authentication and authorisation filters. Inside the same package, we created another class called SecurityConfig.java containing the following code:

Line 8: Because we implemented the UserDetailsService interface in our own user service, Spring security will inject our user service instead of the default service.
Line 9: This is where we’ll inject the encoder we created in the first stage of this config (yep, the BCryptPasswordEncoder).
Lines 12–14: Instead of using the default user service and encoder, we just instruct Spring Security to use ours.
Line 18: For demonstration reasons, we removed the CRSF protection that is enabled by default in Spring Security (since version 4) (we’ll see a suitable CRSF configuration in a future post), you may learn more about Cross-Site Request Forgery.
Line 19: Again, we won’t be utilizing sessions for demonstration reasons, so we set the session creation policy to stateless. You may utilize sessions (with suitable setups) by changing the policy to one of the following values: always, if a session does not already exist, one will be established ifRequired, if a session is required, the default option will be used. never, a session will never be generated, but an existing session can be utilized, or it can be stateless, spring security will never create or use a session.
Line 20–23: We inform Spring which routes are permitted without any authentication/authorisation (line 20), which routes require a certain role to be accessed (line 21), and which routes require the authentication state (line 23).
Line 24: We added the UsernamePasswordAuthenticationFilter before the authorisation filter (we'll see that next) to handle the /login requests seeking to be logged in used a username and a password.
Line 25: Here we add our authentication filter which we will be building next.

Building the Security filters

In this section we need build our own authentication and authorisation filter in order to control how both processes are executed.

The authentication filter

The authentication filter is the part which will handle the authentication process from the authentication attempt (sending the username and password) to the result which can be a successful or an unsuccessful authentication.

The auth function (line 8) will retrieve the username and password from the request header params, create a token and authenticate using the Spring Security AuthenticationManager.

If the authentication was successful the function (line 17) will be invoked which be charged to get the authenticated user, create the access and refresh JWT tokens and return them as a response to the /login request.

JSON Web Tokens (JWT) are a proposed Internet standard for producing data with optional signatures and/or encryption, with the payload including JSON that asserts a set of assertions. A private secret or a public/private key is used to sign the tokens. Know more about JWT.

The JwtUtils class is a utility class which we created and it has the redundant function such the tokens creation and verification functions.

With that we are done our basic security agent using Spring Security and JWT access and refresh tokens. Now, it's time to configure our Netflix Zuul reverse proxy.

Building the reverse proxy using Netflix Zuul

Starting with dependencies, for this part of our app we'll be using, Netflix Zuul as our reverse proxy, Eureka client for service discovery and Netflix Ribbon as our load balancer:

What we need to do here is to set our routes for our backend services, for our example a GET endpoint /client/hello which return a simple string, this is a separate micro-service registered on our Eureka server under the id hello-client.

Also, for this gateway can fetch the registered micro-service, we need to add some Eureka client config.

And finally to add a load balancer capability to our gateway, we'll add a simple ribbon configs:

Under the config package, we added the following config class.

With that, we are done building our app, let's get straight into testing it!

First, note that a super admin user is created when the app starts under the username "xrio" and password "verystrongpwd", when we login we must receive our two codes:

Api Gateway

We will create another user with the name, username and password "admin":

Api Gateway

And we assign the ADMIN role to the created user:

Case 1: when token is wrong or expired

Api Gateway

Case 2: when token is correct

Api Gateway

Now, we try to retrieve the list of user which need the ADMIN or SUPER_ADMIN role to be accessed:

Case 1: when token is incorrect

Api Gateway Case 2: when token is correct

Now, we can try accessing one of the backend micro-services from our gateway:

Case 1: when token is incorrect Api Gateway

Case 2: when token is correct

Api Gateway

Finally,

The gateway we built does a good job here, but believe me when I say it needs a lot more configuration for sophisticated behavior in terms of safeguarding and managing traffic to and from the backend services.

Please notice that I skipped configurations such as CRSF and server sessions configs for demonstration reasons and to keep things simple.

Building An API Gateway With Spring Cloud, Security, Netflix Zuul, Eureka And Ribbon Using JWT Access And Refresh Tokens

Elattar Saad

Mon, 20th September 2021

11 min read

Read on Medium

#spring #spring security #netflix eureka #netflix zuul #JWT

Let’s first define what we’re trying to achieve here before diving into establishing an API Gateway and dealing with sophisticated configuration.

Api Gateway

The API Gateway we aiming to build will have two main jobs to handle:

The filtering and routing agent will manage request routing based on filtering procedures; a series of filters will determine if the request should be forwarded to the backend services, redirected, or even rejected.
The security agent (the largest part) is one of the filters that performs a more thorough examination of the authentication and authorisation statuses of incoming requests.

The authentication status determines whether the request sender is a registered user. The authorisation status of a request indicates whether it has access to a certain resource.

For this example I will be using:

Java version: 8
Spring boot version: 2.4.13
Spring cloud version: 2020.0.0

Building the security agent

The security agency will be based on the following dependencies:

Spring Data JPA and H2 database for storing our users:

Spring Boot Web to expose endpoints to create users and login them by generating JWT Tokens (we need the JWT library also):

Spring Security which will handle the user authorisation and authentication:

The Lombok dependency to reduce our boilerplate code:

Then, let's start with a basic config of our server and datasource:

The authentication statuses are based on two models: users and roles, which we’ll develop next; each module will have its own bean, controller, service, and database repository:

The user module

The user bean will be like the following:

You can other data properties if needed.

We name the bean AppUser instead of user to avoid the collision with the Spring Security user which we'll going to use later.

To handle user endpoints we created the following RESTful controller:

The user repository will be as basic as this:

The service layer of this module will be having the following specs:

Finally, we need to set and handle our custom exceptions:

The role module

The role bean will be like this:

You can add more attributes if needed.

For this module, we didn't add a controller since the user controller handle the role attribution to users, but you still can add a controller if you need dynamic roles.

To persist our roles, the roles repository handles that of us:

And the role service will handle the logic for us:

And of course we need to set our custom exceptions and a handler:

with that, we are done defining the general schema of our project (domain layer).

Spring Security configurations

Inside of a package called "security" we created a class named SecurityBeanConfig.java:

This allows us to use the BCryptPasswordEncoder as our main password encoder, note that there're other encoders like the Pbkdf2PasswordEncoder, SCryptPasswordEncoder and the Argon2PasswordEncoder.

Next, where thing get a bit serious we need a set of configs which will allow us to define:

Our user service as main user service for Spring Security (I'll develop that even more later).
The Cross-Site Request Forgery (CSRF) and Server Session states.
The fully and role-based allowed and prohibited routes.
The authentication and authorisation filters. Inside the same package, we created another class called SecurityConfig.java containing the following code:

Line 8: Because we implemented the UserDetailsService interface in our own user service, Spring security will inject our user service instead of the default service.
Line 9: This is where we’ll inject the encoder we created in the first stage of this config (yep, the BCryptPasswordEncoder).
Lines 12–14: Instead of using the default user service and encoder, we just instruct Spring Security to use ours.
Line 18: For demonstration reasons, we removed the CRSF protection that is enabled by default in Spring Security (since version 4) (we’ll see a suitable CRSF configuration in a future post), you may learn more about Cross-Site Request Forgery.
Line 19: Again, we won’t be utilizing sessions for demonstration reasons, so we set the session creation policy to stateless. You may utilize sessions (with suitable setups) by changing the policy to one of the following values: always, if a session does not already exist, one will be established ifRequired, if a session is required, the default option will be used. never, a session will never be generated, but an existing session can be utilized, or it can be stateless, spring security will never create or use a session.
Line 20–23: We inform Spring which routes are permitted without any authentication/authorisation (line 20), which routes require a certain role to be accessed (line 21), and which routes require the authentication state (line 23).
Line 24: We added the UsernamePasswordAuthenticationFilter before the authorisation filter (we'll see that next) to handle the /login requests seeking to be logged in used a username and a password.
Line 25: Here we add our authentication filter which we will be building next.

Building the Security filters

In this section we need build our own authentication and authorisation filter in order to control how both processes are executed.

The authentication filter

The auth function (line 8) will retrieve the username and password from the request header params, create a token and authenticate using the Spring Security AuthenticationManager.

The JwtUtils class is a utility class which we created and it has the redundant function such the tokens creation and verification functions.

With that we are done our basic security agent using Spring Security and JWT access and refresh tokens. Now, it's time to configure our Netflix Zuul reverse proxy.

Building the reverse proxy using Netflix Zuul

Starting with dependencies, for this part of our app we'll be using, Netflix Zuul as our reverse proxy, Eureka client for service discovery and Netflix Ribbon as our load balancer:

Also, for this gateway can fetch the registered micro-service, we need to add some Eureka client config.

And finally to add a load balancer capability to our gateway, we'll add a simple ribbon configs:

Under the config package, we added the following config class.

With that, we are done building our app, let's get straight into testing it!

First, note that a super admin user is created when the app starts under the username "xrio" and password "verystrongpwd", when we login we must receive our two codes:

Api Gateway

We will create another user with the name, username and password "admin":

Api Gateway

And we assign the ADMIN role to the created user:

Case 1: when token is wrong or expired

Api Gateway

Case 2: when token is correct

Api Gateway

Now, we try to retrieve the list of user which need the ADMIN or SUPER_ADMIN role to be accessed:

Case 1: when token is incorrect

Api Gateway Case 2: when token is correct

Now, we can try accessing one of the backend micro-services from our gateway:

Case 1: when token is incorrect Api Gateway

Case 2: when token is correct

Api Gateway

Finally,

Please notice that I skipped configurations such as CRSF and server sessions configs for demonstration reasons and to keep things simple.

eureka:
  instance:
    hostname: ${spring.application.name}
    secure-port-enabled: true
    nonsecure-port-enabled: false
    nonSecurePort: 80
    securePort: 443
    instanceId: ${eureka.instance.hostname}:${spring.application.name}:${PORT}
    statusPageUrl: http://${eureka.hostname}/
    healthCheckUrl: http://${eureka.hostname}/actuator/health
    secureHealthCheckUrl: http://${eureka.hostname}/actuator/health
client:
    registerWithEureka: false
    fetchRegistry: true
    serviceUrl:
      # your Eureka server url
      defaultZone: http://localhost:8099/eureka/

application.yaml

ribbon:
  NIWSServerListClassName: com.netflix.niws.loadbalancer.DiscoveryEnabledNIWSServerList
  eureka:
    enabled: true

AppUser.java

@Entity
@Data
@NoArgsConstructor
@AllArgsConstructor
public class AppUser {
    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;
    private String name;
    private String username;
    private String password;
    @ManyToMany(fetch = FetchType.EAGER)
    private Collection<Role> roles = new ArrayList<>();
}

AppUserController.java

@RestController
@RequestMapping("users")
@Data
@Slf4j
public class AppUserController {

    private final AppUserService appUserService;


    @PostMapping("/")
    public ResponseEntity<?> save(@RequestBody AppUser appUser) {
        if (appUser == null)
            return ResponseEntity
                    .status(UNPROCESSABLE_ENTITY)
                    .body("User data is corrupted");
        return ResponseEntity
                .status(CREATED)
                .body(appUser);
    }

    @PostMapping("/link")
    public ResponseEntity<String> linkRole(@RequestBody UserRoleLinkingData linkingData) throws AppUserNotFoundException, RoleNotFoundException {
        if (linkingData == null || linkingData.getName() == null || linkingData.getUsername() == null)
                return ResponseEntity
                        .status(UNPROCESSABLE_ENTITY)
                        .body("User/role data is corrupted");
        appUserService.linkRoleToUser(linkingData.getUsername(), linkingData.getName());
        return ResponseEntity
                .ok()
                .body("Role: "+linkingData.getName()+" linked to user: "+linkingData.getUsername());
    }

    @GetMapping("/")
    public ResponseEntity<List<AppUser>> findAll() {
        return ResponseEntity
                .ok()
                .body(appUserService.findAll());
    }

    @GetMapping("/refresh")
    public void refreshToken(HttpServletRequest request, HttpServletResponse response) throws IOException, RefreshTokenMissingException {
        String authorizationHeader = request.getHeader(AUTHORIZATION);
        if (authorizationHeader != null && authorizationHeader.startsWith(JwtUtils.BEARER)){
            try {
                String token = authorizationHeader.substring(JwtUtils.BEARER.length());
                DecodedJWT decodedJWT = JwtUtils.getDecoded(token);
                String username = decodedJWT.getSubject();
                AppUser appUser = appUserService.findByUsername(username);
                Map<String, String> tokens = new HashMap<>();
                tokens.put(ACCESS_TOKEN_ID, JwtUtils.createAccessToken(appUser));
                tokens.put(REFRESH_TOKEN_ID, JwtUtils.createRefreshToken(appUser));
                response.setContentType(APPLICATION_JSON_VALUE);
                new ObjectMapper().writeValue(response.getOutputStream(), tokens);

            } catch (Exception e){
                log.error("Error refreshing token: {}", e.getMessage());
                response.setHeader("error","Error refreshing token: "+e.getMessage());
                response.setStatus(FORBIDDEN.value());
                Map<String, String> error = new HashMap<>();
                error.put("error", "Verification error");
                response.setContentType(APPLICATION_JSON_VALUE);
                new ObjectMapper().writeValue(response.getOutputStream(), error);
            }
        }else{
            throw new RefreshTokenMissingException();
        }
    }

}

AppUserRepository.java

public interface AppUserRepository extends JpaRepository<AppUser, Long> {
    AppUser findByUsername(String username);
}

AppUserService.java

public interface AppUserService {
    AppUser save(AppUser appUser) throws AppUserDuplicatedException;
    void linkRoleToUser(String username, String roleName) throws AppUserNotFoundException, RoleNotFoundException;
    AppUser findByUsername(String username);
    List<AppUser> findAll();

    void init() throws RoleDuplicatedException, AppUserDuplicatedException;
}

AppUserServiceImpl.java

@Service
@RequiredArgsConstructor
@Transactional
@Slf4j
public class AppUserServiceImpl implements AppUserService, UserDetailsService {

    final AppUserRepository appUserRepository;
    final RoleRepository roleRepository;
    final RoleService roleService;
    final PasswordEncoder passwordEncoder;

    @Override
    public AppUser save(AppUser appUser) throws AppUserDuplicatedException {
        if (appUserRepository.findByUsername(appUser.getUsername()) != null) {
            log.error("User with username: {} not found", appUser.getUsername());
            throw new AppUserDuplicatedException(appUser.getUsername());
        }
        log.info("Saving user with username: {}", appUser.getUsername());
        appUser.setPassword(passwordEncoder.encode(appUser.getPassword()));
        return appUserRepository.save(appUser);
    }

    @Override
    public void linkRoleToUser(String username, String roleName) throws AppUserNotFoundException, RoleNotFoundException {
        AppUser userFromDb = appUserRepository.findByUsername(username);
        if (userFromDb == null) {
            log.error("User with username: {} not found", username);
            throw new AppUserNotFoundException(username);
        }
        Role roleFromDb = roleRepository.findByName(roleName);
        if (roleFromDb == null) {
            log.error("Role with name: {} not found", roleName);
            throw new RoleNotFoundException(roleName);
        }
        userFromDb.getRoles().add(roleFromDb);
        log.info("Added role: {} to user: {}", roleName, username);
    }

    @Override
    public AppUser findByUsername(String username) {
        log.info("Retrieving user: {}", username);
        return appUserRepository.findByUsername(username);
    }

    @Override
    public List<AppUser> findAll() {
        log.info("Retrieving all users");
        return appUserRepository.findAll();
    }

    @Override
    public void init() throws RoleDuplicatedException, AppUserDuplicatedException {
        appUserRepository.deleteAll();
        roleRepository.deleteAll();
        AppUser user = new AppUser();
        user.setName("elattar saad");
        user.setUsername("xrio");
        user.setPassword("verystrongpwd");
        Role role = new Role();
        role.setName("SUPER_ADMIN");
        roleService.save(role);
        user.setRoles(Collections.singletonList(role));
        save(user);
    }

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        AppUser userFromDb = appUserRepository.findByUsername(username);
        if (userFromDb == null){
            log.error("User : {} is nowhere to be found", username);
            throw new UsernameNotFoundException("User : "+username+" is nowhere to be found");
        }
        Collection<SimpleGrantedAuthority> authorities = new ArrayList<>();
        userFromDb.getRoles().forEach(role ->
            authorities.add(new SimpleGrantedAuthority(role.getName()))
        );
        return new User(userFromDb.getUsername(), userFromDb.getPassword(), authorities);
    }
}

AppUserException.java

@EqualsAndHashCode(callSuper = true)
@Data
@AllArgsConstructor
public class AppUserException extends Exception{
    protected final String username;
}

AppUserDuplicatedException.java

public class AppUserDuplicatedException extends AppUserException {
    public AppUserDuplicatedException(String username) {
        super(username);
    }
}

AppUserNotFoundException.java

public class AppUserNotFoundException extends AppUserException{
    public AppUserNotFoundException(String username) {
        super(username);
    }
}

RefreshTokenMissingException.java

public class RefreshTokenMissingException extends Exception{}

TokenExpiredException.java

public class TokenExpiredException extends Exception{}

AppUserExceptionHandler.java

@ControllerAdvice
public class AppUserExceptionHandler {


    @ExceptionHandler(AppUserNotFoundException.class)
    private ResponseEntity<?> handleAppUserNotFoundException(AppUserNotFoundException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_FOUND)
                .body("User ["+exception.getUsername()+"] nowhere to be found");
    }

    @ExceptionHandler(AppUserDuplicatedException.class)
    private ResponseEntity<?> handleAppUserDuplicatedException(AppUserDuplicatedException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_ACCEPTABLE)
                .body("User ["+exception.getUsername()+"] already exists");
    }


    @ExceptionHandler(RefreshTokenMissingException.class)
    private ResponseEntity<?> handleRefreshTokenMissingException(RefreshTokenMissingException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_ACCEPTABLE)
                .body("Refresh token is missing");
    }

    @ExceptionHandler(TokenExpiredException.class)
    private ResponseEntity<?> handleTokenExpiredException(TokenExpiredException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_ACCEPTABLE)
                .body("The provided token is expired");
    }
}

Role.java

@Entity
@Data
@NoArgsConstructor
@AllArgsConstructor
public class Role {
    @Id
    @GeneratedValue(strategy = GenerationType.AUTO)
    private Long id;
    private String name;
}

RoleRepository.java

public interface RoleRepository extends JpaRepository<Role, Long> {
    Role findByName(String name);
}

RoleService.java

public interface RoleService {
    Role save(Role role) throws RoleDuplicatedException;
}

RoleServiceImpl.java

@Data
@Service
@Transactional
@Slf4j
public class RoleServiceImpl implements RoleService{

    final RoleRepository roleRepository;

    @Override
    public Role save(Role role) throws RoleDuplicatedException {
        if (roleRepository.findByName(role.getName()) != null) {
            log.error("Role with name: {} already exists", role.getName());
            throw new RoleDuplicatedException(role.getName());
        }
        log.info("Saving role with name: {}", role.getName());
        return roleRepository.save(role);
    }
}

RoleException.java

@EqualsAndHashCode(callSuper = true)
@Data
@AllArgsConstructor
public class RoleException extends Exception{
    protected final String name;
}

RoleDuplicatedException.java

public class RoleDuplicatedException extends RoleException {
    public RoleDuplicatedException(String username) {
        super(username);
    }
}

RoleNotFoundException.java

public class RoleNotFoundException extends RoleException {
    public RoleNotFoundException(String username) {
        super(username);
    }
}

RoleExceptionHandler.java

@ControllerAdvice
public class RoleExceptionHandler {


    @ExceptionHandler(RoleNotFoundException.class)
    private ResponseEntity<?> handle(RoleNotFoundException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_FOUND)
                .body("User ["+exception.getName()+"] nowhere to be found");
    }

    @ExceptionHandler(RoleDuplicatedException.class)
    private ResponseEntity<?> handle(RoleDuplicatedException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_ACCEPTABLE)
                .body("User ["+exception.getName()+"] already exists");
    }


    @ExceptionHandler(RefreshTokenMissingException.class)
    private ResponseEntity<?> handleRefreshTokenMissingException(RefreshTokenMissingException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_ACCEPTABLE)
                .body("Refresh token is missing");
    }

    @ExceptionHandler(TokenExpiredException.class)
    private ResponseEntity<?> handleTokenExpiredException(TokenExpiredException exception){
        return ResponseEntity
                .status(HttpStatus.NOT_ACCEPTABLE)
                .body("The provided token is expired");
    }
}

SecurityBeanConfig.java

@Configuration
public class SecurityBeanConfig {

    @Bean
    PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

SecurityConfig.java

@EqualsAndHashCode(callSuper = true)
@Configuration
@EnableWebSecurity
@RequiredArgsConstructor
@Slf4j
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    final UserDetailsService userDetailsService;
    final BCryptPasswordEncoder bCryptPasswordEncoder;

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.userDetailsService(userDetailsService).passwordEncoder(bCryptPasswordEncoder);
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable();
        http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        http.authorizeRequests().antMatchers("/login", "/users/refresh").permitAll();
        http.authorizeRequests().antMatchers("/users/**").hasAnyAuthority("SUPER_ADMIN", "TECH_ADMIN");
        // More config to be added here
        http.authorizeRequests().anyRequest().authenticated();
        http.addFilterBefore(new AppAuthorizationFilter(), UsernamePasswordAuthenticationFilter.class);
        http.addFilter(new AppAuthenticationFilter(authenticationManagerBean()));
    }

    @Bean
    @Override
    public AuthenticationManager authenticationManagerBean() throws Exception{
        return super.authenticationManagerBean();
    }
}

AppAuthenticationFilter.java

import static io.xrio.gateway.utils.JwtUtils.ACCESS_TOKEN_ID;
import static io.xrio.gateway.utils.JwtUtils.REFRESH_TOKEN_ID;
import static org.springframework.http.MediaType.APPLICATION_JSON_VALUE;


@RequiredArgsConstructor
@Slf4j
public class AppAuthenticationFilter extends UsernamePasswordAuthenticationFilter {

    final AuthenticationManager authenticationManager;

    @Override
    public Authentication attemptAuthentication(HttpServletRequest request, HttpServletResponse response) throws AuthenticationException {
        String username = request.getParameter("username");
        String password = request.getParameter("password");
        log.info("Username: {}", username);
        UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(username, password);
        return authenticationManager.authenticate(token);
    }

    @Override
    protected void successfulAuthentication(HttpServletRequest request, HttpServletResponse response, FilterChain chain, Authentication authResult) throws IOException, ServletException {
        User user = (User) authResult.getPrincipal();
        String accessToken = JwtUtils.createAccessToken(user);
        String refreshToken = JwtUtils.createRefreshToken(user);
        Map<String, String> tokens = new HashMap<>();
        tokens.put(ACCESS_TOKEN_ID, accessToken);
        tokens.put(REFRESH_TOKEN_ID, refreshToken);
        response.setContentType(APPLICATION_JSON_VALUE);
        new ObjectMapper().writeValue(response.getOutputStream(), tokens);
    }
}

JwtUtils.java

public class JwtUtils {

    public static final String SECRET = "your-secret";
    public static final String ISSUER = "your-issuer";
    public static final long ACCESS_TOKEN_VALIDITY = 600000;
    public static final long REFRESH_TOKEN_VALIDITY = 604800000;
    public static final String BEARER = "Bearer "; // do not remove the space!
    public static final String CLAIMS_KEY = "ROLES";
    public static final String ACCESS_TOKEN_ID = "accessToken";
    public static final String REFRESH_TOKEN_ID = "refreshToken";


    public static Algorithm getAlgorithm() {
        return Algorithm.HMAC256(SECRET.getBytes());
    }

    public static JWTVerifier getVerifier() {
        return JWT.require(getAlgorithm()).build();
    }

    public static DecodedJWT getDecoded(String token) {
        return getVerifier().verify(token);
    }

    public static String createAccessToken(UserDetails userDetails) {
        return JWT.create()
                .withSubject(userDetails.getUsername())
                .withExpiresAt(new Date(System.currentTimeMillis() + ACCESS_TOKEN_VALIDITY))
                .withIssuer(ISSUER)
                .withIssuedAt(new Date())
                .withClaim(CLAIMS_KEY, userDetails.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList()))
                .sign(getAlgorithm());
    }

    public static String createRefreshToken(UserDetails userDetails) {
        return JWT.create()
                .withSubject(userDetails.getUsername())
                .withExpiresAt(new Date(System.currentTimeMillis() + REFRESH_TOKEN_VALIDITY))
                .withIssuer(ISSUER)
                .withIssuedAt(new Date())
                .withClaim(CLAIMS_KEY, userDetails.getAuthorities().stream().map(GrantedAuthority::getAuthority).collect(Collectors.toList()))
                .sign(getAlgorithm());
    }

    public static String createAccessToken(AppUser userDetails) {
        return JWT.create()
                .withSubject(userDetails.getUsername())
                .withExpiresAt(new Date(System.currentTimeMillis() + ACCESS_TOKEN_VALIDITY))
                .withIssuer(ISSUER)
                .withIssuedAt(new Date())
                .withClaim(CLAIMS_KEY, userDetails.getRoles().stream().map(Role::getName).collect(Collectors.toList()))
                .sign(getAlgorithm());
    }

    public static String createRefreshToken(AppUser userDetails) {
        return JWT.create()
                .withSubject(userDetails.getUsername())
                .withExpiresAt(new Date(System.currentTimeMillis() + REFRESH_TOKEN_VALIDITY))
                .withIssuer(ISSUER)
                .withIssuedAt(new Date())
                .withClaim(CLAIMS_KEY, userDetails.getRoles().stream().map(Role::getName).collect(Collectors.toList()))
                .sign(getAlgorithm());
    }

    public static UsernamePasswordAuthenticationToken getUsernamePasswordAuthenticationToken(String token) throws TokenExpiredException {
        DecodedJWT decodedJWT = getDecoded(token);
        if(decodedJWT.getExpiresAt().before(new Date())) {
            throw new TokenExpiredException();
        }
        String username = decodedJWT.getSubject();
        String[] roles = decodedJWT.getClaim(CLAIMS_KEY).asArray(String.class);
        Collection<SimpleGrantedAuthority> authorities = new ArrayList<>();
        stream(roles).forEach(role->
            authorities.add(new SimpleGrantedAuthority(role))
        );
        return new UsernamePasswordAuthenticationToken(username, null, authorities);
    }
}

RibbonEurekaClientConfig.java

public class RibbonEurekaClientConfig {

    @Bean
    public IPing ribbonPing(IClientConfig config) {
        return new NIWSDiscoveryPing();
    }

    @Bean
    public IRule ribbonRule(IClientConfig config) {
        return new AvailabilityFilteringRule();
    }

    @Bean
    public ServerList<Server> getServerList(IClientConfig config) {
        DynamicServerListLoadBalancer<Server> serverDynamicServerListLoadBalancer = new DynamicServerListLoadBalancer<>();
        serverDynamicServerListLoadBalancer.initWithNiwsConfig(config);

        return serverDynamicServerListLoadBalancer.getServerListImpl();
    }

}

pom.xml

<dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
     <groupId>com.h2database</groupId>
     <artifactId>h2</artifactId>
     <scope>runtime</scope>
</dependency>

pom.xml

<dependency>
     <groupId>org.springframework.boot</groupId>
     <artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
     <groupId>com.auth0</groupId>
     <artifactId>java-jwt</artifactId>
     <version>3.18.3</version>
</dependency>

pom.xml

<dependency>
     <groupId>org.springframework.security</groupId>
     <artifactId>spring-security-test</artifactId>
     <scope>test</scope>
</dependency>

pom.xml

<dependency>
     <groupId>org.projectlombok</groupId>
     <artifactId>lombok</artifactId>
     <optional>true</optional>
</dependency>

pom.xml

<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-netflix-eureka-client</artifactId>
  <version>3.1.0</version>
</dependency>

<dependency>
  <groupId>org.springframework.cloud</groupId>
  <artifactId>spring-cloud-starter-netflix-zuul</artifactId>
  <version>2.2.10.RELEASE</version>
</dependency>

<dependency>
  <groupId>com.netflix.ribbon</groupId>
  <artifactId>ribbon-eureka</artifactId>
  <version>2.3.0</version>
</dependency>

Building An API Gateway With Spring Cloud, Security, Netflix Zuul, Eureka And Ribbon Using JWT Access And Refresh Tokens

Elattar Saad

Mon, 20th September 2021

Building the security agent

The user module

The role module

Spring Security configurations

Building the Security filters

The authentication filter

Building the reverse proxy using Netflix Zuul

Finally,

Read next

Building An API Gateway With Spring Cloud, Security, Netflix Zuul, Eureka And Ribbon Using JWT Access And Refresh Tokens

Elattar Saad

Mon, 20th September 2021

Building the security agent

The user module

The role module

Spring Security configurations

Building the Security filters

The authentication filter

Building the reverse proxy using Netflix Zuul

Finally,

Read next