Adding JWT to Spring Boot Microservices

user_13426164 0
Viewed 346

I currently have an app on aws that uses spring boot microservices for back-end and ReactJS for front-end.

The way it currently works is that a user logs in using username and password and a fetch call is made to an account microservice. There I do a basic username and pw check with db and send back a True or False response.

If True, the user gets logged in and redirected to products page where a fetch call is made to product service to get list of all products.

I now want to introduce JWT authorisation, so that calls to product service can only be made by logged in users.

My question is - can I introduce it in my current account service or do I have to put something in front of both services (currently they share a load balancer). Or maybe I need to direct product service traffic through account service?

Also, if I can introduce it in my current account service, how do I share the required key to product service so it can validate the request when it comes in?

Cheers, Kris

jwt-auth spring-boot amazon-web-services api java
1 Answers

For this purpose the generic approach is to have an API Gateway layer i.e. a Microservice only which has to take care of following things -

  1. Do the task of authentication and generate a JWT token for the user
  2. Read the roles and responsibilities after decoding the token, every time a call is made by a user for authorization purpose
  3. Once you get the role of user from here, you can create routes in API Gateway for each service to check like whether he can access that functionality or not, in your case let's say user's role is "warehouse Admin" and he is eligible to take care of product and related info, then he can access product service, for this you can do a role check at API Gateway layer only, when the request comes to access from routes related to product service (let's say its "/products" ). Hence you are maintaining the authenticity checks at API Gateway layer only.
  4. Or in the otherwise case if you want to maintain an account service as well to take care of doing the authentication and authorization, then you have to direct the calls from API Gateway to account service and route the request to related backend services, once the response arrives from account service carrying the roles and permissions for the user.
user_104547360
Related