[SOLVED] What should be best practice when I want to authorize REST API calls in Springboot Microservice?

What should be best practice when I want to authorize REST API calls in Springboot Microservice?

Approach-1: I am using Springboot framework for my Microservices design. I want to implement Authentication to all of my Microservices. I am planning to build one Authentication Microservice on top of my all Microservices. Where lets say if my Microservice-A one of path would be /microserviceA/get/employee

and my Authentication MS path to authenticate is /authentication/validate

then I my get/employee will route first to authenticate MS there it will do authentication process and then construct path of my target MS there to make a REST call from authentication.

Approach-2: I will make a direct call to my Microservice-A and there I would intercept and do first call to my authentication to validate the token and once all good then continue the business flow.

Approach-3: To add Authentication gateway in AWS, since this is my one of cloud platform.

What could be the best practice for achieving this flow, thanks in advance, please let me know if anything other than this exist. and which would help me to integrate the flow.

Solution

Use JWT Token for authorization and also add Spring Security for it.

Firstly create an Authentication Microservice (Use Spring Security with UsernamePasswordAuthenticationToken to authenticate users), also for route configurations my recommendation is to use spring-cloud-starter-gateway and add a JWT filter to validate tokens for incoming requests (You can make it with OncePerRequestFilter (you can check this topic) ), then use @PreAuthorize or @Secured to create access for specific endpoints.

Dependency for JWT validation in Microservices:

<dependency>
    <groupId>io.jsonwebtoken</groupId>
    <artifactId>jjwt</artifactId>
    <version>0.9.1</version>
</dependency>