Business
Jobs
  • About Us
  • Solutions
    • Job Postings
      Post your job and receive qualified candidates in 48h.
    • Candidate Assessments
      500+ technical and psychological tests, plus anti-fraud.
    • Headhunting
      Tailor-made executive search from start to finish.
    • Payroll + EOR
      Payroll dispersal and EOR across 15+ LATAM countries.
  • Pricing
  • Jobs

0

569
Views
Adding JWT to Spring Boot Microservices

I currently have an app on aws that uses spring boot microservices for back-end and ReactJS for front-end.

The way it currently works is that a user logs in using username and password and a fetch call is made to an account microservice. There I do a basic username and pw check with db and send back a True or False response.

If True, the user gets logged in and redirected to products page where a fetch call is made to product service to get list of all products.

I now want to introduce JWT authorisation, so that calls to product service can only be made by logged in users.

My question is - can I introduce it in my current account service or do I have to put something in front of both services (currently they share a load balancer). Or maybe I need to direct product service traffic through account service?

Also, if I can introduce it in my current account service, how do I share the required key to product service so it can validate the request when it comes in?

Cheers, Kris

over 4 years ago · Santiago Trujillo
1 answers
Answer question

0

For this purpose the generic approach is to have an API Gateway layer i.e. a Microservice only which has to take care of following things -

  1. Do the task of authentication and generate a JWT token for the user
  2. Read the roles and responsibilities after decoding the token, every time a call is made by a user for authorization purpose
  3. Once you get the role of user from here, you can create routes in API Gateway for each service to check like whether he can access that functionality or not, in your case let's say user's role is "warehouse Admin" and he is eligible to take care of product and related info, then he can access product service, for this you can do a role check at API Gateway layer only, when the request comes to access from routes related to product service (let's say its "/products" ). Hence you are maintaining the authenticity checks at API Gateway layer only.
  4. Or in the otherwise case if you want to maintain an account service as well to take care of doing the authentication and authorization, then you have to direct the calls from API Gateway to account service and route the request to related backend services, once the response arrives from account service carrying the roles and permissions for the user.
over 4 years ago · Santiago Trujillo Report
Answer question
Find remote jobs

Discover the new way to find a job!

Top jobs
Top job categories
Business
Post vacancy Pricing Sales
Legal
Terms and conditions Privacy policy
© 2026 PeakU Inc. All Rights Reserved.
Andres GPT
Show me some job opportunities
There's an error!