Java Community | Help. Code. Learn.•3y ago

Spring Boot Microservice- Security defined in the service always return 403

Hi, I have a problem about Spring Boot Microservices. After creating user login and making a request to order service, I get 403 forbidden issue. I think there is a problem in security config in api gateway or order service but I couldn't solve it. How can I do that? Here is the link : https://stackoverflow.com/questions/74462679/spring-boot-microservice-security-defined-in-the-service-always-return-403

Stack Overflow

Spring Boot Microservice- Security defined in the service always re...

I tried to implement and example of Spring Boot Microservice. It consists of eureka server, config server, api gateway(jwt filter), auth service, product service, order service and lastly payment s...

13 Replies

JavaBot•3y ago

Hey, @direct_x_34! Please remember to /close this post once your question has been answered!

direct_x_34OP•3y ago

@everyone

Tomasm21•3y ago

Have you tried .permitAll() ?

direct_x_34OP•3y ago

Where do I use it?

Tomasm21•3y ago

right after AntMatchers I'm not expert on this. But I took code from earlier project which had Spring security. All /api endpoints should be authenticated and logins are permitted to all:

//....
http.cors().and().authorizeRequests()

                .antMatchers("/", "/swagger-ui/").permitAll()
                .antMatchers("/createAccount", "/login").permitAll()
                .antMatchers("/api/**").authenticated()
                .and().formLogin()
//...

//....
http.cors().and().authorizeRequests()

                .antMatchers("/", "/swagger-ui/").permitAll()
                .antMatchers("/createAccount", "/login").permitAll()
                .antMatchers("/api/**").authenticated()
                .and().formLogin()
//...

When you will be authenticated then you will have a role

direct_x_34OP•3y ago

Have you ever seen my security config in api gateway, order service and auth service?

direct_x_34OP•3y ago

Tomasm21•3y ago

no. I saw only what you've sent in stackoverflow I think that if you would use permit all then you would not get 403 forbidden response. And I don't know anything more.

direct_x_34OP•3y ago

I already shared the repo link in the stackoverflow before.,

Tomasm21•3y ago

Now I see.

direct_x_34OP•3y ago

I shared how to run the app step by step. Otherwise, someone cannot understand what I mentioned about.

Tomasm21•3y ago

You have security config and gateway config

direct_x_34OP•3y ago

I think you look through my api gateway.

Gaming

Programming

Spring Boot Microservice- Security defined in the service always return 403