Authentication at the edge
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
validate tokens at the gateway without making services blindly trust callers.
Planned topics
- The gateway can validate the JWT (signature, expiry, issuer) and reject bad requests early.
- It forwards identity to services (the token itself, or trusted headers).
- Services must still check authorization for their own data and must not accept unauthenticated requests just because they are "internal".
- Network isolation: only the gateway is exposed; services listen on a private network.
- Use the token's audience and scopes; do not trust identity headers that clients could set (strip them at the edge).
Draft outline details
Demonstration
http.oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()))
.authorizeExchange(a -> a.pathMatchers("/api/products/**").permitAll()
.anyExchange().authenticated());Check your understanding
Why must services still validate identity?
Show answer
A gateway bypass or misroute would otherwise expose them; defense in depth.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.