JWT 身份验证与授权

In a microservices architecture, securing your APIs is paramount. Spring Cloud Gateway acts as a central entry point, making it the perfect place to enforce security policies.

This lesson focuses on using JSON Web Tokens (JWTs) for both authentication (who is this user?) and authorization (what can this user do?) directly within your Gateway.

A JSON Web Token (JWT) is a compact, URL-safe means of representing claims to be transferred between two parties. It's often used for authentication and information exchange.

• Stateless: The server doesn't need to store session information.
• Self-contained: Contains all the necessary user information and claims.
• Scalable: Easy to use across multiple services without complex session management.

A JWT consists of three parts, separated by dots (.), which are Base64Url-encoded:

• Header: Specifies the token type (JWT) and the signing algorithm (e.g., HMAC SHA256).
• Payload: Contains the claims (statements about an entity, like a user ID or roles).
• Signature: Used to verify the token's authenticity and ensure it hasn't been tampered with. It's created using the header, payload, and a secret key.

It's crucial to distinguish between Authentication (AuthN) and Authorization (AuthZ):

• Authentication: Verifying the identity of a user or service (e.g., validating a JWT's signature and expiration).
• Authorization: Determining if an authenticated user or service has permission to perform a specific action or access a particular resource (e.g., checking user roles from JWT claims).

The Gateway can handle both, ensuring only valid and authorized requests reach your backend services.

To integrate JWT security, your Spring Cloud Gateway project typically needs the spring-cloud-starter-gateway and spring-boot-starter-security dependencies.

While spring-boot-starter-security provides a robust security framework, we'll focus on manually handling JWT validation using Gateway filters to illustrate the core concepts.

When a client sends a request with a JWT, the Gateway intercepts it. The typical flow is:

1. Extract Token: Get the JWT from the Authorization header.
2. Validate Token: Verify its signature, check expiration, and ensure it's well-formed.
3. Extract Claims: Parse the token to get user details and roles.
4. Authorize Request: Based on claims, decide if the request can proceed to the backend service.

We can implement JWT validation using a custom GlobalFilter in Spring Cloud Gateway. This filter will run for all incoming requests before they are routed.

Inside the filter, you'll access the request headers, extract the JWT, and perform your validation logic. If the token is invalid, you can reject the request directly from the Gateway.

This example demonstrates a basic Spring Cloud Gateway application with a GlobalFilter. It logs the presence of an Authorization: Bearer header, simulating the first step of JWT validation. Run it and try accessing /test with an Authorization header!

Once a JWT is validated and its claims (like user roles or scopes) are extracted, you can use these claims for authorization. Spring Cloud Gateway allows you to define authorization rules directly on your routes.

For instance, you could configure a route to only permit requests if the authenticated user has an 'ADMIN' role specified in their JWT payload.

You've learned how Spring Cloud Gateway serves as a critical enforcement point for API security. We covered the basics of JWTs—their structure, benefits, and how they enable stateless authentication and authorization.

By implementing custom filters, you can integrate robust JWT validation and leverage claims to secure access to your microservices, ensuring only authorized requests reach your backend.