<p>There is architecture where spring boot cloud api gateway acts as an entry point to the entire system. Since it is used as entry point it handle all incoming requests and at some point it would be needed to scale it. All system components including api-gateway is deployed into kubernetes. And in the current setup spring boot cloud api gateway take session identifier from the cookie. This session cookie is used on api-gateway side to map related JWT token before sending request to downstream microservices. This setup won't work when there will be more then one instance of api-gateway due to the statefull session with cookie. Could you please advice how to resolve this issue? I can see few direction here, but not sure which one to choose and how to achieve them:</p>
<ol>
<li>Switch API gateway to use jwt token in authorization header instead of cookie, so API-gateway will send to the client JWT token after successfull authentication and client will store it and send it with each request (client also will be responsible for access token refresh logic)</li>
<li>Make sticky session between client (browser) and api gateway (kubernetes pod), so browser will always go to the specific pod where server would be able to do the mapping between passed cookie and JWT token stored in pod as part of the JVM</li>
</ol>
<p>Please help to choose the option and please sugest how to achive them</p>

fashuser
<p>If you are using microservices architecture, it's better to use stateless services.</p>
<p>Statelessness has several advantages for microservices, such as improved scalability due to load balancing across multiple instances without worrying about synchronizing the state, reduced complexity from fewer dependencies and side effects, and enhanced reliability from being more resilient to failures while recovering and resuming operations without losing or corrupting the state.</p>
<p>I would say, use JWT instead of cookies and make your gateway stateless.
check the authorization header and validate JWT in a spring gateway filter, then pass the user data like ID, name, or whatever you carry in the token to the downstream services.</p>
<p>See also these:</p>
<p><a href="https://medium.com/@rajithgama/spring-cloud-gateway-security-with-jwt-23045ba59b8a" rel="nofollow noreferrer">https://medium.com/@rajithgama/spring-cloud-gateway-security-with-jwt-23045ba59b8a</a></p>
<p><a href="https://spring.io/blog/2019/08/16/securing-services-with-spring-cloud-gateway" rel="nofollow noreferrer">https://spring.io/blog/2019/08/16/securing-services-with-spring-cloud-gateway</a></p>
