title: Securing REST microservices with Spring Security
body: <p>I'm looking for a best-practice and efficient solution to secure multiple microservices communicating via REST to a Web Client application.</p>
  
  <p><strong>Current setup</strong>:</p>
  
  <p>These microservices are made in Java, with Spring Framework and run into Docker containers.</p>
  
  <p>The client is an Angular 2 application.</p>
  
  <p>I made a new µService that will act as a "<em>gateway</em>" and be the only communication point between my web client and my other services.</p>
  
  <p>I retrieve a JWT encrypted token from a remote authentication API (let's call it LOCK)</p>
  
  <p><strong>Solution I was thinking about</strong>:</p>
  
  <p><a href="https://i.stack.imgur.com/ajEpM.png" rel="noreferrer"><img src="https://i.stack.imgur.com/ajEpM.png" alt="enter image description here"></a></p>
  
  <p>I could store the login JWT into a cookie, and send it to the gateway.</p>
  
  <p>The gateway embed in the final payload sent to the concerned µService the token and store the user if it's new into a database.</p>
  
  <p>The microservice then get the query, checks in the remote authentication service the user role, and if it's sufficient, it returns a 200 status with result.</p>
  
  <p><strong>Edit</strong></p>
  
  <p>We will need to have a RabbitMQ Broker into our µServices hive, and thus, to use the WebSockets. In order to secure WebSockets in the same way as securing REST APIs, I'm not sure if we still should manage security in a gateway, and maybe manage it at the microservice level by itself. Because lots of messages will transit, and we should maybe get rid a middleware that will slow down the thing.</p>
  
  <p><strong>Questions</strong>:</p>
  
  <p>Is it a good practice ? What could possibly be done better ? Do you have any example of things done that fills the same needs ? Thanks a lot for your shares &amp; thoughts.</p>