title: Spring Cloud Gateway with spring-boot-starter-web
body: <p>I am creating gateway for Spring Boot microservices using Spring Cloud Gateway. Gateway is also responsible for JWT authorization using Spring Security.</p>
  <pre><code>public class JwtAuthorizationFilter extends BasicAuthenticationFilter {
  
      ...
  
      @Override
      protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain)
              throws IOException, ServletException {
  
          String header = request.getHeader(JwtProperties.HEADER_STRING);
  
          if (header == null || !header.startsWith(JwtProperties.TOKEN_PREFIX)) {
              chain.doFilter(request, response);
              return;
          }
  
          Authentication authentication = getUsernamePasswordAuthentication(request);
          SecurityContextHolder.getContext().setAuthentication(authentication);
  
          chain.doFilter(request, response);
      }
  
      private Authentication getUsernamePasswordAuthentication(HttpServletRequest request) {
          String token = request.getHeader(JwtProperties.HEADER_STRING).replace(JwtProperties.TOKEN_PREFIX, &quot;&quot;);
  
          DecodedJWT decodedJWT = JWT.require(Algorithm.HMAC512(JwtProperties.SECRET.getBytes())).build().verify(token);
          String username = decodedJWT.getSubject();
  
          if (username != null) {
              UserPrincipal principal = (UserPrincipal) userPrincipalService.loadUserByUsername(username);
              Authentication auth = new UsernamePasswordAuthenticationToken(username, null, principal.getAuthorities());
              return auth;
          }
          return null;
      }
  
  }
  </code></pre>
  <p>This filter is registred in configure method like this:</p>
  <pre><code>@Configuration
  @EnableWebSecurity
  public class ApplicationSecurityConfig extends WebSecurityConfigurerAdapter {
      
      ...
      
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .cors()
              .and()
              .csrf().disable()
              .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
              .and()
              .addFilter(new JwtAuthorizationFilter(authenticationManager(), userPrincipalService))
              .authorizeRequests()
              .antMatchers(HttpMethod.POST, &quot;/login&quot;).permitAll()
              ...
              .anyRequest().authenticated();
          
      }
  ...
  }
  </code></pre>
  <p>As you can see, Spring Security is using HttpServletRequest, HttpServletResponse, FilterChain interfaces which belong to spring-boot-starter-web. But that is <strong>main problem</strong> beacause it's incompatible with spring cloud gateway.</p>
  <pre><code>Spring MVC found on classpath, which is incompatible with Spring Cloud Gateway at this time. Please remove spring-boot-starter-web dependency.
  </code></pre>
  <p>Is there any way to avoid this error or any different solution for implementing jwt authorization filter on gateway?
  Thanks!</p>