title: Spring Netflix Zuul: Authenticate and Route the same request
body: <p>I have a bunch of services that sit behind a Zuul Edge Server. The Zuul Edge Server also performs authentication. The session is shared with all services using Spring Session. I want to be able to authenticate and route the request to a service in the same flow. I looked at <a href="https://github.com/spring-guides/tut-spring-security-and-angular-js/tree/master/double" rel="nofollow">Dave Syer's tutorial</a> where a Gateway Server can authenticate and route requests.</p>
  
  <p>On that project, the following commands work:</p>
  
  <ul>
  <li><code>curl -u admin:admin http://localhost:8080/user</code></li>
  <li><code>curl -c cookie.txt -u admin:admin http://localhost:8080/user 
  &amp;&amp; curl -b cookie.txt http://localhost:8080/admin/user</code></li>
  </ul>
  
  <p>I was expecting this to work as well but it doesn't:</p>
  
  <ul>
  <li><code>curl -u admin:admin http://localhost:8080/admin/user</code></li>
  </ul>
  
  <p>I was expecting the Gateway server to authenticate, create a redis session, route the request to admin service which would have picked the Authentication from redis session. The request is being routed to admin service, but it also attempts a Basic Authentication and fails.</p>
  
  <p>This is what I see in admin service's logs:</p>
  
  <pre><code>o.s.s.w.a.www.BasicAuthenticationFilter  : Basic Authentication Authorization header found for user 'admin'
  o.s.s.authentication.ProviderManager     : Authentication attempt using org.springframework.security.authentication.dao.DaoAuthenticationProvider
  o.s.s.a.dao.DaoAuthenticationProvider    : User 'admin' not found
  o.s.s.w.a.www.BasicAuthenticationFilter  : Authentication request for failed: org.springframework.security.authentication.BadCredentialsException: Bad credentials
  </code></pre>
  
  <p>I get an HTTP 401 Unauthorized response. </p>
  
  <p>I also tried to disable HTTP Basic Authentication in admin service, but then I get HTTP 403 Forbidden response.</p>
  
  <p>Is there some way to achieve this?</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I think this can't work due to the way Spring Session is implemented to save session. I'm waiting for a response to my <a href="https://github.com/spring-projects/spring-session/issues/202" rel="nofollow">question</a> on github.</p>