81 lines
2.5 KiB
Plaintext
81 lines
2.5 KiB
Plaintext
==============================================================================
|
|
docs/output/04-gateway-token-relay.txt
|
|
Spring Cloud Gateway Server MVC with 'filters: - TokenRelay='.
|
|
GET /edge/relay through the gateway on 8080.
|
|
==============================================================================
|
|
|
|
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8080/edge/relay
|
|
HTTP/1.1 200
|
|
cache-control: no-cache, no-store, max-age=0, must-revalidate
|
|
expires: 0
|
|
pragma: no-cache
|
|
x-content-type-options: nosniff
|
|
x-frame-options: DENY
|
|
x-xss-protection: 0
|
|
Content-Type: application/json
|
|
|
|
{
|
|
"strategy": "bearer token relayed from the incoming request",
|
|
"downstream": {
|
|
"service": "downstream:8082",
|
|
"strictValidation": false,
|
|
"sub": "alice",
|
|
"aud": [
|
|
"downstream-api"
|
|
],
|
|
"iss": "http://127.0.0.1:9000",
|
|
"scope": "[orders.write, orders.read]",
|
|
"client_id": null,
|
|
"authorities": [
|
|
"SCOPE_orders.read",
|
|
"FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
|
|
"SCOPE_orders.write"
|
|
],
|
|
"cnf": null,
|
|
"orders": [
|
|
{
|
|
"total": "42.00",
|
|
"id": 1
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
$ curl 127.0.0.1:8080/edge/relay # no Authorization header at all
|
|
status 401
|
|
|
|
# and the identical route with the TokenRelay filter REMOVED:
|
|
$ curl -H "Authorization: Bearer $TOKEN" 127.0.0.1:8080/norelay/x
|
|
{
|
|
"strategy": "bearer token relayed from the incoming request",
|
|
"downstream": {
|
|
"service": "downstream:8082",
|
|
"strictValidation": false,
|
|
"sub": "alice",
|
|
"aud": [
|
|
"downstream-api"
|
|
],
|
|
"iss": "http://127.0.0.1:9000",
|
|
"scope": "[orders.write, orders.read]",
|
|
"client_id": null,
|
|
"authorities": [
|
|
"SCOPE_orders.read",
|
|
"FactorGrantedAuthority [authority=FACTOR_BEARER, issuedAt=<timestamp>]",
|
|
"SCOPE_orders.write"
|
|
],
|
|
"cnf": null,
|
|
"orders": [
|
|
{
|
|
"total": "42.00",
|
|
"id": 1
|
|
}
|
|
]
|
|
}
|
|
}
|
|
|
|
# TokenRelay relays the access token of the currently authenticated USER - the one
|
|
# obtained by oauth2Login(). This gateway has no oauth2Login, so there is no
|
|
# authorized client to read a token from, and the filter contributes nothing. What
|
|
# reaches the edge service is whatever Authorization header the caller sent, because
|
|
# the gateway proxied it. TokenRelay is not 'forward the incoming bearer token'.
|