4

I'm using Spring Cloud Gateway with Keycloak, and authentication works from browser. But, there is no Authorization header with the token, but SESSION cookie instead. I don't want to use cookies at all, but token instead.

Currently, if I post to http://localhost:8080/auth/realms/myrealm/protocol/openid-connect/token to get tokens and try to put access_token in Authorization header with Bearer it doesn't work, but returns login page.

Also if I add keycloak.js to browser page, and after successful login try to add xhttp.setRequestHeader('Authorization', 'Bearer ' + keycloak.token); to Ajax call, it again returns login page.

So how to use Spring Cloud Gateway with Keycloak, from any client with provided valid token at all?

Here is my gateway configuration, and web app behind it with /web/ route doesn't have any security applied. Keycloak is configured with basic public client.

    @Bean
    public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http,
            ReactiveClientRegistrationRepository clientRegistrationRepository) {
        http.oauth2Login();
        http.logout(logout -> logout
                .logoutSuccessHandler(new OidcClientInitiatedServerLogoutSuccessHandler(clientRegistrationRepository)));
        http.authorizeExchange().pathMatchers("/web/private").authenticated()
                .pathMatchers("/web/**").permitAll()
                .anyExchange().authenticated();
        http.headers().frameOptions().mode(Mode.SAMEORIGIN);
        http.csrf().disable();
        return http.build();
    }
Vuk Djapic
  • 816
  • 13
  • 29

1 Answers1

0

If you want to make requests to Spring Gateway with access token you need to make it a resource server: https://stackoverflow.com/a/66923312/11122338

Dmitri Ciornii
  • 119
  • 2
  • 4