Spring Boot GraphQL Tutorial #31 – Spring Security Authorization
Welcome to episode 31 from the Swiss Alps!
In this episode we will configure our Spring Boot GraphQL server with Spring Security pre authorization.
In order to use pre-auth, you must ensure that all graphql requests have been previously authorized by an upstream service. For example, All Ingres traffic to this graphql service must bypass an upstream proxy node that will validate the request’s JWT token. If the JWT token is valid, then the proxy will forward the request into this graphql server. This code alone provides no authorization and is not production ready alone. Read more about pre-auth patterns before using this.
This proxy pattern is getting more common among kubernetes / service-mesh / side car enabled technologies such as istio. You will find an istio security architecture diagram linked at the bottom of this bio. There are many sidecar proxy options such as Kong or Envoy.
Personally I see many benefits of this pattern, as we can extract boilerplate, hard to maintain, error prone authorization configuration OUT of our application code.
This allows for a clearer separation of concerns. Authorization policies and mutual TLS in one world, and application code in another.
For a more old-school spring security approach where the real auth code lives in the application code (with explanation), see my other spring security REST example: • Spring Boot Security Tutorial | REST ...
Forwarding additional headers containing the extracted authorization data may allow for a smoother transition to support other authentication methods. For example, if you can avoid your app code from decoding JWT base64 or having specific auth logic - then you can focus on the sidecar auth migration with minimal application code changes. Just think if you have 30+ microservices? An alternative would be to support a shared library and bump the app’s dependencies first.
The spring security context is thread bound. Luckily we can propagate the spring security context into our thread pools and executors. This will allow us to have spring security annotations and method level security on asynchronous threads / execution. For example @Async. You can propagate the security context by wrapping your executor in Spring's DelegatingSecurityContextExecutorService. Java doc linked below.
In the video I forgot to mark the PreAuthenticatedAuthenticationProvider as a Spring Bean. That's why you see the default spring security fallback user/password on the logs.
For anyone interested, I recorded this video after a enjoyable hike to the top of Niederhorn in the Bernese Oberland. Recording at a height of 2000m, you can see across the jungfrau moutnains and region. Clear views from Interlaken to the mightly peaks of Jungfrau, Jungfraujoch (top of europe – can get the train up), Monch, Eiger, Wetterhorn etc!
Have a good day Cheers!
Philip Istio security: https://istio.io/latest/docs/concepts...
Istio security architecture diagram: https://istio.io/latest/docs/concepts...
OpenShift preauth example: https://www.openshift.com/blog/adding...
Spring Boot GraphQL Java: https://github.com/graphql-java-kicks... Kong API gateway: https://konghq.com/
Envoy proxy: https://www.envoyproxy.io/
Spring Security Architecture: https://spring.io/guides/topicals/spr...
DelegatingSecurityContextExecutorService: https://docs.spring.io/spring-securit...